I assume much like anything else in an unregulated industry there are varying degress of “abuse.” Some of the lesser known SaaS businesses can fly under the radar but isn’t there the potential that Salesforce.com’s entire business could be in jeopardy if it were to hit the wires that they were using customer data inappropriately or irresponsibly?

My assumption is that a competitor like SugarCRM or Sage CRM Solutions would just love to expose a company like Salesforce.com if they were collecting and using their customers - customers data in ways that would be obvious violations of even the most basic ethics (like selling names or brokering out confidential information). The NY Times would love to do a Sunday Business piece on that!

I think that is the major reason for Reasonable Fear, Uncertainty and Doubt about this sort of data. Banking at ATM’s are somewhat regulated and controlled in ways that may not ‘completely’ protect the customer does raise the level of trust. The self-regulation of the PCI standards does the same for Credit Card data on websites.. until there is a similar set of government or industry regulations that have teeth.. I would seriously doubt putting confidential data blindly into SaaS.

Any SaaS company must be able to show in some clear and transparent way:
1) What it collects
2) What it stores and how?
3) What are the security mechanisms and methodologies you use to protect that data. (using the methodology that if you are protecting your customers information by obscurity.. you aren’t doing enough because the crackers just have to get someone hired in for a short time to make it ‘open’ to them).
4) How do you truly purge that data when asked to.
5) How else do you lower customer risk?
6) What are your general Incident Response Items from customer notification and cleanup to methodologies on trying to rectify and remediate found vulnerabilities.
7) What is a customers rights and responsibilites and what is the companies (in clear English that a high school student can understand).

Yes, our customer info is in Salesforce but we don’t put CC info or social security numbers or copies of their passwords into the system. I assume you do some banking online. Don’t those banks have far more sensitive data such as SS numbers, bank account numbers, etc?

How can you be so caviler about your customers data that is why SF was targeted they want your customer data. SaaS is dangrous because it’s weakest link is always the same the people and they are going to break no matter what you do.

OWN YOUR CUSTOMERS DATA DON’T LET SOME ELSE!