When SaaS apps first grew in popularity, it wasn't clear who was responsible for securing the data/ Nowadays, most security and IT teams are aware of the shared responsibility model, where the provider is responsible for the app and the organization is responsible for the data. The bigger question today is where does the data responsibility lies on the organization's side?