SaaS vendors are the one who holds the main responsibility for looking after the security of their platform, which covers physical security, infrastructure, and application security. However, the vendors don't own the customer data or take responsibility for how customers use their applications; you need to take action.