Do I need to complete a SaaS request?
Below are examples of when it will NOT need to go through the SRA:
What is not considered a SaaS Solution?
Individual
If an Individual is signing up for something for their sole use, and no personal data is being processed, then this process is not aimed at them. The SRA is for groups of people using a new piece of software hosted in the cloud (SaaS). Generally, this process is aimed at groups of five-plus people. So, for instance, an academic signing up to a subscription service to access some specific academic content or signing up to a portal which provides a software license key for download, is not something that would go through the software risk assessment.
Registering an account
If you are not buying a software solution but instead are registering an account as a means to access something, for example using the ‘Enterprise’ website to hire a car, then this is not a software solution and does not need to go through the software risk assessment.
Inputting data
If you are not inputting personal data, or sensitive data and there are no user accounts except admins - for example 'Career pathways' who can modify the content to show specific info on specific school / course pages.
Virtual Server
If it will be hosted on a LU virtual server for example 'OnPortal' no software risk assessment is required as data will be under Loughborough University's control.