"Can we host this ourselves?"

Like most hosting questions, it can come from four different worries, and you need to know which one before you answer. A security lead may be asking where the data lives. An IT manager may be asking who has to maintain it. A lawyer may be asking about cross-border transfers, and finance may be asking how it's paid for. Ask once, early: "What's behind the question?" Most cloud vs on-prem buyer questions get easier once you know which of the four you're dealing with.

What you can actually offer

Buyers use cloud terms loosely, so it helps to know the formal version. NIST's definition of cloud computing (SP 800-145) names four deployment models: private cloud, community cloud, public cloud and hybrid cloud.

Sales conversations use a different, more practical vocabulary about who runs the software and where:

Multi-tenant SaaS: one shared instance serves many customers, with each customer's data logically separated.
Single-tenant or dedicated cloud: the vendor runs a separate instance for one customer.
Customer-hosted: the software runs inside the buyer's own AWS, Azure or Google Cloud account.
On-premises: the software runs on hardware the buyer controls, sometimes with no internet connection at all (air-gapped).

If your product is multi-tenant SaaS only, say that plainly in the first answer. "We're SaaS only; we host in these regions" is a complete answer, and it's far better than a vague "we're flexible" that falls apart when security asks for deployment documentation.

Security and legal, the most frequent askers

Security teams usually raise hosting as part of a broader review, often alongside a request for your SOC 2 report (see our post on SOC 2 questions for sales reps). They want to know which cloud provider and regions you use, whether data is encrypted at rest and in transit, whether customers can manage their own encryption keys (BYOK, bring your own key), and who on your side can access customer data.

The cloud providers describe the split of duties as a shared responsibility model; AWS's explanation is a good one to send. The provider secures the underlying infrastructure; the customer secures what they run and how they configure it. With SaaS, your company sits in the middle, and buyers want to know which layers you cover. Unless you've been given approved answers, route the specifics to your security team.

Legal questions tend to come from buyers in the EEA. GDPR restricts transfers of personal data to countries outside the EEA unless conditions are met, such as an adequacy decision or safeguards like Standard Contractual Clauses; the European Commission explains the transfer mechanisms. For US vendors, one detail is worth knowing: on 10 July 2023 the Commission adopted an adequacy decision for the EU-US Data Privacy Framework, which covers transfers from the EEA to US organisations certified under it. Buyers can check whether a company is certified on the official Data Privacy Framework list. Know whether your company appears there and which regions you host in. Anything beyond that goes to legal.

Regulated buyers in government, defence or healthcare sometimes have hosting rules written into policy. Ask to see the requirement. It might permit a dedicated instance in a named region, or it might genuinely mean air-gapped hardware, and those lead to very different conversations.

IT and finance, usually later

IT wants to know who does the work. With on-prem or customer-hosted software, the buyer's team typically installs, upgrades and monitors it, and gets paged when it fails. With SaaS, the vendor carries most of that, and everyone usually runs the current version. Ask IT who would own upgrades if they hosted it themselves. If nobody would, the request often fades.

Finance tends to see SaaS as a subscription expense, while self-hosting can add servers or cloud capacity and staff time to the bill. Don't build that comparison yourself on the call. Ask how they budget for software and bring in your deal desk or SE for the numbers.

Whatever the answer to "What's behind the question?", type it into the CRM in the buyer's own words before you hang up.