| Responsibility Area | SaaS (e.g., Notion, PhonePe) | PaaS (e.g., Heroku, Vercel) | IaaS (e.g., AWS EC2) |
|---|---|---|---|
| Infrastructure (servers, storage, network) | Provider | Provider | Provider |
| Operating System | Provider | Provider | Customer |
| Middleware / Runtime | Provider | Provider | Customer |
| Application / Code | Provider | Customer | Customer |
| Data | Customer (but sometimes limited control) | Customer | Customer |
| Security (OS patching, firewalls) | Provider | Shared (Provider handles OS, Customer handles apps) | Customer |
| Updates / Maintenance | Provider | Provider | Customer |
| Compliance / Governance | Mostly Provider, some Customer policies | Shared | Shared |
There are four main cloud deployment models: