Which of the following is MOST important for an IS auditor to consider when evaluating a Software as a Service (SaaS) arrangement?