From an Enterprise perspective (and I'm in the belly of the fortune 50 beast at a division level ~10bn/yr mfg) SaaS discussions internally aren't really about data security -- they're about lock in and leverage by the vendor. For anything of a certain level of criticality SaaS is just too much vendor leverage. Enterprise software licensing is a vicious lawyer on lawyer battleground with deeply unethical behavior and brinksmanship regularly displayed on both sides. If you think I want to give any of those vendors the possession of my server and data during a dispute, you're nuts. The enterprise SaaS model seems fundamentally flawed.