Harrison would also like to see Google Apps provide an offline component that would allow users to work on their local PCs when disconnected from the Internet, a capability he knows Google is pursuing with its Gears technology.

That Harrison would feel more at ease with an SLA is telling. His company isn't an ordinary Google Apps customer. Although the relationship between Google and Abraham Harrison is purely of the vendor-client type, meaning that the company receives no compensation from Google, the Google Apps team has singled it out as a model small business whose feedback it regularly seeks. As a result, Harrison is in close contact with the Google Apps team.

What should a business manager look for in a service level agreement? The most basic item should be an uptime commitment for application availability, ideally 99.9 percent of the time or above. It should also address planned maintenance downtime, which, if too frequent, can become bigger burdens on customers than accidental outages.

When negotiating, inquire whether the SaaS vendor owns its own datacenters or whether it depends on a partner, and be sure to investigate who the partner is and the extent of its infrastructure. Also verify that the SaaS vendor has key certifications, such as the SAS 70 Type II audit.

The SLA should address performance, as well, because an application that is extremely slow will affect a company's operations. It's also a good idea to include provisions for the data created with the applications and to put in writing what responsibility the vendor will assume for data that is lost, corrupted, or stolen, along with statements about the vendor's data security measures and data backup and recovery services.

Kaplan recommends assuming the worst -- that the vendor may go out of business altogether. To protect against that eventuality, customers can request that the vendor bring in a third-party "escrow" provider that will, for example, house the applications source code and data, in case the SaaS vendor goes under.

Business managers need to remember, too, that they must be proactive in securing a satisfying SLA, because SaaS vendors are understandably reluctant to volunteer generous service guarantees. Many elements outside of a SaaS vendor's control can interfere with the performance of its applications and with the integrity of data. Such external factors can include interference from security software on users' PCs, problems with the customer's local network, ISP issues, and structural Internet hiccups.

"Every provider will write an SLA, especially if you ask them, but it's going to cover things that they can control," Burton Group's Maiwald says.

Still, industry experts agree that, little by little, both buyers and SaaS vendors are recognizing the importance of SLAs, so business managers should find securing them progressively easier.

Enterprises leading the way
Help is coming indirectly by way of large enterprises, which initially limited their SaaS deployments to small groups and individual departments but are now extending their rollouts, sometimes companywide, says Forrester analyst Liz Herbert.