Yup - basically they don't want SaaS they want on-prem. That is a drastically different pricing model and should have a different SLA. I would go so far as to i

Yup - basically they don't want SaaS they want on-prem. That is a drastically different pricing model and should have a different SLA. I would go so far as to include into the pricing the cost of keeping engineers and support people on staff who know this particular build specifically because it is different than what you normally run. You would need to maintain the exact stack they are running to test patches, upgrades, etc. If there is a security vulnerability somewhere in their stack that is running your app, that should be called out as well as not your problem (legally, financially). Similarly if they have access to your running system and muck it up somehow, also not your problem. The large Target breach a few years back was because the HVAC system controls were adjacent to payment systems and attackers got in and installed credit card number swiping. I get their concern with having a vendor's stuff sitting on their network but you should be protecting yourself from them not maintaining things.