For serious cloud/SaaS products, especially B2B stuff, this really shouldn't be a question. When I was at Harvest we sent SSL-for-all in 2009: http://www.getha

For serious cloud/SaaS products, especially B2B stuff, this really shouldn't be a question. When I was at Harvest we sent SSL-for-all in 2009: http://www.getharvest.com/blog/2009/06/unlimited-clients-projects-and-ssl-for-all-plans/ http://www.getharvest.com/blog/2009/06/unlimited-clients-pro... Sure, it costs a little bit of money. But it makes our users little safer when they log into our service. There aren't many levers you have a SaaS product that you can pull to really make user data secure once it leaves your servers. As pwim said, if you can't recover the cost per user then your company must have some big problems. I always frown at a pricing page that says SSL is an add-on, it demonstrates that whomever is running things behind the curtain isn't really concerned about the safety of user data in their app.