A company subscribes to a Software-as-a-Service (SaaS) email and collaboration platform. During a review of the cloud shared responsibility model, the security team wants to confirm which security task is handled entirely by the SaaS provider rather than the customer. Which task falls to the provider under a SaaS model?