SaaS in the Real World: Who's Responsible to Secure this Data?

When SaaS applications started growing in popularity, it was unclear who was responsible for securing the data. Today, most security and IT teams understand the shared responsibility model, in which the SaaS vendor is responsible for securing the application, while the organization is responsible for securing their data. 
What’s far murkier, however, is where the data responsibility lies on the

application applications data lies organization responsibility responsible saas saas applications security shared responsibility shared responsibility model teams understand vendor world