The cloud service model stack describes who manages what. Each layer hands off more of the operating burden to the provider and leaves you with less to run. There are four layers worth knowing in 2026: Metal, Infrastructure, Platform, and Software as a Service.
NIST SP 800-145 formally defines three of them (IaaS, PaaS, SaaS). MaaS is a newer industry-recognized model, championed by Canonical MAAS and OpenStack Ironic. It sits one layer below IaaS.
The four layers
MaaS, Metal as a Service. You get a physical server, provisioned on demand. No hypervisor, no neighbors. You bring the OS and everything above it. Useful for GPU training, license-bound software, and workloads unable to tolerate virtualization overhead.
IaaS, Infrastructure as a Service. Virtual machines, block and object storage, virtual networks. The provider runs the hypervisor and physical layer. You manage the OS, runtime, and apps. NIST defines IaaS as “the capability to provision processing, storage, networks, and other fundamental computing resources.”
PaaS, Platform as a Service. You deploy code or containers. The provider runs the runtime, scaling, and patching. Managed Kubernetes, managed databases, and serverless functions all sit here.
SaaS, Software as a Service. A complete application delivered over the network. The user signs in and uses it. Email, CRM, and collaboration tools are the canonical examples.
A 2024 IEEE comparative analysis of these models notes the trade-off is consistent across the stack: more abstraction means less control and easier operations.
ZCP service mapping
Here is where each ZCP product fits:
| Layer | ZCP service |
|---|---|
| MaaS | Private Cloud Build-Out (bare-metal procurement and operation, not self-serve) |
| IaaS | Virtual Machines (CloudStack + KVM), Block Storage (Ceph), Object Storage (S3-compatible), File Storage, VPC + Networking (OPNsense + WireGuard), Security, DNS |
| PaaS | Managed Kubernetes (control plane $99/mo), Observability (Prometheus + Grafana). Serverless is on the roadmap. |
| SaaS | Not offered directly. SaaS ISVs run their products on ZCP IaaS. |
The bulk of ZCP today is IaaS, with a thin and growing PaaS layer. We do not pretend to be a SaaS vendor. We run the layer underneath the SaaS you already use.
Picking a layer
A useful rule: choose the highest layer with the control you need. If you only need to send transactional email, SaaS wins. If you need a Postgres cluster but not the OS underneath it, PaaS. If you need OS-level control or custom networking, IaaS. If you need the physical host (GPUs, hardware-bound licenses, strict isolation), MaaS.
Most workloads land on IaaS or PaaS. ZCP’s catalog is built around those two layers first.