The specific prohibitions vary by sanctions program, but there are some that prohibit companies from providing “services” and the answer as to whether that includes SaaS is right there in the name.
Companies are required to do due diligence to determine that they aren’t engaged in activities that are sanctioned. GeoIP is less than 100% accurate… but so is comparing first and last names. Unreliable data is not something inherently unique to the internet.
