3 ms·
I really don't understand how companies just give AWS and GCP access (along with infrastructure and release management) to fly by night SaaS companies like your
by candiddevmike 3y ago
I really don't understand how companies just give AWS and GCP access (along with infrastructure and release management) to fly by night SaaS companies like yourself. No security docs, no compliance audits, nothing. To me, I'd use your customer list as companies to avoid interacting with, because there's a serious lack of due diligence on their part.
- alex_lav 3y agoBecause GCP and AWS give access to "fly by night" devs, companies, products etc. as part of their business? Anyone can create a company, create some dev infrastructure and then _also_ ignore security and "compliance" best practices? What do you think a cloud vendor's role in this process is?
- bovermyer 3y agoThe ad hominem attack and the hostility in your comment are unnecessary.
- suryao 3y agoIf I parse through and get to the concern being voiced, I'd rephrase it as "how can I trust you with access to my cloud". There is no easy answer but here is my response: 1. We take precautions to enable connections through oauth/app mechanisms for VCS integrations and IAM roles for cloud accounts like aws and gcp 2. Our incentives are aligned - we make money only if we earn and keep the trust of our customers 3. We have gone to extra lengths to enable easy exits in case companies want to move out. These, broadly speaking, are true for any other provider that you would use and may now trust for app hosting or CDNs or version control or payments - some of which are SmallCos and some were SmallCos until just a couple of years ago. At some level, it all boils down to "trust us" but hope this provides context.
- alex_suzuki 3y agoThe calm and professional way you respond to a needlessly aggressive comment does you credit.