3 ms·

> Comply with all industry security standards relevant to your business such as PCI DSS, HITRUST, ISO27001, and SSAE 18 > Comply with local laws and regulations

by belval 3y ago

> Comply with all industry security standards relevant to your business such as PCI DSS, HITRUST, ISO27001, and SSAE 18 > Comply with local laws and regulations in jurisdictions applicable to your company and your customers, such as GDPR, Binding Corporate Rules, and Standard Contractual Clauses > Ensure data localization requirements are implemented in line with local regulations and contractual obligations Whoever wrote this must be so irrationally out of touch with the startup space (or thinking of older billion dollar unicorn startup) to think that an MVP needs to do any of the above. I wouldn't care about GDPR until I have a somewhat strong EU userbase. Try to respect the spirit sure, but it's not like it will be enforced on a small business within it's first few years of existence. Localization for an MVP is even more out of touch. Make an English US-centric version first (I'm not even American) put it out there and work on localization once you've had some success.

b112 3y ago
Indeed, some of these things take months of work to complete, to expect a startup with a couple of people, working part time, to dedicate time to these is a startup death sentence. And really, most of them don't provide security, they're a checklist. Checklists don't provide security, they provide (sort of) accountability.
- habinero 3y ago
  Frankly, security should not be the top priority of a small startup, unless you deal with extremely sensitive data. I'm not sure it should make the top five. Off the top of my head, survival, product dev, growth, hiring and infra are all more important if you're just starting out
  - b112 3y ago
    Sure, but what if you get hacked, or defaced, or your client info gets out? It could kill you too. It's a balance.
  - evantbyrne 3y ago
    There are certain things that are very difficult to implement if you skip them at launch. For example, encryption of 3rd-party secrets. CircleCI is a good example of a successful company burning themselves badly by treating encryption as an afterthought.
cratermoon 3y ago
There's more to i18n/l10n than the language. Would you be happy seeing all dates in US-centric formats like 05-06-2023 for May 6th, not June 5th, and numbers like 1,245,678.90?
- belval 3y ago
  I think you misinterpreted what I meant. Yes I would prefer that my dates are in my preferred format, but if you are building an MVP, a Minimum Viable Product, spending precious time on getting localization implemented instead of your core features that deliver values to your customers is misguided. It would be like focusing on accessibility when you don't even have a single customer let alone a customer with a handicap. Focus on value, everything else is fluff. When you have a few paying customers and that your product is now mostly proven then it's time to make it better.
  - cratermoon 3y ago
    > It would be like focusing on accessibility when you don't even have a single customer let alone a customer with a handicap. So you're saying people people with accessibility needs are an afterthought, at best? Can you say a bit more about how you justify designing and shipping a product that only appeals to Americans who read English and happen to be perfect physical specimens?
    - belval 3y ago
      > So you're saying people people with accessibility needs are an afterthought, at best? This is such a comical strawman of what I wrote but I'll try to clarify nonetheless. Say you have a startup that wants to disrupt inventory management, your secret sauce "idea" is a feature that allows you to cut stale inventory by 14% by implementing various just-in-time workflows that optimize shipping and reception of new goods. If you are in the US (or most English-speaking countries but considering how combative you are let's say US), your MVP should be the most barebone system that you can ship that will give your customers that 14% reduction and make them want to sign a contract with you. Having a screen-reader-compatible interface might be a must ~1 year down the line when you reach a scale where conforming to ADA is a necessity or realistically when your customers ask for it because of the ADA. It's not about caring or not, it's about assigning your meager startup resources towards the features that the prospective customer will say "yes we want your product". That's what an MVP is. In addition (and perhaps even more importantly), MVPs are useful in determining your product-market fit. You might go over 5 or even 10 MVPs as you pivot and refine your inventory management idea, all without having a single customer keeping the lights on. You could implement accessibility in all of them, or you could implement it only in the version that actually gets adopted by a customer.
rrdharan 3y ago
> I wouldn't care about GDPR until I have a somewhat strong EU userbase. Try to respect the spirit sure, but it's not like it will be enforced on a small business within its first few years of existence. This seems ethically wrong - 1. Even if your user base is not “strong” the privacy of the users you do have still matters and 2. It should be about protecting them not just calculating enforcement risk like a Ford Pinto engineer.
- mrbungie 3y ago
  Maybe it is ethically wrong to launch in EU without complying with GDPR. But if that is the case, then launch somewhere else first and build towards a more secure product in the meantime while you raise money and gather more insights. Don't forget it is a MVP ffs, and that you can be completely open about it (i.e. just say it is in beta or early access phase).
- deleted 3y ago
  [deleted]
- mufti_menk 3y ago
  I will NOT comply with authoritarian demands imposed on me by the EU. My users, MY data. I clearly state how and why I share user data with brokers and users choose of their own volition to use my services. This is NOT unethical.
  - seabass-labrax 3y ago
    Even when accepting users' choice to submit personal data as a justification for retaining the data (which is illegal in more than just the EU, by the way), you may still receive personal data about someone which was not submitted by them voluntarily. This can happen in situations ranging from the normal course of business to customers actively attempting to use your product illegally. You have a duty to deal with a situation like that, and since the GDPR already makes provision for third-party processing of personal data, there is little reason not to go one small step further and extend your process for personal data deletion to users directly.

by belval 3y ago

b112 3y ago

Indeed, some of these things take months of work to complete, to expect a startup with a couple of people, working part time, to dedicate time to these is a startup death sentence. And really, most of them don't provide security, they're a checklist. Checklists don't provide security, they provide (sort of) accountability.

habinero 3y ago
Frankly, security should not be the top priority of a small startup, unless you deal with extremely sensitive data. I'm not sure it should make the top five. Off the top of my head, survival, product dev, growth, hiring and infra are all more important if you're just starting out
- b112 3y ago
  Sure, but what if you get hacked, or defaced, or your client info gets out? It could kill you too. It's a balance.
- evantbyrne 3y ago
  There are certain things that are very difficult to implement if you skip them at launch. For example, encryption of 3rd-party secrets. CircleCI is a good example of a successful company burning themselves badly by treating encryption as an afterthought.

cratermoon 3y ago

There's more to i18n/l10n than the language. Would you be happy seeing all dates in US-centric formats like 05-06-2023 for May 6th, not June 5th, and numbers like 1,245,678.90?

belval 3y ago
I think you misinterpreted what I meant. Yes I would prefer that my dates are in my preferred format, but if you are building an MVP, a Minimum Viable Product, spending precious time on getting localization implemented instead of your core features that deliver values to your customers is misguided. It would be like focusing on accessibility when you don't even have a single customer let alone a customer with a handicap. Focus on value, everything else is fluff. When you have a few paying customers and that your product is now mostly proven then it's time to make it better.
- cratermoon 3y ago
  > It would be like focusing on accessibility when you don't even have a single customer let alone a customer with a handicap. So you're saying people people with accessibility needs are an afterthought, at best? Can you say a bit more about how you justify designing and shipping a product that only appeals to Americans who read English and happen to be perfect physical specimens?
  - belval 3y ago
    > So you're saying people people with accessibility needs are an afterthought, at best? This is such a comical strawman of what I wrote but I'll try to clarify nonetheless. Say you have a startup that wants to disrupt inventory management, your secret sauce "idea" is a feature that allows you to cut stale inventory by 14% by implementing various just-in-time workflows that optimize shipping and reception of new goods. If you are in the US (or most English-speaking countries but considering how combative you are let's say US), your MVP should be the most barebone system that you can ship that will give your customers that 14% reduction and make them want to sign a contract with you. Having a screen-reader-compatible interface might be a must ~1 year down the line when you reach a scale where conforming to ADA is a necessity or realistically when your customers ask for it because of the ADA. It's not about caring or not, it's about assigning your meager startup resources towards the features that the prospective customer will say "yes we want your product". That's what an MVP is. In addition (and perhaps even more importantly), MVPs are useful in determining your product-market fit. You might go over 5 or even 10 MVPs as you pivot and refine your inventory management idea, all without having a single customer keeping the lights on. You could implement accessibility in all of them, or you could implement it only in the version that actually gets adopted by a customer.

rrdharan 3y ago

> I wouldn't care about GDPR until I have a somewhat strong EU userbase. Try to respect the spirit sure, but it's not like it will be enforced on a small business within its first few years of existence. This seems ethically wrong - 1. Even if your user base is not “strong” the privacy of the users you do have still matters and 2. It should be about protecting them not just calculating enforcement risk like a Ford Pinto engineer.

mrbungie 3y ago
Maybe it is ethically wrong to launch in EU without complying with GDPR. But if that is the case, then launch somewhere else first and build towards a more secure product in the meantime while you raise money and gather more insights. Don't forget it is a MVP ffs, and that you can be completely open about it (i.e. just say it is in beta or early access phase).
deleted 3y ago
[deleted]
mufti_menk 3y ago
I will NOT comply with authoritarian demands imposed on me by the EU. My users, MY data. I clearly state how and why I share user data with brokers and users choose of their own volition to use my services. This is NOT unethical.
- seabass-labrax 3y ago
  Even when accepting users' choice to submit personal data as a justification for retaining the data (which is illegal in more than just the EU, by the way), you may still receive personal data about someone which was not submitted by them voluntarily. This can happen in situations ranging from the normal course of business to customers actively attempting to use your product illegally. You have a duty to deal with a situation like that, and since the GDPR already makes provision for third-party processing of personal data, there is little reason not to go one small step further and extend your process for personal data deletion to users directly.