6 ms·
Really neat idea but I'm surprised that a company who needs me to send them intimate accounting data makes no mention of what they're doing to ensure my data is
by doomspork 12y ago
Really neat idea but I'm surprised that a company who needs me to send them intimate accounting data makes no mention of what they're doing to ensure my data is safe and secure.
Building an API is relatively simple, protecting sensitive financials is not.
- ewang1 12y agoAgree... Something like that would be much better in the form of a library that companies can integrate into their code.
- tmornini_ey 12y agoI understand your position clearly! People felt the same way about Salesforce.com, i.e. The data is too sensitive to place in the cloud. Yet millions use QuickBooks Online every day. We believe strongly that a huge new API economy is being built, we're delighted to offer our accounting API, mobile app, and web app to people who do not wish to build and manage it themselves.
- bdcravens 12y agoI'd be careful of using the Salesforce and QuickBook comparison. Salesforce had a $4M seed round, include Larry Ellison. Do you have that kind of cash to throw at security? I presume Salesforce controlled the hardware - it looks like you're on AWS (at least that's what using CloudFront suggests to me). Intuit is 31 years old, and QuickBooks is 20. They spent a long time getting account software right before they ventured into the hosted solution, and they're a publicly traded company with the advantages that comes with. Not to say that you can't answer the security story, but I'd be cautious of the analogy approach.
- tmornini_ey 12y agoThanks, understand your points clearly. I'll point out that I did spend a lot of time, energy and money on application security at Engine Yard (and still do as board member) and I'm very proud of our security record there.
- flylib 12y agothis is in a FAQ in the email after you signup for beta "Q) Does Subledger store data safely and securely? A) Yes. Subledger runs entirely on Amazon's AWS, which itself is compliant with HIPAA, SOC 1/SSAE 16/ISAE 3402 (formerly SAS70), SOC 2, SOC 3, PCI DSS Level 1, ISO 27001, FedRAMP(SM), DIACAP and FISMA, ITAR, FIPS 140-2, CSA and MPAA. Subledger itself has not yet been certified. We take your data security and safety very seriously: when Subledger says it has received your data, it has already been stored in two separate data centers. Q) Does Subledger provide disaster recovery? A) Yes. Subledger makes real time backups of transactions as you create them. Our storage system has a stated durability of 99.999999999%. Subledger can optionally mirror your transactions to a separate geographic location. With multiple copies in diverse georgraphic locations, your data is extraordinarily durable. Q) Do I need to replace what I've already built? A) No. Subledger can exist alongside anything that's already in place. Q) Is accessing my financial data over the internet secure? A) Yes. All communications to and from Subledger are TLS/SSL encrypted which is the modern standard for over the internet security. Q) Do you have strong authentication and authorization? A) Yes. We employ a gigantic keyspace (7.3322e+78 combinations) key/secret authentication with support for rolling key updates."
- bdcravens 12y agoThere's little value in putting this information in the FAQ after I signup. You'll never even see my email if I can't have this level of confidence in your service. The site is pretty and flat and has decent copy, but this isn't a to do list app.
- tmornini_ey 12y agoI hear you loud and clear, will get site updated! Thank you for your clear and concise feedback, very much appreciated!