> If you follow best practices that can be learned in a afternoon, you can keep a server secure without hiring someone. Yes and no. Running a business is diff

> If you follow best practices that can be learned in a afternoon, you can keep a server secure without hiring someone. Yes and no. Running a business is different. Sure it may be too early to hire someone right now, but not the worst thing to think of. If OP can secure funding, get someone who has good knowledge with system and security. It's important. I am jack-of-all-trade to many, but as a devops I can't do everything at once. > storing some web analytics and personal finance information Fair. My company's finance data would be under compliance regulation, but even as a SaaS to provide easy-access easy-to-understand web analytics means you are going to have access to customer's data, or the customer is passing you data that the customer doesn't wish to share with others. Take an analytic SaaS to see your AWS usage. That requires a separate READ-ONLY access to your AWS account. Twitter recently dropped employee access to internal data. People suggest this was done to avoid insider trading. I don't know if that was the real intent, but let's take that as a yes, then web analytic is just sensitive as one's financial information. Security is not easy, just like writing code is not easy. I am suggesting OP to do some security audit before the launch. If OP ever hire someone to join the startup, try to secure a seat for someone good at security. FYI, I did some whitehat for some startup and had found numerous serious security bugs (no I am not here for hire, no time and definitely NOT as good as others, and I am 100% happy with my current job...). Just my genuine advice: don't just focus on features :)