5 ms·

I admittedly don't know a lot about this situation beyond what I've read in the news the past day or so. However, isn't it the case that Zenefits is simply buil

I admittedly don't know a lot about this situation beyond what I've read in the news the past day or so. However, isn't it the case that Zenefits is simply building an interface on top of ADP's payroll data? And, from what I've read, it seems like they did this without following the proper procedures (did they write some kind of web scraper?). So if that is the case, ADP has every right to block them. If the situation was reversed and a large company was scraping a startup's data to integrate into their own platform, the outrage would be directed quite differently. So Zenefits is plugging into ADP's data, not paying them for access, not following the proper procedures to get access, and selling an interface on top of that data for a 10% fee, and then they complain that ADP blocked them? EDIT: Also, all of their press releases sound very immature.

ohitsdom 11y ago
Zenefits has their users create an admin ADP user. Then zenefits uses those credentials to pull whatever data they want. They chose this route instead of working with ADP's third party system (without giving any justification as to why). I might sympathize if ADP's API access was severely limited or extremely expensive, but it appears as if Zenefits made no efforts to go this route.
- cddotdotslash 11y ago
  Exactly. If I found a third-party company that was having users create accounts on my systems for the purposes of pulling data out, I would block it too, probably more quickly than ADP did. Imagine if a company asked for your Google password instead of using the proper API channels. I don't know many users who would do that.
  - pyre 11y ago
    > Imagine if a company asked for your Google password instead of using the proper API channels This would be more like creating a new Google Apps email account for someone, and allowing them to use it to (e.g.) manage things on your Google Drive (by sharing a group folder with them). How many companies hire a 3rd party accounting / HR firm (or person) to manage their bookkeeping? How many of them create an ADP admin account for these people so that they can manage payroll? How is this that much different than Zenefits?
    - eitally 11y ago
      Ironically, this is typical in the Google Apps reseller arena, where the reseller creates your domain for you under their Google account, and then also administer it using a superadmin account they create in your domain for that purpose.
    - aioprisan 11y ago
      This is exactly how most resellers on Google Apps are set up, actually.
  - whoisthemachine 11y ago
    The Google password scenario actually used to be a pretty common thing before Google built an API.
- eropple 11y ago
  From having been there, ADP is a tin-plated nightmare to work with for third-party API access. I'd do the exact same thing in Zenefits' shoes; ADP knows that they are eternally your competitors and will screw you at the first opportunity. Of course, ADP doing that is not doing right by their customers, but who cares, they're just cash cows.
  - hamburglar 11y ago
    How smart is it to build a business on unofficial, non-API access to a system maintained by someone who you know will try to screw you at the first opportunity? If I were ADP, I'd probably be intentionally breaking those types of integrations just to make it clear that they don't intend to hamstring themselves by supporting interfaces they never published. The fact that it's someone in a market they intend to enter is gravy.
    - eropple 11y ago
      I didn't say it was smart, but it's smarter than ADP's jokestore of an official API. If you want to talk to ADP customers--and, functionally, you very close to need to talk to ADP customers--those are your options. I feel like maybe the point of my post was not completely clear, though: this would not be a problem, and Zenefits would not be doing this, if ADP was good (not good in the "not poor software" sense, but good in the moral sense). And we should be faulting ADP for not being good to its customers, not Zenefits for trying to bring good to ADP's customers.
      - mynameisvlad 11y ago
        ADP's customers are most definitely not the third party developers, though. Because of that, you can't really conflate the two into one argument. ADP can easily be "good" to their customers while still having shitty APIs. Hell, plenty of companies do this every day, why should we chastise ADP for running a business? Furthermore, a profit-seeking corporation shouldn't really be on the moral scale to begin with. At best, they should be amoral, that is, not involved at all in morality. Their primary goal is, and should be, to earn more money, not to be good citizens of the world.
- cbzink000 11y ago
  I'm not speaking for or against Zenefits and their methods, but ADPs API is severely limited and extremely expensive. I worked with their Dealer Services division when I was at a startup in the automotive space and ADP had one of the worst crafted APIs I have ever seen. I made a comment about it on an earlier Zenefits post, but the gist was that the "stable, production API" was a constantly moving target that changed without notice or reason. I believe we had incurred over $50,000.00 in fees before we ever reached the testing stage or purchased the right to use the API (that license is on a client by client basis, too). That $50M number was fees directly to ADP, and does not include our own payroll and expenses. We were completely bootstrapped and started with about $70M in the bank, yet we were still able to complete that integration. I can't see how a company with over $500MM in funding[0] couldn't unless they were prohibited by ADP. https://www.crunchbase.com/organization/zenefits https://www.crunchbase.com/organization/zenefits
- fweespeech 11y ago
  As someone who is a customer of ADP [we use them for payroll, etc, etc] I'd go the Zenefits route too [and we do for our automation in relation to ADP precisely because ADP's API is insufficient]
wvenable 11y ago
It actually works a bit differently; it's not all scraping. People enter data into Zenefits and then it populates that data into ADP. I don't think the issue is as cut and dried as the typical web scraping situation and I wonder how HN readers feel about this kind of thing. The data belongs to the client. The client chooses to use both services. Should it matter how the client accesses their own information from the service? Are they required to use a web browser? Would you feel the same about them using their own wget script to automate interactions ADP? At what point does it become improper to access a service differently than that service wishes you to access it?
- gamblor956 11y ago
  Generally, from an ethical perspective, it matters at the point when you choose to build a business on the method of accessing a 3rd party service. From a legal perspective, the profit-making purpose is irrelevant. Improper access matters when you start using the service.
  - Lawtonfogle 11y ago
    >it matters at the point when you choose to build a business on the method of accessing a 3rd party service. Why? They are having to pay them and then buy your services for data entry. This is no more unethical than hiring someone to do your banking for you. Violating an EULA by doing this may be unethical, but in that case, it is violating the EULA that is unethical, not the general practice of providing a new interface.
  - wvenable 11y ago
    Are accountants who access ADP on behalf of their clients doing something unethical? Does it matter if that accountant uses their own scripts or wget to access ADP? > Improper access matters when you start using the service. I don't know what this means.
- logn 11y ago
  > Should it matter how the client accesses their own information from the service? I don't think so either. Would people feel the same if a store banned wheelchairs? You can write a EULA however you want, but I don't think you should be able to enforce arbitrary provisions which harm customers and potentially violate the Americans with Disabilities Act. Probably this has nothing to do in practice with accessibility for disabled people, but it is related to accessibility and user experience for everyone. (Disclosure: I write web scraping software... nothing related to this. Also I'm speculating about general circumstances, not individual companies, so please no libel lawsuits :)
parkerconrad 11y ago
ADP has for years, and still does, allow bookkeepers, accountants, and HR services firms similar to Zenefits to access client accounts via 3rd-party administrative logins that clients themselves set up in their payroll. The way this works is that you, as an ADP client, call them up and says "hey, I've asked my HR firm, XYZ-HR, to manage my payroll. Can you create an account for them to access my payroll system?" ADP creates this account, and XYZ-HR then handles all the payroll admin work going forward -- adding employee, terming them, inputting hours worked, managing deductions, etc. This is how this has worked for years, and it's how thousands of companies do this via ADP. Even today, as an ADP RUN client, you can call in and add any third-party person you want as an admin to your payroll system -- as long as it's not Zenefits. ADP has marketing materials that describe this feature, both for companies and HR / bookkeeping / accounting firms. This is how Zenefits was accessing client's payroll, and doing so in order to take on all the administrative work related to payroll that you don't want to handle. We weren't "hacking" anything. We were doing this at our customers' request, with their full knowledge of what we were doing, and ADP set up these accounts with @zenefits.com email addresses, knowing it was Zenefits. There is nothing improper about how we were doing this.
- maratd 11y ago
  > There is nothing improper about how we were doing this. You were automating it, weren't you? With bookkeepers, accountants, etc. the login and work done on the system was manual. It was an actual person doing it. In your case, a computer is doing it instead. Virtually every site out there, from Facebook to Twitter, prohibits the use of bots and scraping. Not surprising ADP isn't a fan. What is surprising is that you feel you're entitled to access their system however you want? It's their system. If they want to prohibit bots and allow only people, that's their biz. If you think ADP is full of it, create your own system with a public API and put them out of business.
- cddotdotslash 11y ago
  > you can call in and add any third-party person you want as an admin to your payroll system So they will create an admin account for a person - a single, human individual. > In addition, Zenefits’ method of extracting data from ADP’s RUN system via “screen-scraping” put excessive demands on ADP’s servers, potentially impacting service delivery to the entire client base.[1] If you weren't using the API, and instead were having a machine log in to access the data, that is pretty much the definition of scraping. There is a difference between a person using an admin account setup for them to log in and perform a certain set of actions and hundreds of accounts setup for the purposes of continual automated logins. How many requests did you make? Do you rate-limit your queries to the rate of a human-being (maybe 1 click every couple of seconds)? Do you only login to one or two accounts at a time? I still don't see a valid reason why any company (big or small) should have to invest resources in supporting a third-party that wants to use its data in an unsupported manner. Of course you can argue that they allowed it in the past, but an entire business shouldn't rely on unsupported access to something without the assumption that it could disappear at any minute. [1] http://techcrunch.com/2015/06/10/adp-sues-zenefits-for-defamation-rolls-out-a-competing-service/ http://techcrunch.com/2015/06/10/adp-sues-zenefits-for-defam...

ohitsdom 11y ago

Zenefits has their users create an admin ADP user. Then zenefits uses those credentials to pull whatever data they want. They chose this route instead of working with ADP's third party system (without giving any justification as to why). I might sympathize if ADP's API access was severely limited or extremely expensive, but it appears as if Zenefits made no efforts to go this route.

cddotdotslash 11y ago
Exactly. If I found a third-party company that was having users create accounts on my systems for the purposes of pulling data out, I would block it too, probably more quickly than ADP did. Imagine if a company asked for your Google password instead of using the proper API channels. I don't know many users who would do that.
- pyre 11y ago
  > Imagine if a company asked for your Google password instead of using the proper API channels This would be more like creating a new Google Apps email account for someone, and allowing them to use it to (e.g.) manage things on your Google Drive (by sharing a group folder with them). How many companies hire a 3rd party accounting / HR firm (or person) to manage their bookkeeping? How many of them create an ADP admin account for these people so that they can manage payroll? How is this that much different than Zenefits?
  - eitally 11y ago
    Ironically, this is typical in the Google Apps reseller arena, where the reseller creates your domain for you under their Google account, and then also administer it using a superadmin account they create in your domain for that purpose.
  - aioprisan 11y ago
    This is exactly how most resellers on Google Apps are set up, actually.
- whoisthemachine 11y ago
  The Google password scenario actually used to be a pretty common thing before Google built an API.
eropple 11y ago
From having been there, ADP is a tin-plated nightmare to work with for third-party API access. I'd do the exact same thing in Zenefits' shoes; ADP knows that they are eternally your competitors and will screw you at the first opportunity. Of course, ADP doing that is not doing right by their customers, but who cares, they're just cash cows.
- hamburglar 11y ago
  How smart is it to build a business on unofficial, non-API access to a system maintained by someone who you know will try to screw you at the first opportunity? If I were ADP, I'd probably be intentionally breaking those types of integrations just to make it clear that they don't intend to hamstring themselves by supporting interfaces they never published. The fact that it's someone in a market they intend to enter is gravy.
  - eropple 11y ago
    I didn't say it was smart, but it's smarter than ADP's jokestore of an official API. If you want to talk to ADP customers--and, functionally, you very close to need to talk to ADP customers--those are your options. I feel like maybe the point of my post was not completely clear, though: this would not be a problem, and Zenefits would not be doing this, if ADP was good (not good in the "not poor software" sense, but good in the moral sense). And we should be faulting ADP for not being good to its customers, not Zenefits for trying to bring good to ADP's customers.
    - mynameisvlad 11y ago
      ADP's customers are most definitely not the third party developers, though. Because of that, you can't really conflate the two into one argument. ADP can easily be "good" to their customers while still having shitty APIs. Hell, plenty of companies do this every day, why should we chastise ADP for running a business? Furthermore, a profit-seeking corporation shouldn't really be on the moral scale to begin with. At best, they should be amoral, that is, not involved at all in morality. Their primary goal is, and should be, to earn more money, not to be good citizens of the world.
cbzink000 11y ago
I'm not speaking for or against Zenefits and their methods, but ADPs API is severely limited and extremely expensive. I worked with their Dealer Services division when I was at a startup in the automotive space and ADP had one of the worst crafted APIs I have ever seen. I made a comment about it on an earlier Zenefits post, but the gist was that the "stable, production API" was a constantly moving target that changed without notice or reason. I believe we had incurred over $50,000.00 in fees before we ever reached the testing stage or purchased the right to use the API (that license is on a client by client basis, too). That $50M number was fees directly to ADP, and does not include our own payroll and expenses. We were completely bootstrapped and started with about $70M in the bank, yet we were still able to complete that integration. I can't see how a company with over $500MM in funding[0] couldn't unless they were prohibited by ADP. https://www.crunchbase.com/organization/zenefits https://www.crunchbase.com/organization/zenefits
fweespeech 11y ago
As someone who is a customer of ADP [we use them for payroll, etc, etc] I'd go the Zenefits route too [and we do for our automation in relation to ADP precisely because ADP's API is insufficient]

wvenable 11y ago

It actually works a bit differently; it's not all scraping. People enter data into Zenefits and then it populates that data into ADP. I don't think the issue is as cut and dried as the typical web scraping situation and I wonder how HN readers feel about this kind of thing. The data belongs to the client. The client chooses to use both services. Should it matter how the client accesses their own information from the service? Are they required to use a web browser? Would you feel the same about them using their own wget script to automate interactions ADP? At what point does it become improper to access a service differently than that service wishes you to access it?

gamblor956 11y ago
Generally, from an ethical perspective, it matters at the point when you choose to build a business on the method of accessing a 3rd party service. From a legal perspective, the profit-making purpose is irrelevant. Improper access matters when you start using the service.
- Lawtonfogle 11y ago
  >it matters at the point when you choose to build a business on the method of accessing a 3rd party service. Why? They are having to pay them and then buy your services for data entry. This is no more unethical than hiring someone to do your banking for you. Violating an EULA by doing this may be unethical, but in that case, it is violating the EULA that is unethical, not the general practice of providing a new interface.
- wvenable 11y ago
  Are accountants who access ADP on behalf of their clients doing something unethical? Does it matter if that accountant uses their own scripts or wget to access ADP? > Improper access matters when you start using the service. I don't know what this means.
logn 11y ago
> Should it matter how the client accesses their own information from the service? I don't think so either. Would people feel the same if a store banned wheelchairs? You can write a EULA however you want, but I don't think you should be able to enforce arbitrary provisions which harm customers and potentially violate the Americans with Disabilities Act. Probably this has nothing to do in practice with accessibility for disabled people, but it is related to accessibility and user experience for everyone. (Disclosure: I write web scraping software... nothing related to this. Also I'm speculating about general circumstances, not individual companies, so please no libel lawsuits :)

parkerconrad 11y ago

ADP has for years, and still does, allow bookkeepers, accountants, and HR services firms similar to Zenefits to access client accounts via 3rd-party administrative logins that clients themselves set up in their payroll. The way this works is that you, as an ADP client, call them up and says "hey, I've asked my HR firm, XYZ-HR, to manage my payroll. Can you create an account for them to access my payroll system?" ADP creates this account, and XYZ-HR then handles all the payroll admin work going forward -- adding employee, terming them, inputting hours worked, managing deductions, etc. This is how this has worked for years, and it's how thousands of companies do this via ADP. Even today, as an ADP RUN client, you can call in and add any third-party person you want as an admin to your payroll system -- as long as it's not Zenefits. ADP has marketing materials that describe this feature, both for companies and HR / bookkeeping / accounting firms. This is how Zenefits was accessing client's payroll, and doing so in order to take on all the administrative work related to payroll that you don't want to handle. We weren't "hacking" anything. We were doing this at our customers' request, with their full knowledge of what we were doing, and ADP set up these accounts with @zenefits.com email addresses, knowing it was Zenefits. There is nothing improper about how we were doing this.

maratd 11y ago
> There is nothing improper about how we were doing this. You were automating it, weren't you? With bookkeepers, accountants, etc. the login and work done on the system was manual. It was an actual person doing it. In your case, a computer is doing it instead. Virtually every site out there, from Facebook to Twitter, prohibits the use of bots and scraping. Not surprising ADP isn't a fan. What is surprising is that you feel you're entitled to access their system however you want? It's their system. If they want to prohibit bots and allow only people, that's their biz. If you think ADP is full of it, create your own system with a public API and put them out of business.
cddotdotslash 11y ago
> you can call in and add any third-party person you want as an admin to your payroll system So they will create an admin account for a person - a single, human individual. > In addition, Zenefits’ method of extracting data from ADP’s RUN system via “screen-scraping” put excessive demands on ADP’s servers, potentially impacting service delivery to the entire client base.[1] If you weren't using the API, and instead were having a machine log in to access the data, that is pretty much the definition of scraping. There is a difference between a person using an admin account setup for them to log in and perform a certain set of actions and hundreds of accounts setup for the purposes of continual automated logins. How many requests did you make? Do you rate-limit your queries to the rate of a human-being (maybe 1 click every couple of seconds)? Do you only login to one or two accounts at a time? I still don't see a valid reason why any company (big or small) should have to invest resources in supporting a third-party that wants to use its data in an unsupported manner. Of course you can argue that they allowed it in the past, but an entire business shouldn't rely on unsupported access to something without the assumption that it could disappear at any minute. [1] http://techcrunch.com/2015/06/10/adp-sues-zenefits-for-defamation-rolls-out-a-competing-service/ http://techcrunch.com/2015/06/10/adp-sues-zenefits-for-defam...