July 2022 Summaries

If you’ve worked on a digital product, whether as a developer, product manager, or business leader, you know that the most common problems in software development are rarely as straightforward as “bugs.” Troubleshooting through trial and error is a crucial skill for developers to find solutions to complex issues. Courier's Gmail integration and API rate limits can cause 429 errors when sending bulk transactional emails, requiring developers to use Google-fu to troubleshoot. An incomplete data profile can also cause issues, such as "unroutable" / "MISSING_PROVIDER_SUPPORT" errors in the response, which can be fixed by adding an email recipient to the profile. Courier's Inbox and Toast features require a more detailed profile in the request, but exceptions exist for certain providers like PagerDuty. In some cases, notifications may not persist due to a subtle oversight, such as missing `to.user_id` or `to.courier.channel` in the SEND request. The team at Courier is constantly working on improving and fixing bugs, and provides support options through their documentation and 1-1 with engineers and support staff.

Courier is now HIPAA compliant, handling protected health information (PHI) and personally identifiable information (PII), which is a sensitive type of data that requires special regulations like the Health Insurance Portability and Accountability Act (HIPAA). Becoming HIPAA compliant is necessary for SaaS companies to handle PHI, especially as healthcare tech grows and digitization expands. Courier's mission to make software-to-human communication delightful led to investing in HIPAA compliance to provide better notification infrastructure for healthcare providers and patients. To achieve compliance, Courier considered who would touch the data and how it would be presented in the product, implementing a Business Associate Agreement (BAA) with vendors like AWS and designing internal policies and security safeguards.

Setting up your own servers requires a lot of upfront investment and ongoing maintenance. Most technology companies use an Infrastructure-as-a-Service (IaaS) provider for their compute needs, freeing up teams to focus on building valuable functionality. Cloud providers like AWS, Google Cloud, and Microsoft Azure offer security and compliance benefits, including built-in functionality to help meet industry best practices and regulations, integrations with compliance monitoring tools, and user management options. However, cloud providers don't "just" solve compliance, and companies must still identify what they need to use to meet compliance requirements and implement required controls. The cost of compliance can be significant, especially for pay-per-use services, and savvy companies calculate projected costs and estimate security risks. Best practices include implementing approval workflows, verifying third-party services, automating compliance monitoring, and using tools like Courier to streamline notifications.