December 2020 Summaries

This guide emphasizes the importance of learning enterprise sales for early-stage founders, as it can lead to more profitable deals and a larger market. It explains that increasingly all sales are starting to resemble what we traditionally call "enterprise sales," with companies expecting features like single sign-on (SSO), directory sync (SCIM), audit logs, and more. The guide provides reasons why founders should learn enterprise sales, such as the profitability of enterprise deals, the creation of a bigger market, and the inevitable gravity exerted by enterprises on business development. It also offers tips on how to start loving or tolerating enterprise sales, key terminology for understanding the process, and steps to begin selling to enterprises.

Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) are two common models used for system authorization. RBAC is based on roles assigned to users with varying levels of permissions, while ABAC uses attributes such as user, resource, and environmental details to determine access. The choice between RBAC and ABAC depends on factors like company size and security needs. In general, larger companies or those requiring more detailed permissions may benefit from ABAC. However, a combination of both models can also be used for optimal security.

A service level agreement (SLA) is a contract between a service provider and a user that outlines the expected performance of a service, as well as provisions for issues and downtime. Writing an effective SLA requires clarity, simplicity, and ease of use to ensure customer satisfaction. Companies like Slack, Google, and Amazon have set good examples by keeping their SLAs simple, defining confusing terms, and displaying information in an easy-to-digest manner. An SLA is just one step towards becoming Enterprise Ready for a business.

Compliance is crucial for businesses to grow and secure enterprise deals. Service Organization Control (SOC) reports are issued by Certified Public Accountants (CPAs) to assess the internal control processes of a company. There are three primary types of SOC reports: SOC 1, SOC 2, and SOC 3. - SOC 1 focuses on financial reporting and is essential for companies that handle their customers' financial information. It comes in two types: Type 1 and Type 2, with the latter testing the effectiveness of controls over a set period. - SOC 2 is centered around operations and compliance, particularly in cloud computing and data security. It also has two types of reports and aligns with AICPA's five Trust Services Criteria: Security, Confidentiality, Processing Integrity, Privacy, and Availability. - SOC 3 contains the same information as SOC 2 but is intended for a general audience. Companies often use it to display compliance on their websites or in marketing materials. To become compliant, companies must work with an independent CPA who will audit their internal control processes. The AICPA has final say on compliance, and obtaining a SOC report can help businesses avoid individual audits from customers.

Twilio, a developer-focused company, built its business model around individual developers and expanded into massive enterprise sales. By creating a useful and easy-to-use product, they marketed it to developers who started using and deploying it, giving the product sales momentum when they eventually went to close enterprise-level deals. Twilio's focus on developers has always driven its growth, enabling them to modernize communications by virtualizing telecommunications infrastructure and making all that power available via a flexible web API. The company's success can be attributed to its utility-first philosophy, which prioritized features such as security, authentication, and compliance, making the product "Enterprise Ready" and allowing it to move upmarket.

User provisioning and deprovisioning are processes that enable system access to new employees and restrict access to departing ones, respectively. These automated tasks can increase efficiency by speeding up employee onboarding and organization updates, while also enhancing security by quickly removing access from users who leave the company or have compromised accounts. Automated user provisioning and deprovisioning tools like WorkOS Directory Sync, Okta Lifecycle Management, and OneLogin Automated User Provisioning can integrate with various directory providers and applications to streamline these processes.

Federation in technology refers to independent systems united under a central organization. It is particularly important as internet usage expands across various aspects of life and companies rely on third-party SaaS providers for technical services. Three common use-cases of federation are federated search, federated identity, and federated databases. Federated search involves compiling results from multiple sources into a single format for the user. It is different from distributed search as it centralizes the process of formatting queries, de-duplicating results, and presenting them in a unified format. Federated identity allows users to access data and apps across multiple systems through one interface without needing individual logins. This concept is similar to single sign-on (SSO), which is a subset of federated identity. Common technologies used for this include SAML, OAuth, and OpenID. Federated databases connect disparate databases with a unifying user interface, allowing each database to maintain its own structure and query language while communicating with the centralized database. This approach avoids complicated data migrations and merges by keeping all data in their original formats. Overall, federation enhances user experience by abstracting implementation details across different systems.

Magic links provide a passwordless authentication method that enhances user experience while maintaining security. They work by sending a unique token via email, which the user clicks on to verify their identity and gain access to an account. This eliminates the need for remembering complex passwords and reduces the risk of weak or reused passwords. However, magic links have some security implications, such as vulnerability to man-in-the-middle attacks and dependence on email providers' spam filters. To mitigate these risks, developers can enforce one-time use, set expiration times, and limit access to specific devices or browsers. Overall, magic links offer a convenient and secure alternative for user authentication in various applications, especially those handling non-sensitive data.

The General Data Protection Regulation (GDPR) is a set of user-data privacy regulations established by the EU in 2016 and strictly enforced since 2018. Developers play a crucial role in ensuring GDPR compliance for their software, even if their company isn't based in the EU. Understanding what constitutes "personal data" under GDPR is essential, as it includes not only basic information like name, email, and address but also more complex data such as biometric, genetic, and location data. Developers must shift their perspective on user data, recognizing that they are allowed to use the users' data but do not own it. To achieve GDPR compliance, developers should provide clear documentation of data collection policies, create clear opt-in opportunities for users, only collect necessary data, protect user data through encryption and security measures, and empower users with tools to manage their own data.

WorkOS held its Fall Release event last month, showcasing new features, product updates, a new documentation site, and a fireside chat with Webflow CTO Bryant Chou. The company aims to provide APIs that abstract the complexity of building enterprise-ready features like SSO, directory sync, audit trail, and access control. WorkOS's Admin Portal is designed to make it easy for developers to integrate these features into their applications. Additionally, Directory Sync/SCIM enables automatic user provisioning and de-provisioning based on external directories. The company also introduced a new developer documentation site with enhanced search functionality and a dedicated Slack channel for feedback. WorkOS's focus is on engineering developer joy by providing high-quality support and tools to streamline customer communications.