Don't build for small business. They are the 20% customers with 80% of the problems. Large business problems are lucrative and you can use them to name drop on small businesses once you want to go to that market.
Ask HN: Main things to consider when building an app for business/enterprise?
71–80 of 132 posts
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#72Frankly, you have no chance of making a secure product if you don't have a ton of experience in this area. For single sign on, SAML for instance, you have to get a ton right with security certificates, xml parsing, manifest rules, signing algorithms, request expiration, etc. SAML (and other single sign-on protocols) are poorly designed and any single mistake is fatal. Some SAML libraries have support for null signing…
The obvious solution to all these problems is to not implement them yourself and use a platform like Auth0 or WorkOS.
That’s a solution only from a business perspective. Some of these SSO platforms have a “move fast break things” attitude to software development and a security track record to match.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#73I was heading tech and product of a SAAS software for ~15 months so writing this from that experience. - Who is the buyer? Typically they are not same as the user of the product so understand what they look for in similar products. - SSO, preferably SAML based. - As for security, take care of OWASP top-10 [1] and you should be covered for app-sec. - Implement RBAC. Make it easy to add/manage users for an admin-user.…
I wasn't familiar with the acronym RBAC (but certainly familiar with the concept) until web searching for it. First link was from solarwinds.. nope, found an okta link.. yep! Thanks for the well thought out list this was helpful
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#74I have been a CTO/founder in few b2b saas services for maybe 15-20 years (one was scandinavian market leader with 100k+ users).
Anyway
Most important thing is simply: find a problem a business is willing to pay for to solve (i.e. it costs them money and time). Set up a simple MVP if that's possible and grow from there.
Do NOT listen to soc/iso talk on this thread, they are an distraction and you will have a lot of time to do them later. Security audits, certificates etc. Might be important LATER when big accounts will ask for them but not at the beginning (unless you are doing fintech etc).
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#75I searched through the comments and was surprised no one had mentioned this:
Look at the evolution of how AWS has changed their services.
I see your HN account was created in 2021. If you haven't been watching this space for a long period of time (6-10+ years), go back and watch the AWS re:Invent keynotes.
You'll notice a trend of starting out with a very simple IAM and then evolving into vastly more complex mechanisms of authentication, authorization, auditing, accounting, network policy, and representation of multi-tiered organizational hierarchies between all of these systems.
This will give you an idea of what the MVP looks like, but also allow you to plan for what WILL be requested in the future (even if it's a stupid idea). Tragically, the briefest way I can summarize this is to say: "give them a Rube Goldberg machine so they can take Conway's Law and run with it."
context: I've worked exclusively on the intersection of FL/OSS and "Enterprise" software for almost 20 years.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#76I was heading tech and product of a SAAS software for ~15 months so writing this from that experience. - Who is the buyer? Typically they are not same as the user of the product so understand what they look for in similar products. - SSO, preferably SAML based. - As for security, take care of OWASP top-10 [1] and you should be covered for app-sec. - Implement RBAC. Make it easy to add/manage users for an admin-user.…
Disclosure: I work for an auth service vendor. Great feedback about knowing who the buyer is. Lots of folks think about the user, but knowing the buyer (and they are usually not the same person) is critical too. If you are a building a SaaS, I'd recommend outsourcing your auth, since that is both critical and undifferentiated functionality. There are lots of solutions out there. FusionAuth is one option (I work there…
IMO https://ory.sh has completely changed this calculation. With the help of Ory Kratos it makes sense to roll your own auth.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#77Wrote a blog post on this one about a year ago that has a list of what I've seen: https://staysaasy.com/product/2022/02/19/enterprise-selling-...
Overall though I would heed the advice of others in this thread and focus on the buyer/customer. Enterprise SaaS is all about effective (note – not even necessarily elegant) solutions to important business problems. Absolutely everything else is secondary until you're at a larger scale.
Just as an example this blog post was written with post-traction / scaling startups in mind because before then everything on your mind should just be buyer/buyer/buyer. Even past $100m ARR it should still be buyer/buyer/scaling.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#78For insuretec/fintec
iso 27001, soc2, Pcidss
Sso with force logout
Allow fine granular role based access (RBAC) to let distinguish between all kinds of roles. Admins, super admin, bots. Have audit logs available.
Multi tenant saas and Encrypt the data on a per customer basis or even per department of a customer.
Publish your api spec as OpenApi/Swagger/raml in order for api gateways to be consumed. In case you offer some kind of web hooks, publish the api spec of your webhooks as well.
Support custom truststores, key stores.
Support a private access to your api, e.g. a VPN or a vpc private endpoint in the same AWS region where your customer might have their cloud environment running. Or fixed IPs which will be used for egress/ingress traffic.
Document your supply chain. How do you program the software? Which Saas providers do you use yourself? In case for Europe: how do you ensure the data stays in Europe (I.e. in case you might be monitoring your saas product with for example pager duty, then maybe the data might be hosted in the us. Therefore ensure your supply chain is also in Europe. I think OpsGenie has an Europe endpoint)
Provide support contracts and SLAs.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#79Earlier quoted context omitted.
Background: cofounded an enterprise saas company. I like this coverage of tech, though it's missing soc2 which will be required. And 27001 eventually. I disagree on making it easy for admins to add users. Just don't: rather, implement (a bit of) scim or jit user creation with the idp flows. The big thing it's missing is sales. This software is sold not bought. In any sales process with 3 different constituencies (use…
When would you prioritise SOC2 before ISO27001? And when the other way around?
I'm not an expert on this, but I'd start with a soc2 type 2. soc2 served us well in the US. Some of Europe prefers 27001, but we sold into the EU with just a soc2 in the beginning.
a soc2 is also a choose-your-own-adventure cert: you describe your processes (within constraints imposed by the goals you must achieve per the soc2 principles), and then you get audited on following your process.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#80For insuretec/fintec iso 27001, soc2, Pcidss Sso with force logout Allow fine granular role based access (RBAC) to let distinguish between all kinds of roles. Admins, super admin, bots. Have audit logs available. Multi tenant saas and Encrypt the data on a per customer basis or even per department of a customer. Publish your api spec as OpenApi/Swagger/raml in order for api gateways to be consumed. In case you offer…
Great answer. It might dissuade people from starting A SaaS company, though, LOL.