I am thinking of a product many businesses would find it useful but my only concern is that the product revolves around sensitive documents(like lawyer's documents but can be extended to other industries too). The product is already built by many companies but I have found a unique angle that I think would benefit my users. I am not a team and I don't know how to handle laws of sensitive documents as a business entity(and those documents might live on AWS S3/similar services).
Ask HN: How to handle sensitive document uploads as a one-person SaaS?
1–10 of 15 posts
Re: Ask HN: How to handle sensitive document uploads as a one-person SaaS?
#2This'll be unpopular, but if you want to keep it super lean and avoid being asked for compliance certs like SOC2/ISO, you could consider building it as an installable app on top of a platform your customers already trust
ie. a Salesforce App.
That way, they already use/trust the environment where the storage/processing of their sensitive data is taking place, akin to an old school 'on prem' solution (but without as much headache for you)
Worth thinking about
Re: Ask HN: How to handle sensitive document uploads as a one-person SaaS?
#3I don't know what the product is (and you probably don't want to say...?) but is it something that could potentially done clientside in their browser, maybe in JS or WASM? That way you never even have to receive, much less store, their document.
Re: Ask HN: How to handle sensitive document uploads as a one-person SaaS?
#4I don't know what the product is (and you probably don't want to say...?) but is it something that could potentially done clientside in their browser, maybe in JS or WASM? That way you never even have to receive, much less store, their document.
That's a good idea - not sure how big the docs are, but would local storage be helpful?
Re: Ask HN: How to handle sensitive document uploads as a one-person SaaS?
#5In addition to being a 3rd party app as someone suggested, you could make it a desktop app.
You could also make it a control plane and the customers run it in their cloud. You would need a tech savvy customer who already uses say AWS.
Desktop app or Chrome extension is another possibility.
Re: Ask HN: How to handle sensitive document uploads as a one-person SaaS?
#6This'll be unpopular, but if you want to keep it super lean and avoid being asked for compliance certs like SOC2/ISO, you could consider building it as an installable app on top of a platform your customers already trust ie. a Salesforce App. That way, they already use/trust the environment where the storage/processing of their sensitive data is taking place, akin to an old school 'on prem' solution (but without as m…
The helps only if your extendee is providing a PaaS for you and makes guarantees. Last time I made a slack extension, for example, I had to egress and ingress client data.
Re: Ask HN: How to handle sensitive document uploads as a one-person SaaS?
#7I don't know what the product is (and you probably don't want to say...?) but is it something that could potentially done clientside in their browser, maybe in JS or WASM? That way you never even have to receive, much less store, their document.
Unfortunately, storing the document is required. Almost an essential feature.
Re: Ask HN: How to handle sensitive document uploads as a one-person SaaS?
#8I’d say take your time a spend a week learning about S3.
It’s better to piggy back on another teams hard work than build from scratch.
Re: Ask HN: How to handle sensitive document uploads as a one-person SaaS?
#9Gentleman’s agreement that you pinky promise you won’t peek if they don’t
Re: Ask HN: How to handle sensitive document uploads as a one-person SaaS?
#10Zip with password. Keep passwords in private for now.