Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Perspectives of a Builder, a Buyer, and a Founder

Security Considerations in the Time of AI for Startups

Browse AI Democratizes Access to Information on the Internet with Auth0

“I was captivated by the internet's inclusive nature, allowing a child with no knowledge of English in a small city in the Middle East to create and share something with the world,” [Ardy Naghshineh](https://ca.linkedin.com/in/ardalann), Founder and CEO of [Browse AI](https://www.browse.ai/), shared about his childhood. In January 2020, driven by his vision for a more inclusive online experience, Browse AI was brought to life with a mission to democratize access to information on the internet. He noticed that large enterprises were able to acquire and invest in business-critical data, leaving smaller organizations and individuals who couldn’t afford it behind. Since then, Browse AI has leveled the playing field for over 250,000 users by empowering them to make data-driven decisions and stay competitive in their industries.

## Making the Internet More Inclusive

[Browse AI](https://www.browse.ai/) is a no-code web data extraction platform that allows non-technical users to train custom AI robots to turn any website into a spreadsheet or data pipeline in minutes. Their method provides a simple and cost-effective way to utilize valuable live data.

<include src="QuoteCard" body="Our first-of-its-kind platform reduces the time and expense required for data acquisition, allowing organizations to focus on analyzing and leveraging data to drive innovation and success." name="Ardy Naghshineh" title="Founder and CEO" team="" company="Browse AI" />

Popular [use cases](https://www.browse.ai/use-cases) include turning websites into APIs, price monitoring, product data extraction, and lead generation, but Browse AI is a very flexible product. They haven’t focused on a specific niche or vertical, which has made their product applicable to many. One of the more unique use cases came from a 9-year-old user who used the product for a school project. He extracted NFL game results and forecasts from different sites and, with the help of Browse AI and a few other applications, published a website that showcased everything in one place. Did we mention this was done on their [free plan](https://www.browse.ai/pricing)? Besides this use case being extremely clever, it speaks to not only the simplicity of getting started but also the power this product puts in the hands of all of its users — from the classroom to the offices of Fortune 500 companies. 

Browse AI’s vision is clear, and they consider their current product to be just one piece of the puzzle. While they know they’re helping users in meaningful ways, they also believe they have room for more advancement. “We’re in this for the long game, and we have really ambitious goals. We’re just getting started.” 

## Auth0: A Trusted Solution

Ardy shared that he spent his career developing multi-million dollar web applications for Fortune 500 companies. Even before he started Browse AI, he was familiar with the extensive engineering time spent on [building user authentication](https://auth0.com/resources/whitepapers/build-vs-buy-evaluating-identity-management/). After prototyping and reading through our [documentation](https://auth0.com/docs), they decided Auth0 was the best solution for their team. 

<include src="QuoteCard" body="We used Auth0 from day one to be able to spend our limited time on innovating and creating new user experiences rather than building another user authentication system." name="Ardy Naghshineh" title="Founder and CEO" team="" company="Browse AI" />

Auth0 became a valuable asset to Browse AI as their customer base grew rapidly. A lean but mighty team of four senior engineers oversaw over 200,000 new user signups over the course of six months. While this could have been a strenuous task, the team felt confident about their authentication system’s scalability and reliability. Auth0 has since helped the Browse AI team save about 4-5 months of engineering time. 

![Why Auth0?](https://images.ctfassets.net/23aumh6u8s0i/1k8YZcbJVayxcAgxmg2VRN/aea478bad289538aea19982c629d3a2c/Browse_AI_Checklist.png)

## Join Browse AI and the other 1700+ startups that benefit from Auth0

The [Auth0 for Startups](https://auth0.com/startups/profiles) program brings the simplicity, extensibility, and scalability of Auth0 to qualifying startups – **all free for one year**. We are passionate about helping startups get their applications up and running while we take care of identity needs. So much so that we recently [expanded our eligibility](https://auth0.com/blog/auth0-for-startups-expands-eligibility/) by increasing the funding limit to $5M, doubling our previous cap. If you have any questions, you can find us at [startups@auth0.com](mailto:startups@auth0.com) or apply [here](https://autheco.atlassian.net/servicedesk/customer/portal/4/group/9/create/101). 

A special thank you to Ardy and the entire Browse AI team. If you want to create your own NFL game results website or just want to take advantage of any of the other many use cases, get started with Browse AI [here](https://www.browse.ai/). If you want to follow their journey, check out their blog [here](https://www.browse.ai/blog).

Startup Stories: Browse AI

How SafeBase Uses Auth0 to Lead the Way in Customer Trust

## Leading the Way in Customer Trust

The security startup, [SafeBase](https://safebase.io/), is defining the standard for customer trust management. Through the SafeBase [Smart Trust Center](https://safebase.io/showcase), companies are able to share their security posture and eliminate security review friction, ultimately leading to more closed deals. “Implementing good security controls as you’re a growing company is very hard, and it’s always under-invested,” said SafeBase’s Co-Founder & CTO, [Adar Arnon](https://www.linkedin.com/in/adarnon). 

We sat down with Adar, and he shared that their approach was aimed at helping companies grow. Their goal is to eliminate human time spent on security communications like sharing SOC2 or Pentest reports, security questionnaires, or incident breach notifications. While these are crucial to maintaining customer trust, they can be time-consuming and a bottleneck to closing deals. Arnon explains that these processes can be “...super manual, and that’s what we decided is worth solving.” 


<include src="QuoteCard" body="As we’re growing with these customers, something that’s very clear is that big customers really care about identity management and security." name="Adar Arnon" title="CTO & Co-Founder" team="" company="SafeBase" />


The impact SafeBase has had on their [customers](https://safebase.io/customer-love) since their 2020 inception is truly exciting. They’ve taken historically frustrating and tedious security processes and created a product that allows companies to become more efficient, ensuring stakeholders have fewer security review emails in their inboxes. That’s a total win in our book. 

## Choosing Auth0, a Standard in Authentication and Authorization

Once SafeBase started adding users, they determined that it didn’t make sense to implement their own user management system. Upon asking his network, Adar shared, “...it sounded like Auth0 was the agreed-upon standard. Auth0 offered a platform that we felt could grow with us while providing good support.” Other factors that were evaluated were Auth0’s [tech stack](https://auth0.com/docs/quickstarts) and [documentation](https://auth0.com/docs). 

One of the key features the team benefits from is [Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login), specifically because they do not have to deal with maintaining the front-end or back-end. The SafeBase team determined Auth0 was a good solution and joined our startup program to help them scale. 


![Why Auth0](https://images.ctfassets.net/23aumh6u8s0i/6fQxARcY6WWbfOE8wiClfN/6521c4ef2961cb12bf461db6ca037f9a/SafeBase_Checklist_-1.png)

## Join SafeBase and the Other 1700+ Startups That Benefit from Auth0

The [Auth0 for Startups](https://auth0.com/startups/profiles) program brings the simplicity, extensibility, and scalability of Auth0 to qualifying startups – **all free for one year**. We are passionate about helping startups get their applications up and running while we take care of identity needs. So much so that we recently [expanded our eligibility](https://auth0.com/blog/auth0-for-startups-expands-eligibility/) by increasing the funding limit to $5M, doubling our previous cap. If you have any questions, you can find us at [startups@auth0.com](mailto:startups@auth0.com) or apply [here](https://autheco.atlassian.net/servicedesk/customer/portal/4/group/9/create/101). 

A special thank you to Adar and the entire SafeBase team. If your organization is looking to build your own Smart Trust Center, [schedule a demo](https://safebase.io/schedule) today. 

_This profile is the fourth installment in our series highlighting members of the Auth0 for Startups program. The Auth0 for Startups program began in 2020 and has since worked with 1700+ startups._

Startup Stories: SafeBase

Customer Growth platform [Catalyst](https://catalyst.io/) helps their customers upsell and retain customers with precision. Their product includes tools that empower sales and success teams to analyze customer revenue, churn, and segmentation. Their [Customer-Led Growth](https://catalyst.io/customer-led-growth) (CLG) methodology enables revenue growth by focusing on current customers and embracing retention and expansion. 

<include src="QuoteCard" body="The best way to grow as a company is to take a look at the customers that you already have strong relationships with and expand on those..." name="Corey Finley" title="Engineering Manager" team="" company="Catalyst" />

In our sit-down with the team, [Corey Finley](https://www.linkedin.com/in/corey-finley-1403b165), Engineering Manager, shared more about how putting customer success (CS) at the center of an organization has been important to Catalyst, rather than looking at it as just the handoff in the post-sales cycle. He continued explaining that CS should play a central role in organizations in determining where product direction should go and by giving in-depth feedback on what customers are experiencing. “There’s a missed opportunity if you’re not focusing on the customers you already have.”

## Securing Future Growth Opportunities with Auth0 

Before Auth0, Catalyst had only one login method; utilizing OmniAuth to internally build a Google OAuth connection. As their prospect base grew and they targeted more enterprise-level companies, they encountered some that were not on Google Workspace and could not utilize Google OAuth. Authentication became a blocker in these conversations, and the team needed to take action.

With these new requirements and the need for additional login methods, Corey was tasked with finding a solution that wasn’t resource heavy and that would provide a wide range of options. He found that Auth0 could plug into the library they were already using, acting like a single provider while servicing many providers. 

> “If we could get this tool that will not only fix the Azure login problem but also leave the door open for future [SAML](https://auth0.com/docs/authenticate/protocols/saml/saml-configuration) implementations, then that would be perfect.”

> Corey will be providing more insight into Catalyst’s story and their implementation at [Developer Days 2023](https://developerday.com/), and we hope you’ll join us! Presented in-person and online on May 16, 2023, this event is free to attend. Please register [here](https://developerday.com/register). 

![Why Auth0?](https://images.ctfassets.net/23aumh6u8s0i/NbdrqE1lwkcJYIXb40vlz/72900ad7ccf2ddc065153edbcea03069/Catalyst_Checklist_-1.png)

## Join Catalyst and the Other 1700+ Startups That Benefit from Auth0

The [Auth0 for Startups](https://auth0.com/startups/profiles) program brings the simplicity, extensibility, and scalability of Auth0 to qualifying startups – **all free for one year**. We are passionate about helping startups get their applications up and running while we take care of identity needs. So much so that we recently [expanded our eligibility](https://auth0.com/blog/auth0-for-startups-expands-eligibility/) by increasing the funding limit to $5M, doubling our previous cap. If you have any questions, you can find us at [startups@auth0.com](mailto:startups@auth0.com) or apply [here](https://autheco.atlassian.net/servicedesk/customer/portal/4/group/9/create/101). 

A special thank you to Corey and the entire Catalyst team. If your organization wants to fine-tune your CLG strategy, schedule a demo [today](https://catalyst.io/lp/request-demo). P.S. Enjoy some excellent [CS memes](https://www.csmemes.io/) curated by the Catalyst team. 

_This profile is the third installment in our series highlighting members of the Auth0 for Startups program. The Auth0 for Startups program began in 2020 and has since worked with 1700+ startups._

Startup Stories: Catalyst

How Open-Sourced Akto Uses Auth0 to Secure APIs

The security startup, [Akto](https://www.akto.io/), allows users to discover, test, and find API vulnerabilities in a minute. Security and engineering teams can evaluate their APIs utilizing the [Akto platform](https://docs.akto.io/readme) by taking API inventory, testing and finding business logic vulnerabilities, and monitoring issues in run-time. With 30 million developers using APIs every day, the Akto team discovered an opportunity to address the constant addition and modification of APIs and protect their customers from harmful data leaks. 


<include src="QuoteCard" body="API security is where people are lagging. There is no place to get your API inventory, and there’s no place to do API testing in an automated way." name="Ankita Gupta" title="CEO & Co-Founder" team="" company="Akto" />


In our sit-down with the team, [Ankita Gupta](https://www.linkedin.com/in/ankita-gupta-89214515), CEO and Co-founder, shared more about Akto’s product-led growth model that helps their customers jump into the platform and start for free in a minute. “From day one, we wanted to make it a product-led product. Early on, we realized that it’s more of a security engineer problem than a CISO problem, so we needed a bottom-up model.” (Fun fact: Auth0 also offers a product-led growth model that helps our customers get started immediately. We are always delighted to hear when other companies are doing the same!) 

Ankita shared more about Akto’s decision to [open source](https://www.akto.io/blog/introducing-akto-open-source) and everything they’ve developed so far. The team saw that their customers wanted to contribute, add custom tests, or add custom rules for their business case, so open source made sense. Once the results were in, they were met with customer praise and felt customers were more comfortable with customization. The Akto team strongly believes that open sourcing will help developers and security teams around the world secure their application APIs from attacks. [Ankush Jain](https://www.linkedin.com/in/ankushgjain?trk=public_post_share-update_actor-text), Co-Founder and CTO, shared, “We are building the platform by being transparent to the security community and getting the community’s help in building the product.” 

## Letting Auth0 Take Care of the Login Box

When the Akto team was building their product, they knew that login flow was one of the biggest problems they or any startup will have, but they didn’t want to build it themselves. “It’s been a very smooth journey for us; we don’t have to think of anything around login now,” said Ankita. They use Auth0 for their primary login page, where customers can sign up and start their onboarding journey. A few features that make this possible and frictionless are [email verification](https://auth0.com/docs/manage-users/user-accounts/verify-emails), [Social Login](https://auth0.com/learn/social-login), and [password recovery](https://auth0.com/learn/password-reset). They also built a custom login in-house, but compared to their Auth0 login flow, they saw reliability issues, especially with fake emails. With Auth0, they were not only able to streamline their customer onboarding experience but also receive accurate data for their business. 

![Checklist](https://images.ctfassets.net/23aumh6u8s0i/6TXxpAfYPc1XwopbYH5Mx8/132e780e64563d54464cd3af0884047f/Akto_Checklist_-1.png)

## Join Akto and the other 1700+ startups that benefit from Auth0

The [Auth0 for Startups](https://auth0.com/startups/profiles) program brings the simplicity, extensibility, and scalability of Auth0 to qualifying startups – **all free for one year**. We are passionate about helping startups get their applications up and running while we take care of identity needs. So much so that we recently [expanded our eligibility](https://auth0.com/blog/auth0-for-startups-expands-eligibility/) by increasing the funding limit to $5M, doubling our previous cap. If you have any questions, you can find us at [startups@auth0.com](mailto:startups@auth0.com) or apply [here](https://autheco.atlassian.net/servicedesk/customer/portal/4/group/9/create/53). 

A special thank you to Ankita, Ankush, and the entire Akto team. If your organization wants to secure your APIs in a minute, [get started](https://github.com/akto-api-security/akto) today. 

_This profile is the second installment in our series highlighting members of the Auth0 for Startups program. The Auth0 for Startups program began in 2020 and has since worked with 1700+ startups._


Startup Stories: Akto

Eli Rabek

I joined Okta in 2021 to manage the Auth0 for Startups program. I love supporting early-stage companies and have spent the past decade building and running startup programs for corporations (e.g., Intel Corp), government agencies (e.g., the Spanish Institute for Foreign Trade), and universities (e.g., Stanford University). Outside of work, you can usually find me running around San Francisco's dog parks with my dog, hosting friends for dinner with my husband, or traveling with friends/family.

Director, Auth0 for Startups

Learn how both companies provide products and support for innovative founders.

### Overview

We are excited to announce that [MongoDB for Startups](https://www.mongodb.com/startups?utm_campaign=startups-partners&utm_source=auth0_for_startups&utm_medium=community&utm_content=startups) is collaborating with [Auth0 for Startups](https://auth0.com/startups/mongo-db) to provide top security for applications by the most innovative startups! 

### Why should a startup be a part of the MongoDB and Auth0 startup programs?

Customers, investors, and stakeholders expect many different things from you, but one thing in common is responsibly managing their data. 

Companies choose MongoDB because it accelerates application development and makes it easier for developers to work with data. 

Developers mindful of security, compliance, and privacy when it comes to data use the robust Auth0 platform to create great customer experiences with features like single sign-on and multi-factor authentication. 

<include src="QuoteCard" body="Auth0 and MongoDB are very complimentary in nature. While MongoDB provides a strong, secure data platform to store sensitive workloads, Auth0 provides secure access for anyone with the proper authorization. We are safely using Auth0 as one of the data stores for the encryption piece, as well as using those keys to encrypt all of our users’ confidential information inside MongoDB." name="Soumyarka Mondal" title="Co-Founder" team="" company="Sybill.ai" />

### What is the Auth0 for Startups Program?

Auth0, powered by Okta, takes a modern approach to identity and enables startups to provide secure access to any application for any user. Through Auth0 for Startups, we are bringing the convenience, privacy, and security of Auth0 to early-stage ventures, allowing them to focus on growing their business quickly. 

The Auth0 for Startups program is free for one year and supports the following:

* 100,000 monthly active users
* Five Enterprise Connections
* Passwordless authentication
* Breached Password Detection
* 50+ Integrations, 60+ SDKs, and 50+ Social & IdP connections

### What is the MongoDB for Startups Program?

MongoDB for Startups is focused on enabling the success of high-growth startups from ideation to IPO. The program is designed to give startups access to the best technical database for their rapidly scaling ventures.

Apply to our program, and you will receive the following:

* $500 in credits for all MongoDB cloud products (valid for 12 months)
* A dedicated technical advisor for a two-hour, one-to-one consultation to help you with your data migration and optimization
* Co-marketing opportunities
* Access to the MongoDB developer ecosystem and access to our VC partners.

> Apply to [Auth0 For Startups](https://auth0.com/startups/mongo-db) and the [MongoDB for Startups Program](https://www.mongodb.com/startups?utm_campaign=startups-partners&utm_source=auth0_for_startups&utm_medium=community&utm_content=startups) today.

MongoDB Joins Auth0 to Help Startups Combat Security Risks

In 2022 we witnessed a surge in the number of companies who have taken advantage of the [Auth0 for Startups](https://auth0.com/startups) program: doubling from 600 at the beginning of this year to 1200 at the time of this post. That’s 1200 early-stage ventures enjoying a startup-focused plan from Auth0 that’s free for one year – all with the goal of growing using Auth0’s enterprise-ready tools.

### Funding Cap Expansion

In this year’s spirit of doubling, I am excited to share that we are **increasing our funding limit to $5M** more than double our previous $2M cap for the amount of venture funding a startup in our program could have received. This expanded limit will help an even broader group of early-stage companies leverage Auth0 for their identity needs so they can focus on growing their core businesses.

### How to Get Involved 

Join the 1200+ startups that have benefited from the convenience, privacy, and security of Auth0 by applying for our program at [www.auth0.com/startups](http://www.auth0.com/startups).

Auth0 for Startups Expands Eligibility

Salman Ladha

As a Product Marketing Manager, I’m responsible for communicating the value of identity for SaaS application builders and our public sector vertical. I’m particularly passionate about the role identity plays in accelerating business growth, promoting product adoption, and establishing trust. Outside of work, you can catch me reading, working out, or watching the latest Marvel movie.

Senior Product Marketing Manager

How identity can help startups scale up-market to win bigger deals.

Most (not all) founders at Business-to-Business (B2B) and Software-as-a-Service (SaaS) startups dream of becoming the next industry-defining enterprise application like Salesforce, Slack, or Atlassian.

To have millions of daily active users, billions of dollars in market capitalization, and the comfort of being a staple in the technology stack of another business, is a revered status that [fuels the ambition of hungry startups](https://auth0.com/blog/so-you-want-to-be-a-unicorn/).  

An important step to attaining such scale is the difficult journey of moving upmarket to acquire enterprise customers. From both a go-to-market (GTM) and product perspective, enterprise customers come with their own unique set of [requirements](https://www.enterpriseready.io/), which can overwhelm even the most disciplined teams. As a burgeoning startup, pursuing these opportunities may feel like a double-edged sword.

On the one hand, adding a large, recognizable brand to your customer base would improve your company’s standing in the market. On the other, it would mean diverting most (if not all) development resources towards building capabilities that aren’t central to your business’s core value proposition.

The good news is that business customer identity solutions can help provide startup teams with the necessary tools to incorporate standard enterprise-ready capabilities early on in their product development, thus unlocking future growth. In doing so, identity can support GTM motions without bogging down technical teams in the long run. 


## 670 Billion Reasons to Move Upmarket 

The enterprise market is an attractive space for SaaS companies for one main reason: there’s a lot of money on the table.

Digital transformation continues to change the way businesses operate, particularly related to the adoption of cloud applications. Investments into SaaS products were up [50% in 2020](https://www.blissfully.com/saas-trends/2020-annual-report/) compared to the previous year and showed no signs of slowing down. [According to a Gartner®](https://www.gartner.com/en/newsroom/press-releases/2022-01-18-gartner-forecasts-worldwide-it-spending-to-grow-five-point-1-percent-in-2022) report, worldwide spending on Enterprise Software is projected to reach almost 670 billion dollars this year alone, representing an 11% growth rate. 

For startups, entering this segment of the market not only signals a level of product maturity but also supports long-term, sustainable growth by widening the total addressable market (TAM) of the business and increasing profitability in a few ways. 

First, the average selling price (ASP) for an enterprise customer is typically much larger than others. As an example, let’s consider Shopify, the Canadian E-commerce company that helps businesses sell, ship, and process payments online. Their core platform, geared towards small and medium-sized businesses (SMB), has an upper price point of $299/month. In stark contrast, Shopify Plus, their enterprise offering, is nearly ten times that, starting at $2000/month. This is why enterprise deals can grow revenues from [10 to 30](https://www.saastr.com/why-tilting-just-a-smidge-from-self-service-can-grow-your-revenue-30x/) times the original product’s value depending on the market, product, and offers. 

Secondly, enterprise clients are [less likely to churn](https://www.cmswire.com/analytics/enterprise-saas-churn-rates-whats-acceptable/#:~:text=According%20to%20Lincoln%20Murphy%20of,would%20be%20approximately%200.4%20percent.) from your service. Due to the higher ASP, longer contract lengths, and less price sensitivity, the average churn for enterprise customers can range anywhere from 1% to 5% compared to the 20% - 25% churn seen from their SMB counterparts. 

Finally, adding a recognizable brand to your customer base exerts a form of gravity that other GTM teams can leverage as it signals a degree of credibility for your offering. As an example, look at the customers cited on your favorite SaaS applications home page. You’ll likely find larger, established companies. For what it’s worth, AMD, Pfizer, and American Airlines are just a few of the global brands you’ll find on the Auth0 [home page](https://auth0.com/). 

When you combine all of those factors, the benefit on pipeline generation, top-line revenue, and net dollar retention paint a compelling picture of the financial benefit of moving upmarket. 


## The Challenges of Building for Enterprise 

The natural question is if the enterprise space is so lucrative, why doesn’t every company race towards it like their valuation depends on it? 

Though a SaaS company may demonstrate market viability with its customers in the SMB segment, the needs of the enterprise are significantly more complex, often stressing functionality around user provisioning, administration, and security at scale. They’re inherently risk-averse and rely on well-established patterns to vet the security of the SaaS applications they adopt. Common requirements of doing business with larger customers include: 

* **Single Sign-On —** so that administrators can easily manage user provisioning and de-provisioning via their own IdP while making it simple for employees to access an application. 
* **Multi-Factor Authentication —** to align with security policies and validate the owner of the account is the one actually trying to access the application. 
* **Role-Based Access Control (RBAC) —** so that appropriate levels of user permissions can be granted throughout an application.  
* **Compliance Accreditations —** certifications such as [SOC2](https://auth0.com/blog/soc-2-compliance-and-certification-what-saas-businesses-need-to-know/), [ISO27001](https://auth0.com/blog/what-is-iso-27001-2013-a-guide-for-businesses/), and [PCI](https://auth0.com/blog/what-is-pci-a-business-guide-to-compliance/) DSS that are granted by a third party and assert a professional standard.
* **Data Privacy Compliance —** adherence to privacy laws and regulations such as GDPR, LGPD, APPI, and CCPA. 

It’s not _impossible_ to build these capabilities with developers in-house, but it is challenging and requires subject matter expertise in identity, security, and protocols. 

However, just because developers _can_ build something doesn’t mean they _should_. When it comes to platform capabilities like authentication, startups should weigh their decision against two key criteria:

1. The opportunity cost of doing it yourself 
2. The potential cost of getting it wrong  

B2B buyers have never had more options for the SaaS solutions they adopt. Consider the marketing technology landscape, with over [8,000 products](https://chiefmartec.com/2020/04/marketing-technology-landscape-2020-martech-5000/) that promise some variation of the same value proposition. Building a single sign-on solution from scratch might meet the requirements of the enterprise customer you’re trying to close a deal with, but it also takes away from your team’s ability to work on the core customer problems your technology aims to solve. While you’re bogged down learning the nuances of SAML protocols, competitors can double down on product innovation and focus on delivering differentiated value from your offering. 

Additionally, putting the responsibility of building mission-critical infrastructure onto developers whose core expertise lies outside of security is a risky proposition because the financial and social costs of getting it wrong are severe. Identity is increasingly becoming a target for bad actors. According to Verizon’s 2021 Data Breach Investigations Report, [80% of web application breaches](https://www.verizon.com/business/resources/reports/dbir/) involves using stolen credentials. On average, credential stuffing attacks cost businesses upwards of [4 million dollars](https://www.information-age.com/credential-stuffing-123482099/) a year. Sifting through protocols and leveraging open source code—which has also been shown to have [vulnerabilities](https://www.sonatype.com/resources/white-paper-state-of-the-software-supply-chain-2020)—might feel like an easy option, but it’s highly stressful for internal teams, requires constant attention in the form of maintenance, and if something does go wrong, it can leave your business in tatters. 

## Becoming _Identity_ Ready to Fuel Growth   

Your identity platform should be a crucial tool in your efforts to grow and land larger customers. Auth0’s Business Customer Identity solution is purpose-built for the unique needs of B2B SaaS organizations. With it, customer requirements around Enterprise SSO and Multi-Factor Authentication are available out-of-the-box. Coupled with our high availability cloud services that ensure a [99.99%](https://status.auth0.com/) SLA, you’ll have another great reason for that larger customer to sign on the dotted line.

Development teams can quickly implement Auth0 into your application with well-documented APIs and SDKs. In fact, many of our customers go live in [less than a month](https://auth0.com/case-studies/innit-inc/) and have been able to [shorten their time to market](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas?utm_content=dsa&gclid=Cj0KCQiAosmPBhCPARIsAHOen-NkJJirZcFB7dOkaSL7_S3nBwgTP9G1yZ-pxJ0pK8Eal8ZKRncqI_IaAszlEALw_wcB) for other key product capabilities. 

You’ll also have the peace of mind of having an on-demand, identity security system in place. Secure the data of your business customers by quickly adding protection against some of the most common attacks on identity systems out of the box. From bot attacks to credential stuffing, Auth0 takes the burden of identity security off your internal teams so that they can focus on shipping new features for your product.

Importantly, all of this can be managed programmatically and at scale using Auth0 Organizations, which can help you represent all your business customers in your multi-tenant application.  

If you’re interested in learning how other SaaS businesses used Auth0 to move upmarket and nab larger customers, check out our [Sendoso case study](https://auth0.com/case-studies/sendoso/). 

## Gartner Trademark
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

<include src="asides/AboutAuth0" />

Identity is the First Step Towards Enterprise Readiness

richard-marr

GM, APAC

Richard Marr

Bolstered by a 42% increase in unicorns, India’s technology startup scene is powered by developers focusing on new core products

Have you noticed the number of Indian startups making international news lately? Well, the world media and investors sure have, and with good reason. The startup scene in India has not only weathered the last year of global uncertainty, it’s managing to thrive by staying focused on core offerings. According to a report from [KPMG and Pitchbook](https://home.kpmg/xx/en/home/campaigns/2020/01/q4-venture-pulse-report-asia.html), that worked out to 2019 Q3 returns in the $3.6 billion range. 

Fortune India reports that as of the end of 2019, India was home to [26 unicorns](https://www.fortuneindia.com/bengaluru-buzz/indias-unicorn-club-set-to-expand-in-2019/102896). And according to Inc42, by the end of 2020, [11 more were added to the ranks](https://inc42.com/infocus/year-end-review-2020/11-indian-startups-that-defied-the-pandemic-to-enter-the-unicorn-club/). That’s an increase of 42%, during a global pandemic no less. The keys to this success are varied, some say it’s the wide range of user pain points these products address — from remote learning platforms to touchless payment options, and from low-interest loans for struggling students to drones that are helping wipe out malaria.

Today, we want to give you an overview of the technology startup scene in India, starting with a brief history showing the roots of today’s expanding successes. Then we’ll touch on a couple of our favorites to highlight the diversity of needs being addressed. And finally a look at the developer-focused nature of some of the startups we’re working with, and how this model is helping them thrive in today’s reality.

<include src="QuoteCard" body="We wanted a single sign-on solution for our employees that gave them seamless and secure access to various company applications. Auth0 fit that bill and it was nice that we did not have to manage the service ourselves. It also allowed us to set rules to limit user access to specific applications. We also like the fact that we can integrate and test multiple tenants/applications in a distinct QA/UAT environment before deploying to production." name="Rahul Bhargava" title="CPO, CTO" team="" company="InCred" />


## Technology Startups In India: A Condensed History

A recent study by [Global Entrepreneurship Monitor](https://www.gemconsortium.org/country-profile/69) reported that nearly 20% of workers in India intend to start a business within three years. That statistic sums up the entrepreneurial spirit of the sub-continent and forms the foundation for growth we’re seeing today. India’s role on the international tech scene began in 1968 when Tata Consultancy Services partnered with an American mainframe manufacturer to provide support services. Successive waves of development followed, continuing through the 2010s when an expansion of R&D facilities led to further innovation and expansion of infrastructure, including the creation of Indiastack — a homegrown consent-based scalable architecture that is helping power the next wave of IP-based, deep-tech innovation in India. 

The tech sector has now matured to the point where homegrown incubators and accelerators have taken the lead and are helping fuel the current round of startups. These new startups are building on a solid history of innovation and collaboration — and adding their own unique stamp with cutting-edge advances. Along the way, they’ve developed an understanding of the power of outsourcing and partnering with fellow innovators who may be producing something they can incorporate to further their own product development.

## Indian Startups Address a Range of User Pain Points

With a local business history ranging from outsourced support for mainframes, all the way to cutting-edge R&D, it’s no wonder there are so many interesting and innovative startups in India today. And when you look at the international trend toward componentized development you see why companies with this rich and varied history are able to thrive. To keep it on topic, we decided to highlight a handful of startups that we at Auth0 are already working with to give you a taste of the range of use cases being addressed.

The founders of these organizations saw a need in their communities and decided to create the technology that could address those needs in scalable ways. In partnering with us here at Auth0 to ensure their CIAM needs were met while allowing their in-house development teams to focus their talents on developing the best core product possible, these young organizations are laying the groundwork for sustainable growth going forward.

### InCred: Single sign-on streamlines the development cycle

[InCred](https://www.incred.com/) is a new-age financial services platform that leverages technology and data science to make lending quick and easy for individuals and small businesses. They believe traditional ways of lending tend to exclude those most in need because of outdated, rigid, and inefficient processes. InCred has simplified the lending process, leveraging cutting-edge technology and a sharp focus on serving their borrowers’ unique needs and circumstances to offer a truly superior borrowing experience.

InCred was founded to provide microloans with terms that would allow their customers to thrive while building credit. With zero brick-and-mortar presence, the entire InCred loan process is app-based, yet backed by human-powered, and human-scaled, customer service. When they needed a single sign-on (SSO) solution that would let them set granular controls to limit user access to specific apps, they turned to Auth0.

### LambdaTest: Easy extensibility via a cloud-based testing platform

[LambdaTest](https://www.lambdatest.com/) is a SaaS platform that enables software developers and QA testers to run tests faster and more efficiently on a cloud infrastructure. LambdaTest allows developers to increase their browser coverage and cut down on overall test execution times. With LambdaTest, developers can test their website’s look, feel, and performance on more than 2000 browser, operating systems, and device combinations — all from one platform.

LambdaTest spotted a clear gap in the market for a development testing environment that allowed cross-platform testing in an accessible format. Testing teams across the globe were struggling to scale up their resources to match the fast-paced development cycles global consumers demand. Their platform allows even the smallest bootstrapped startup access to the testing power they need to ensure cross-platform compatibility. And Auth0’s extensive SDK library and easy extensibility pairs well with this model, allowing LambdaTest’s customers to quickly and easily access all of their testing tools smoothly, knowing that we can scale at pace with their expanding business.

### mPokket: Hybrid environment authentication, simplified

With an estimated seven million Indians graduating college each year, [mPokket](https://mpokket.in/) knows it can be hard when you’re just starting out in the world. With their app, students and recent grads can get instant loans to cover bills or rent without the need to provide collateral. In addition, the borrower can set their own custom repayment schedule of up to three months This limited repayment timeframe is to encourage prudent financial planning and careful use of available funds — thus setting them up to be successful savers and investors later in their working lives. By focusing their microlending business on young adults, mPokket aims to help the next generation achieve financial independence earlier.

mPokket makes ample use of Auth0’s Log Streaming capabilities to help ensure compliance with India’s financial reporting standards. They also cite our seamless authentication user experience across their hybrid application landscape as a determining factor in their decision. They are also seeing increased conversions due to the ease of use provided by social sign-on in addition to static user databases. 

### Ontic: Ensuring compliance via integrations

Blending digital with real-world security is where [Ontic](https://ontic.co/) steps in. They provide the first protective intelligence platform that takes digital intelligence and brings it to physical security professionals. This ensures that those in charge of protecting an institution’s most valuable assets, its people, have the most relevant intelligence for early threat detection. Insights from Ontic’s cloud-based SaaS platform allow corporate security and education leaders to better identify pre-incident indicators, perform risk assessments, and mitigate potential threats in order to protect employees, patrons, students, educators, facilities, and schools.

What Ontic sees in Auth0 is a SaaS partner. The time and resources saved by partnering with us are put directly into developing the best core product possible. By allowing their clients to seamlessly integrate with Auth0 single sign-on and Multifactor Authentication, Ontic enables their clients to remain compliant with their own industry regulations without the hassle of creating these integrations internally. And knowing that updates and maintenance of their login flow are in the capable hands of our industry specialists takes one more stress away from their development team.

## One Thing These Startups Share Is a Developer Focus

The history of India’s technology sector has led to a healthy community of software developers with years of experience and often highly specialized expertise in their fields. These companies are using their entrepreneurial tolerance for risk and their innate problem-solving abilities to flourish, even during a global pandemic. 

A global survey conducted by [Auth0](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas) found that when a software company puts their trust in their developers, they spend more wisely when it comes to SaaS products. This, in turn, allows these companies to stay agile and speeds their time-to-market considerably. And with the majority of startup founders coming from a development background, the current crop of Indian startups are very strong in their developer focus, further aiding their successes. 

By allowing their often small development teams to focus on the core product with smart investments in platform as a service (PaaS), [identity as a service (IDaaS)](https://auth0.com/blog/identity-as-a-service-in-2018/), and other SaaS offerings, these startups are positioned to create the disruption they’re looking for, no matter what sector or industry they’re entering. In [Auth0’s recent survey](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas) of global IT managers, development leaders, and technology industry executives, we found that a full 91% of developer respondents feel that having a say in SaaS purchases leads to higher overall job satisfaction (88%) and an increase in productivity (87%). 

This developer-centric model is how Auth0 works as well. We were founded on the idea that by empowering developers to focus on their core strengths, companies are better positioned to come out with the best products possible.

We make it easy by bundling everything you need in a [customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) solution into a streamlined package with all the SDKs and APIs your developers need to integrate Auth0 into your core offerings. Download our recent whitepaper on [How Development Teams Purchase SaaS](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas) to learn more. Or [Get in touch](https://auth0.com/contact-us) with one of our specialists today to begin the conversation.

<include src="asides/AboutAuth0" />

India Startups Are Thriving, With More on the Way

angela-devlin

Program manager focused on all things self service at Auth0. I am passionate about making Auth0 the very best user experience for all of our customers. In my free time, I’m with my husband and two daughters at the park, hanging out with my adorable old cat or heads down working on my MBA.

Program Manager, Self Service

Angela Devlin

How using Auth0 can solve your startup's authorization and identity needs.



As an Identity Platform, we believe it is especially critical for young startups to determine their identity solution and implement it right from the start, to avoid complications and extra work down the road. Auth0 has always been dedicated to innovation by offering simple authorization and identity solutions to developers, so you can focus on what matters most to you. We are also dedicated to equality and want to level the playing field by making our services easily accessible to minority founders and companies that may run into specific challenges during their first steps as a business. To help you with your awesome new ideas, **we are now offering our startup plan free for a year** to anyone that meets the following criteria:

* Your startup must be under two years old.
* Your startup must be venture-backed and with less than $2M of funding.
* Your startup must have less than $1M in revenue.

Auth0 can help you by handling your business critical identity processes, providing a seamless and safe login experience. Auth0 is also compliant with end user data requirements, GDPR, HIPPA, and more; we can help you stay compliant as your business and identity needs grow. 

_"We are a privacy-first company. Knowing that Auth0 is GDPR compliant was a big factor in our decision to expand our partnership. It goes without saying; we feel very secure."_ Itay Flikier, Engineering Team Leader at Otonomo.

Auth0 is an industry leader in simplicity, control, and extensibility. We know how much time you need to spend on your core business, especially in the early stages, and want to take care of your identity needs, so you can focus on what is most important. We also know that as a new startup, you will be concerned with saving money. While our customers see significant cost and time savings using Auth0, the startup program will be provided to you for free for a full year, so you don't have to worry about that either.

_"If we didn't have Auth0, we'd probably need seven or eight developers focused on [identity]. Our teams now can spend much more time working on the improvements that our customers actually see and care about. Not having to spend time on means that we get to spend time on everything else."_ Chris Hood, CT, and Co-Founder at GO1.

Auth0 safeguards billions of transactions each month, let us help you with yours.

Sign up at [https://auth0.com/startups/](https://auth0.com/startups/)


Auth0 Startup Plan Now Free for Everyone

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

We are offering free services to startups to help innovators tackle the challenges we are all facing



I know how difficult it is to start a business when the world is relatively calm, let alone the one we all find ourselves in now. Nothing is the same as it was. Between scrolling through rolling news channels and worrying about ourselves and loved ones, we are all looking for ways to help one another. For those companies trying to make progress during these times, I know how much harder it must be. 

We already offer a free tier of service to thousands of customers to help them innovate, but starting today, if you are a startup battling the impact of COVID-19 and meet our program criteria [1] , then you are eligible to get a **year of Auth0 Startup Relief for free**. From Single-Sign-On (SSO) to anomaly detection, we are making it easier to manage all of your users’ identities, however, they access your applications.

The “Auth0 Startup Relief” is designed for those who are doing any one of the following:

* Fighting the virus 
* Helping those who can’t work due to travel restrictions
* Enabling distance learning
* Helping small businesses who are struggling 

We want the best minds thinking about how to make things better, not worrying about authentication or authorization. And we are going to continue finding ways to make our technology available to those who need it most, as well as actively engaging with anyone who wants our help and advice during these times. [We also just announced free workforce authentication for businesses](https://auth0.com/blog/auth0-makes-workforce-authentication-free-through-august-2020/), through to August 31st, for up to 500 employees as well.

We at Auth0 hope this will further help these innovators fight COVID-19; we are rooting for you! 

## How It Works

1. Fill out your information [here](https://auth0.com/contact-us?utm_source=blog&utm_medium=oc&utm_campaign=businesspost&place=blog%20post&type=link&text=here) and don’t forget to include a mention in the message field that your startup is applying to the “Auth0 Startup Relief”
2. Our team will get back to you in less than 2 business days to confirm your eligibility and, assuming you meet the requirements, to help you start using Auth0 services for free for a year.

![Free Auth0 to help innovators fight COVID-19](https://images.ctfassets.net/23aumh6u8s0i/6n2zNChmRNytjOyp58cb0M/502f54c3101011828211819bcbda58d1/value-customer)

[1] In addition to meeting one of the Auth0 Startup Relief criteria, your company must meet these requirements as of the date of your application

* Less than $1M in Annual Recurring Revenue (ARR)
* Less than $2M in raised funding
* Less than 2 years old

<include src="asides/AboutAuth0" />


Auth0 Startup Relief: Helping Innovators Battle COVID-19

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

How Startups and SMBs can balance compliance with growth



For startups and small and medium-sized businesses (SMBs), “Move fast and break things” is no longer a viable philosophy for data privacy. Today’s startups and SMBs face the same relentless pressure to innovate, grow, and scale as the Silicon Valley darlings of yesteryear but must contend with a slew of new laws demanding much greater care in how customer data is handled.

The rapidly shifting attitudes and regulations governing data privacy are putting executives in a challenging position. After all, customer data remains an essential asset in doing business, and tasking developers to build and maintain identity management tools is costly and time-consuming and pulls them away from working on your company’s core product.

Data privacy laws have existed in Europe, the Middle East, and Africa for some time, but we’re in the midst of a new wave of global laws, led by the EU and California. Given the threat of massive fines, and the genuine public interest in preventing data mismanagement, startup and SMB executives are having to give [data privacy](https://auth0.com/explore/data-privacy/) greater consideration than in the past.

In this piece, we’ll offer a primer on current and upcoming data privacy laws and discuss how outsourcing identity management can make you compliant without sacrificing growth.

## Catch up to (and get ahead of) the laws

The current data privacy laws differ in their specifics, but they operate from similar sets of principles. The most fundamental shared mandates concern the right of users to access and control their personal data and the obligation of companies to disclose a breach of such data.

To comply with these laws, companies must be transparent in communicating their data practices and offer users the means to control, export, and remove their data.

Looking at the two most prominent laws and the others they have inspired will give executives a sense of where these trends are heading.

![Illustration of data privacy separator 01](https://images.ctfassets.net/23aumh6u8s0i/4XkWjoyQ9J2SUHkUo63OzT/f3fc030e823110e367abe0179057b4b0/data-privacy-illustration-separator-01)

## General Data Protection Regulation ([GDPR](https://auth0.com/gdpr/))

The EU’s landmark privacy legislation set the standard for the new age of data privacy by emphasizing user consent and calling for transparency and accountability in data collection. The GDPR applies to any company (not just tech) that processes the data of EU residents, regardless of the company’s size or where they are headquartered.

Anyone who doubted the seriousness of this law has been proved wrong by the wave of GDPR fines issued in recent months, prompting one Gabe Morazan, director of product management at CrownPeak to dub 2019 the “[year of enforcement](https://digiday.com/media/2019-is-the-year-of-enforcement-gdpr-fines-have-begun/).”

While the fines levied against Google and other major corporations have grabbed headlines, smaller companies are far from exempt. [TechRepublic](https://www.techrepublic.com/article/gdpr-fines-levied-so-far-the-lessons-businesses-can-learn/) reports that in the past year, a Portuguese hospital, a Danish taxi company, and the German social media company Knuddels were all slapped with penalties for failing to adequately protect, delete, or anonymize data. As TechRepublic states: “It does not matter to the European data protection authorities whether violations of the provisions of the GDPR are unintentional mistakes stemming from neglect, laziness, sloppiness, or ignorance.”

## California Consumer Privacy Act ([CCPA](https://auth0.com/blog/yes-data-privacy-applies-to-you/))

California’s privacy law, which takes effect January 1, 2020, has a great deal of policy overlap with the GDPR, though there are also [substantive differences](http://bakerlaw.com/webfiles/Privacy/2018/Articles/CCPA-GDPR-Chart.pdf). The CCPA applies to companies with customers in California, provided they:
- Have a gross revenue above $25 million
- Hold data on more than 50,000 consumers
- Earn at least half their revenue from selling personal data.

The [CCPA](https://auth0.com/ccpa/) allows for personal data to be collected, used, and sold, provided it is sufficiently deidentified. However, much like the GDPR, it requires that companies make their data collection policies available to customers and give them the ability to opt out of certain types of reselling. 

CCPA has also undergone several significant [amendments](https://www.adlawaccess.com/2019/09/articles/ccpa-update-legislature-amends-the-ccpa-to-exclude-employee-data-b2b-communications-for-one-year/) that require, among other things, for data brokers to register in California, for businesses to require at least two ways for customers to request information, and a one-year exemption on collecting employee data.

![Illustration of data privacy separator 02](https://images.ctfassets.net/23aumh6u8s0i/6qHnwuxvn5oC7kf9p7rIDj/f1bc4b28698f0c853632d08b1bd6f674/data-privacy-illustration-separator-02)

## Future (stricter) legislation

More laws are currently on the books or in the works that go much further than CCPA or the GDPR. However, in this environment, it’s easy for founders to be confused about which set of laws to tailor their product to. But generally, it’s a good rule of thumb to build on the principles laid out in the legislation discussed above, while still keeping an eye on the latest developments.

The [EU’s ePrivacy Regulation](https://iapp.org/news/a/eprivacy-regulation-continues-to-stall-but-theres-hope/) hasn’t passed yet, due to concerns that it’s too strict in prohibiting benign forms of tracking and cookies, but some form of it is likely to pass in the coming months.

In the United States, Maine's privacy law goes into effect in July 2020, and as the _[National Law Review](https://www.natlawreview.com/article/maine-s-new-internet-privacy-law-what-you-need-to-know)_ explains, it “requir[es] broadband internet service providers (ISPs) to obtain a customer’s express, affirmative consent before using their personal information, including browsing history.” Meanwhile, enforcement of Nevada’s [Senate Bill 220](https://www.infolawgroup.com/blog/2019/6/4/nevada-enacts-new-online-privacy-law-requiring-opt-out-rights-for-data-sales) became effective on October 1, 2019, and that law may be more aggressive than the CCPA in its requirements for letting consumers opt out of data sales.

Many of these laws have different definitions for crucial concepts, such as what constitutes personally identifiable information and how it should be anonymized. This patchwork of legislation presents a minefield that any company would struggle to navigate. Many observers think Congress is highly likely to pass unifying federal data-privacy legislation in the near future, but until then, whichever state passes the strictest laws effectively forces every company to play by its rules.

## Get control of your data

Like it or not, laws like GDPR and CCPA represent a huge paradigm shift in data privacy, and meeting their demands requires an immediate response. Of course, changing how your company handles data is a challenge for any team, and especially for startups and SMBs that are also trying to grow.

That’s why a [Wall Street Journal survey](https://www.wsj.com/articles/businesses-across-the-board-scramble-to-comply-with-california-data-privacy-law-11567947602) found that, even when faced with serious fines and a loss of public trust, only 52% of companies expect to be CCPA-compliant by the January 2020 deadline.

The unpleasant truth is that most companies don’t even have the ability to assess their current data privacy picture. User data is frequently siloed across applications, and companies frequently lack clear protocols for managing permissions.

You can’t tackle your data security until you have a holistic, high-level view of how it’s being accessed, and by whom, so getting this bird’s-eye view is the first step in getting compliant.

![The Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/01LwCh4Yy7Tk0LdhNxgxG8/7d2a6efdfb8b4c12093076b1e00b5140/auth0-dashboard)

The [Auth0 dashboard](https://auth0.com/docs/dashboard) lets you manage all of your users, employees, and third parties, quickly enabling or revoking permissions as needed. This kind of intuitive, de-siloed interface will be critical in order for companies to comply with the legal mandate (shared by the CCPA and the GDPR) that users be able to access, delete, or change their data in a timely fashion.

Once you have an organized look at your users, the best way to minimize your company’s exposure to fines and scandal is to minimize your data’s exposure to breaches. Implementing [multi-factor authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/) can give your company a huge boost in security, not just from cybercriminals using stolen user credentials but also from stolen admin or third-party contractor credentials, which can lead to massive data breaches.

As you restructure your company’s data privacy policy, keep in mind that it’s not enough to meet the legal requirements. Your company must also integrate well with other businesses, which are changing their attitudes and expectations around data privacy.

For example, Apple recently announced that any app on its platforms that allows for third-party sign-in options must also include [Sign In with Apple](https://auth0.com/blog/auth0-adds-sign-in-with-apple-as-ootb-integration/). This is considered a privacy-friendly option since Apple doesn’t share information on nearly the same scale as Facebook or many other social login providers.

[Auth0](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/) is already integrating it into [Universal Login](https://auth0.com/docs/universal-login) as an out-of-the-box option. This integration is a must for any company that wants access to the App Store, and with Auth0, you can do it by flipping a [single toggle](https://auth0.com/blog/try-sign-in-with-apple-in-your-auth0-apps-today/).

![Auth0 Social Connections](https://images.ctfassets.net/23aumh6u8s0i/3rMC0k1THr4rYHnQ22y2zx/891a90db2e67aed1b0e233a26713139b/social-connections)

## Shift your philosophy, not just your policy

These laws, and the public outcry that brought them into being, require that companies make data privacy a foundational principle woven into their entire operations. The legislators behind CCPA and GDPR have indicated that they will consider whether companies have acted “[in good faith](https://auth0.com/blog/data-privacy-2019-the-lowdown/)” when issuing fines. Proving good faith starts with aligning your company’s philosophy to the legal demands, and there are some actionable methods to put that into practice.

Changing your company culture around data privacy and security starts with getting internal alignment. [Develop employee training](https://www.vyond.com/resources/how-to-create-cybersecurity-training-videos-for-employees/) that educates your team on how to avoid social engineering attacks, such as phishing, and on the importance of following protocol in protecting data flow.

Embrace [transparency](https://auth0.com/blog/cybersecurity-shouldnt-be-a-secret/) in your cybersecurity and data collection policies to avoid appearing underhanded. Failing to explain how and why you’re collecting data leaves you vulnerable to scandal. Email startup [Superhuman](https://www.dailydot.com/debug/superhuman-email-privacy-scandal-explained/) became the most recent example of this phenomenon. Users learned the company collected location data via tracking pixels, and, despite a public apology, the damage to Superhuman’s credibility has been done. The backlash from this type of scandal can hurt even established companies, but the reputational damage is particularly devastating to startups and SMBs.

It’s hard to shift gears around data privacy overnight, and it’s even harder if you try to do it all yourself. For many startups and SMBs, off-loading identity management onto an IdaaS company like Auth0 is the most cost-effective way to shift your approach. If you’re rapidly scaling, and your team doesn’t have the bandwidth or expertise to address all of these issues, you can reap the benefits of Auth0’s accreditations and integrations without having to worry about constantly updating and maintaining identity to keep pace with the next set of laws — leaving you free to focus on your business processes and the core business driving your need for an identity solution.

<include src="TweetQuote" quoteText="It’s hard to shift gears around #CCPA or #GDPR overnight, and it’s even harder if you try to do it all yourself. How offloading #identity can help."/>

## Compliance doesn’t have to stall growth

Even if your company is under the minimum size for CCPA fines, you should still design your identity solution with growth in mind. You don’t want to lose out on landing a major customer because they aren’t confident your policies are up to their standards.

Conversely, you don’t want to slow your company’s growth by making your developers code for the complex and ever-changing demands of data privacy. For the vast majority of startups, off-loading identity management to experts is the smartest choice to allow you to focus on delivering your product. To learn more about your legal obligations and how our platform can meet your company’s needs, reach out to an Auth0 representative.

<include src="TweetQuote" quoteText="Even if your company is currently under the minimum size for #CCPA fines, why you should still design your identity solution with growth in mind."/>

<include src="asides/AboutAuth0" />

---


Data Privacy 101

ghazi-masood

I'm a seasoned business leader with nearly a 25 year track record in Sales running and managing teams of all sizes working in leadership positions for world class organizations.  Nowadays, you can find me at Auth0 leading all aspects of Revenue growth  for the Americas business.

Auth0 Vice President and General Manager, Americas.

Ghazi Masood

It's not magic. Startups can succeed if they have infrastructure that enables them to scale quickly and securely.


Unicorns (startups valued at over $1 billion) depend on rapid, uninterrupted growth. With just a [1.28% chance](https://www.cbinsights.com/research/unicorn-conversion-rate/) of achieving this coveted status, you need to set yourself up for success from the very start.

Your growth begins with creating infrastructure that fits your needs. To realize your vision for the impact you want to have on the world, you need to assemble systems that enable speed and efficiency — and can also rapidly adapt to change.

It's no easy feat. [Forbes](https://www.forbes.com/next-billion-dollar-startups/#56e3d2514441) believes Auth0 might be figuring it out. We wanted to share some of the insights and advice gleaned from our journey. While there's no one-size-fits-all solution, this piece offers entrepreneurs and their early technical teams advice on when to build or buy their tools, how to become a leader in customer engagement, and how to effectively manage a growing number of users as you scale. 

Nailing these critical components of growth early on will provide a solid foundation from which to take off.

## When Should You Buy, and When Should You Build?

As you grow, you'll need ways to store data, collaborate with co-workers ([particularly remote ones](https://auth0.com/blog/we-are-thankful-for-these-benefits-of-working-remote/)), and understand and connect with your customers. You’ll also need systems for [managing your finances](https://pilot.com/blog/merakis-hans-robertson-on-building-a-startup-finance-team/), hiring and human resources, and, of course, [security](https://auth0.com/security/). 

When confronting these challenges, teams at early-stage companies face trade-offs between [building or buying their own tools](https://auth0.com/blog/when-to-build-and-when-to-buy/).

![Startup Unicorn in the build vs buy tools/tech analysis.](https://images.ctfassets.net/23aumh6u8s0i/1wwxoR3yvEUhr4CBpXZ2UA/b7ae38df1cf649e93a5b91021a3833fa/the-build-vs-buy-analysis)

On the one hand, built tools have the potential to fit your specific use case and needs. If you create them in-house, your developers will have an intimate view of your team's mindset and working style. Though it might be time-consuming, building your systems fully on your own might pay off in the long run as you’re not incurring third-party fees.

On the other hand, when you're in the midst of rapid growth, [buying can be faster to implement](https://auth0.com/blog/auth0-roi-how-are-you-calculating-your-build-formula/). The upfront cost might be a challenge, but you won’t tie up your tech talent for months on end and can begin using your tools for faster ROI.

An approach that many startups take is to build certain components in-house and find trustworthy partners that understand their business and need for flexible solutions to fill in critical gaps.

Here at Auth0, for instance, we offer a [“buy and customize” model](https://auth0.com/learn/identity-faster-buy-customize/) for our identity solutions that can immediately address core issues like federation and offer teams the ability to refine other processes like user authentication. 

Auth0 Extensions enable third-party integrations that extend Auth0's base identity product. With Extensions, you can authorize users with groups, roles, and permissions; manage custom social connections; import and export existing users; create a single sign-on dashboard; and more.

The ability to [customize and integrate](https://auth0.com/docs/integrations) can help reduce business risk and close sales. 

As you grow and take on new [enterprise level clients](https://auth0.com/enterprise), striking the right balance of powerful and flexible tools becomes even more valuable — helping you to meet, and even exceed, demands of increasingly complex service-level agreements.

## Unicorns are Always on the Front Lines of Customer Engagement

Before long, you'll have too many customers to reliably speak to or survey. The importance of [feedback, metrics, and iteration](https://www.profitwell.com/blog/choosing-the-right-saas-metrics-for-different-stages-of-your-company) will require sophisticated analytics tools that can capture granular user data. 

![Startup Unicorn analyzing customer data in their decision-making](https://images.ctfassets.net/23aumh6u8s0i/m8HYvKo8fo1kVSN6go1wA/ab8df220f045c43ace7f96ab0cc8611d/analyzing-customer-data-is-key)

Infrastructure that enables [social login](https://auth0.com/learn/social-login/) can provide a stage for these analytics. Every time a user authenticates to your site, you can learn more about who they are and what they want — all while making it easier for them to log in. 
Social logins [reduce friction](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth//) so that users don't have to create new accounts to join your site. Less friction can result in lower customer acquisition costs, maximizing the value of your marketing efforts.

With social login, you can correlate [users' logins](https://auth0.com/docs/identityproviders) with other data, such as pages visited and shopping cart additions. You can even do [sentiment analyses](https://auth0.com/blog/4-ways-to-calculate-your-customers-happiness/) that search their login source, such as Twitter, for positive or negative mentions of your company. 

The sooner you know more information about someone, the better you can [personalize the onboarding experience](https://blog.clearbit.com/customized-saas-on-boarding-actions-person-role-referring-link/) and support retention down the line. 

In addition, Auth0 enables [progressive profiling](https://auth0.com/blog/progressive-profiling/), which builds up an image of each user as they interact with your product. Users authenticated through Auth0 each get a profile, which fills in with information from their identity provider, attributes created by [_Rules_](https://auth0.com/docs/rules), and information directly from users.

## Unicorns Always Efficiently Manage Their Users

This rapid model of change means that startups are constantly under pressure to spend resources on improving their core product. Speed must, however, match security. The more you grow, the more vulnerabilities you're likely to have, and the better target you become for hackers. 

Over half of SMB breaches result from [negligent employees or contractors](https://keepersecurity.com/assets/pdf/Keeper-2017-Ponemon-Report.pdf), but you can mitigate these threats by authorizing different levels of access for different people working to improve your products.

Identity is one of those areas that might seem like an afterthought; however, it becomes essential as your company grows. Authenticating new employees while you let go of others, and tracking all of your temporary contractors, consultants, and partners can become so complex that it drains technical resources from core product development. Losing sight of this, however, can result in gaps in communication, project delays, and even [data breaches](https://auth0.com/blog/what-is-a-data-breach/).

Outsourcing your identity needs is one way that many teams remain focused on their core business while easily and securely [managing different levels of access](https://auth0.com/user-management).

Auth0 profiles enable you to see detailed information on each of your users, such as authentication details, devices, login histories, and locations. With a comprehensive user management dashboard, authenticating users won't slow you down. 

Managing users on your own will cost you time, but a security breach can cost you your company. If growth is your goal, then defense and recovery need to be as important as your offense.

## You Want to be a Unicorn? Make Innovation + Infrastructure Work Together

Methods that made your company successful in its first year might not work in its fifth. If you want to be a unicorn company, your growth depends on flexible and powerful infrastructure that directly supports your [bold startup vision](https://www.intercom.com/blog/why-startups-need-a-strong-vision/) — even as it changes over time.

![Startup Unicorn innovating and growing thanks to powerful infrastructure](https://images.ctfassets.net/23aumh6u8s0i/4hSxXMHqxWgOdSTyUs57G1/f2e706df4f7956e9b6506681ac1e76ec/innovation-and-infrastructure-supports-growth)

No one can guarantee your success; however, finding the right balance of partners and tools to support you *will significantly increase your chances*.

<include src="asides/AboutAuth0" />



So You Want to be a Unicorn?

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Outsourcing cloud-based Identity as a Service (IDaaS) and Identity and Access Management (IAM) solutions are increasing in popularity amongst a variety of SaaS startups.



Chances are, if you're a B2B SaaS company (whether you're a large, established firm like Microsoft or an up-and-comer like Slack) — you're focused on being up to speed on the latest security tools. 

For teams of all sizes, however, it can be a challenge to keep up in a rapidly evolving threat environment. How do you ensure that your team has a safe foundation on which to scale?

Building your security practices around the starting point of understanding and managing all of your users can help ensure that you always have a handle on who is working within your system and with confidential information. When crafted well, a robust identity and access management (IAM) system for your users can be a springboard for moving forward.

<include src="TweetQuote" quoteText="When crafted well, a robust identity and access management (IAM) system for your users can be a springboard for moving forward."/>

## What Is Identity and Access Management (IAM)?

According to [Gartner](http://www.gartner.com/it-glossary/identity-and-access-management-iam/), "Identity and access management (IAM) is the security discipline that enables the right individuals to access the right resources at the right times for the right reasons." As teams become more dispersed and users are logging in across multiple time zones and various devices, IAM practices have emerged to organize and control appropriate access.

Historically, when teams were largely on site, enterprises simply used their own IAM software. Nowadays, as companies add more [cloud services](https://auth0.com/blog/moving-your-app-to-cloud/), managing access is becoming increasingly complex. For IT teams that are already swamped with maintenance tasks, outsourcing cloud-based Identity as a Service (IDaaS) and cloud IAM solutions is becoming more popular.

### Identity Management: To Build or To Buy?

While you might have the in-house capacity to build your own identity and access management system, most teams don't. Even if you do, going with a DIY solution is often [less cost-effective](https://auth0.com/learn/build-or-buy-20-identity-management-questions/).

In today's environment, an effective IAM solution should

* provide a clear and centralized view of all users at a given time;
* give an admin quick controls to communicate with, manage the access of, and even block users;
* be powerful yet still flexible to grow with your company; and
* help you comply with the latest security regulations.

Asking yourself the following questions will help you determine whether it's time to outsource your IAM:

* Have you thought about how you’ll [implement user management](https://auth0.com/docs/api/v2) (e.g., self-service or admin managed? 
* How will the user experience your solution?
* What [analytics](https://auth0.com/learn/powering-user-analytics-identity/) will you need for account creation and authentication events? 
* How will you use your system to stay on top of potential security vulnerabilities? 
* How will you [flag and mitigate anomalies](https://auth0.com/learn/anomaly-detection/) in user management and authentication events?
* How will you onboard new [B2B customers wanting SSO](https://auth0.com/learn/the-b2b-customer-value-journey/) for your product or service? 

For an even more comprehensive checklist, see Auth0's [guide](https://auth0.com/learn/build-or-buy-20-identity-management-questions/).

## Use Auth0 Lock for Simple, Secure Access

An example of a highly successful tool that has worked for a range of growing software companies, more established enterprise-scale companies, and even nonprofits is the [Auth0 Lock](https://auth0.com/blog/auth0-lock-is-here-for-b2b-and-b2c/). Auth0 Lock connects the login boxes of all users (i.e., both employees and customers) via a single, embeddable widget.

![Use Auth0 Lock for Simple, Secure Access](https://images.ctfassets.net/23aumh6u8s0i/7ovBZp8aNbgYrOgYCj2tIR/1dd6bb67c3b7c6807dd0f5375079537e/auth0-lock-connections)

Instead of having multiple login boxes for each category of users, which can add a layer of complexity to the admin process, entrance with Auth0 Lock is streamlined for all. Given distinct usernames and passwords, IT admins are easily able to differentiate between users as soon as they've logged in — and can view all activity at one time, from a central hub. Separate login credentials will usher users to different sites that suit their work needs. For example, if you're in [hiring mode](https://wizehire.com/), prospects can log in to fill out applications as easily as your [finance team](https://www.teampay.co/blog/finance-goals/) can update their records.

Once Auth0 Lock is implemented, your company can add features like [social login](https://auth0.com/learn/social-login/) and [single sign-on](https://auth0.com/single-sign-on) (SS0) to further secure and enhance the UX of authentication. It's simple to [customize](https://auth0.com/docs/libraries/lock/v9/ui-customization) Lock based on your company's needs and how you want the experience to be for your users. 

### The Power of Auth0 Connections

Auth0 sits between your app and the Identity Provider (like Twitter and Facebook, or enterprise providers like Active Directory and LDAP) that authenticates your users. Auth0 Lock is just [one tool of many](https://auth0.com/b2b-saas) that will help secure this connection. 

Auth0 supports over 30 social providers, 11 enterprise providers, and three legal identities. It adds a level of abstraction to your app to help isolate it from disruptive updates or idiosyncrasies of each provider's implementation. For example, as Facebook rolls out [new privacy standards](https://auth0.com/blog/cambridge-analytica-and-facebook/), any technical updates on their end that could change the login process for your users will be internalized and streamlined.

## If You're Still Unsure About Outsourcing Your Identity Management Needs, Consider Compliance

More than simply creating a safer and easier UX, Auth0 can help B2B SaaS teams comply with increasingly stringent [security regulations](https://auth0.com/security). A specialized provider like Auth0 can become a one-stop shop for adhering to GDPR and similar laws.

<include src="TweetQuote" quoteText="More than simply creating a safer and easier UX, Auth0 can help B2B SaaS teams comply with increasingly stringent security regulations."/>

Auth0 tools incorporate

* encryption;
* password protection; and
* five levels of password complexity.

In addition, Auth0 consolidates all of your user data into a single dashboard view, making it simpler to communicate processes to stakeholders — a core tenant of GDPR. 

Auth0 is a team of experts, focused on the specific task of authentication and user management 24/7. The company is up to date on all of the latest security developments and rapid changes in the industry. We monitor for new threats and adapt our tools accordingly for B2B SaaS companies at all stages of growth.


How B2B SaaS Teams Can Stay Up To Date With Identity Management

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Although considered the easiest option, building has it limitations when compared to the benefits of buying.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

The buy-vs-build battle is an eternal one for startups. With limited time, resources, and manpower, you're always weighing the relative benefits of building a piece of software in-house and buying it from a third-party vendor.

Even enterprises with access to the necessary resources face this challenge. Do they build because they can or trust someone to do it better and more efficiently than they can?

As time passes and the needs of startups and enterprises become more complex, new products and services contribute to making the decision to buy an increasingly beneficial one.

Here's a look at the history of some major technological innovations and how they changed perceptions of whether to build or buy software and platforms.

## The Rise of Relational Databases

Businesses have always been interested in the collection of data, but the introduction of the desktop computer as a mainstay of the office (and the home) brought their data collection capabilities to a whole new level.

By the 1980s, buying software like dBASE (for databases) or Lotus 1-2-3 (for spreadsheets) had become commonplace. Oracle's market-leading database software was a few years old and had already permeated thousands of businesses.

This revolution started in the early 1970's, when [E.F Codd](https://en.wikipedia.org/wiki/Edgar_F._Codd) first presented the concept of relational databases.

Before Codd's groundbreaking paper, there had been two models for how computerized databases could work: the hierarchical model and the CODASYL model (or network model). These were both based on *navigational* data models, meaning you found entries primarily through references from other entries. Numerous shortcomings with this method, including the total lack of a “search” functionality, encouraged Codd to look for a new system.

His proposed relational system proved to be far more efficient, and it enhanced the productivity of those who used it greatly. Programmers who wanted to access and use a relational database didn't need to [worry about how the data was stored](http://avant.org/project/history-of-databases/). They only needed to run the queries outlined in the emergent Structured Query Language—or SQL.

![DBMS interaction](https://images.ctfassets.net/23aumh6u8s0i/2E5aIePNI049jPoUYe6c1P/47285095f6e78886b5665df7304bac99/dbms_interaction)

While IBM fretted over how a relational database product would cut into the revenue they were generating from their navigational database product, Oracle CEO Larry Ellison had no such concerns. Within a few years, the relational database and SQL—the language used to interact with it—had become the default option. [Oracle](https://www.oracle.com/), based on the strength of their relational database product, reaped the rewards of this shift.

In the case of databases, the shift from build to buy came about as a result of the creation of **standards**. Prior to the relational takeover, there was no standout protocol, too many competing options, and no compelling reason to use any particular system over another.

With the rise of the relational database came not only standardization but the opportunity for companies to take that standard model and run with it, creating suites of applications *around* the database. With Oracle, for instance, every additional application that they released to their customers came bundled with, relied on, and expanded the utility of the customer's database. They aimed to become the hub around which a business's whole operations revolved, not just their database provider.

The standardization of the relational model made it possible for companies to begin providing truly great customer experiences. Here was a model that simply made more sense that everything that had come before—not only was it better for customers, it was better for entrepreneurs looking to solve problems for those customers.

## Access to Affordable CRM

The 1980's also marked the beginning of attempts to digitize the messy universe of *Customer Relationship Management* (CRM).

The earliest software was database-driven and was more [digital Rolodex](https://www.crmswitch.com/crm-industry/crm-industry-history/) than true relationship manager. The organization of customer contact information was its primary purpose. Siebel was born in the 1990's, becoming the first “sales force automation” product to really capture the market—but it was still limited in that it was exclusively sold to big enterprises (It's worth noting that founder Tom Siebel came from Oracle.)    

But the vast market of small to medium sized businesses remained largely without, relying on e-signatures and email to add order to the process of customer relationship management. That was until [Salesforce](https://www.salesforce.com). The *SaaS* (Software as a Service) model of Salesforce, driven home by founder Marc Benioff's guerrilla “software is dead” marketing, resulted in a product that was tailor-made (cost-wise) for *SMBs* (small and medium-sized business).

For the first time, a *CRM* tool could truly add value to the operations of an *SMB* and make buying a *CRM* a worthwhile endeavor. Their subscriber base grew rapidly.

![Salesforce growth](https://images.ctfassets.net/23aumh6u8s0i/6lfmop2ILMjtEULeQ7wnPd/13de453b39efe2bf2edce20c27c2b4b3/salesforce-subscribers)

What Hubspot's Dharmesh Shah calls their ["simple pricing and low-risk implementations"](https://www.quora.com/Why-did-Salesforce-com-succeed) allowed Salesforce to become the favored product of a massive market of *SMBs* in need of a *CRM*.

The introduction of Salesforce helped shift *CRM* from a transactional model where customers were just seen as data points to a relational model where customers were seen as business partners.

Like Oracle, they used the fact that they were becoming embedded in so many companies to begin offering add-ons that would cement their positioning. Look at their revenue today and it's clear that those add-ons—the Salesforce platform, analytics, marketing, and other services—are what drive Salesforce's [growth now](http://www.forbes.com/sites/greatspeculations/2015/11/25/here-is-the-reason-behind-salesforces-unabated-growth/):

![Salesforce Markets](https://images.ctfassets.net/23aumh6u8s0i/371gXtumfpHqexLICNif9H/5dd700fbf0575518a5e895b68b99b41d/salesforce-markets)

What those additional layers of services tell us is that once again, adding value on top of your core proposition is what can make buying (rather than building) a true no-brainer.

![Salesforce definition](https://images.ctfassets.net/23aumh6u8s0i/6NVf8PT5nn6Kln3H9GoUNL/8a8af600405d29101877542d77e58ff1/salesforce-definition)

Even today, businesses might not want to spend the money to pay for Salesforce or another kind of *CRM*. But the value being proffered now is so much greater. It's not just the *CRM* tool that you're paying for—it's a whole suite of analytics and services to help drive more value out of that data.

## The Evolution of Payments

Tech companies have never been very well served by banks, making online payments processing a tricky process. Banks were more focused on helping large enterprises manage high-return credit opportunities.

By the 2000s, new companies like Authorize.net and PayPal were working on the problem of online payments—but not truly cracking it. With Authorize, companies had to have a bank account linked to it. PayPal, on the other hand, had acquired a reputation for not being very user-friendly (by occasionally holding funds, for instance) and so payment remained a thorny problem for upstart developers.

Both eventually moved upmarket, leaving startups without a simple way to process payments just as consumer demand for it was increasing. There was no simple option—until [Stripe](https://stripe.com/).

At its start, Stripe did one thing really well. They made it incredibly easy for businesses to collect payments online. Whatever the revenue model—one-time, transactional, subscription—you could take a developer, and have they set up a working payments portal in one afternoon with just a few simple API calls. The onboarding was simple, efficient, and it got people up and running fast.

![Stripe landing page](https://images.ctfassets.net/23aumh6u8s0i/1PeAra8f1U7B4IFSFO0Yqg/e7b7c88d8cf89e35df0cfe0170f810c5/stripe-landing-page)

It's not enough to make something easy, of course.

What Stripe has done to move the tech world firmly into “buy” territory, when it comes to payments, is find the same kind of network effects that Oracle and Salesforce did.

When you use Stripe for payments, you're not just saving yourself the time it would have taken you to build a payments gateway. You're taking advantage of the fraud detection systems that Stripe has built. You're taking advantage of their massive marketplace of integrations. You're getting other features like international transfers and instant debit card payouts that are difficult to get whether your organization is small *or* large.

In other words, everyone has something to gain from buying Stripe vs. trying to build their own payments processor.

## Emergence of Identity as a Service

These technological shifts are just beginning. Every year, another industry is disrupted by the emergence of new back-end technologies that enable startups and enterprises alike to stop building and start buying. There's [Algolia](https://www.algolia.com/) for search, [SendGrid](https://sendgrid.com/) for email, [Zapier](https://zapier.com/) for workflow automation, and of course, there's *Identity and Access Management* (IAM).

When it comes to managing user identities, companies of all sizes used to build all of their own systems. This came with plenty of difficulties, like creating a flexible and secure *Single Sign-On* (SSO) system to maintaining security amidst ever-increasing threats.

These systems were also very expensive to build and maintain, but at the time, businesses had few options other than to build.

![Emergence of identity as a service](https://images.ctfassets.net/23aumh6u8s0i/4zOoUSlDg77TY3JWibMHD6/ba57cf4df6d0f0827fd10b3d484e5c26/iam)

It wasn't until *IAM* was introduced as *Identity as a Service* (IDaaS) that businesses were able to outsource to get a comprehensive identity management solution. With *IDaaS*, businesses, especially startups, can feel secure in everything from *SSO* to using cloud-based environments for access controls and compliance.

Anyone can now trust their compliance, authentication and security needs with a specialized provider. They don't have to worry about exposing themselves to vulnerabilities because of the risks involved with building their own system.

Nor do they have to worry about the cost of revisions and upgrades for an in-house product. These can be expensive, time-consuming to handle and require constant involvement, especially as a business grows.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

## To Buy or Not to Buy

Products and services for enterprises and startups have come a long way in many areas of technology. While it used to make sense to build in-house, customer needs and expectations have become more complex. This change means technology has to adjust accordingly.

You don't have to use your precious time trying to figure out something if you buy a third-party solution. Even if you have the capability and resources, chances are there's something you haven't thought of.

Let companies who've put in the time and research take care of processes that they can manage more effectively. If it makes sense for you to buy, your time is best spent on growing your business and focusing on what *you* do best.


The History Behind When Build Becomes Buy

We take a look at budget planning for startups and find out why making authentication part of the budget is more important now than ever



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Research conducted a comprehensive analysis of our identity platform and determined that using Auth0 can yield a 548% ROI and $9.9M in savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

2017 is coming and with it so do many tough decisions for startups and small businesses alike. Budget planning is perhaps the hardest of them. In this short article we will take a look at what is important for tech startups, how to aim for success in the coming year, and why you should consider authentication an important part of your budget. Read on!

<include src="TweetQuote" quoteText="Budget planning is tough, and authentication should be a part of it"/>

-----

## Introduction
December, the perfect time to review the failures and successes of last year. Startups fail and succeed based on their vision, so sitting back and reflecting on the things that went wrong is key to eventually becoming a successful, self sustaining company. An important part of this job is finding where exactly it is wise to use (or invest) the precious money from your investors. And in the world of ever cheaper, commoditized, software engineers, it is tempting to say "let's roll this feature in-house". This *might* be a great call. Think of Amazon: they developed a whole class of internal appliances and services. They invested millions on the necessary infrastructure, and, now, in retrospective we can say it *was* the right call. 

But what would have happened had Amazon made that same decision, to invest millions upon millions on the development of their own infrastructure and software, today? Would Amazon Web Services have been a success? Would their investment have payed off eventually? It is hard to say, but it probably would have costed them more. 

So finding the right idea on which to invest, or develop, is not just about the idea, but about the right time to do so. It is safe to say there are great alternatives for many things today. Buy, or develop them in-house? This is probably the single most difficult call software startups have to make today. An error in this area can make or break a startup or small business.

## Playing It Safe
There's no success without some risk, so identifying areas where your company *can* fail is of the utmost importance. Not only will this way of thinking show you great growth or investment opportunities, but it will also make it very clear which wars are worth fighting. For Amazon, yeah, developing world-class, globally distributed, datacenters was a war worth fighting. They had the vision, the opportunity, the time, and, fundamentally, a war chest big enough to survive failure in case they could not monetize their investment later on.

A different example: take a look at state-of-the-art chip companies. Keeping up with the pace of development and manufacturing requirements for the products that are coming out to the market is so crushingly exhausting, from an economic point of view, that it makes absolutely no sense to invest in manufacturing facilities unless you can keep the facilities at 100% full capacity. This results in interesting scenarios where competitors in the market are associates in manufacturing competing products!

Intel, probably the most advanced CPU manufacturer in the world, is the only CPU company that also owns their own manufacturing facilities (called "fabs" in the semiconductor industry). AMD used to own their own fabs, but it was so difficult to justify the expense of keeping manufacturing in-house, that they had to sell them. ARM, Nvidia and Apple do not own any fabs either.

We can spot a certain trend when it comes to technology companies: it is usually the first-to-market company that can reap most of the benefits of a big investment. This may sound too far removed with regards to startups, but think of it this way: most of the time, a startup is operating so close to running out of money, that, unless that startup is developing a first-to-market product, it is usually not worth investing in keeping that something in-house.

In the old days, every company kept their own mail server. Now you would be foolish to use something other than one of the corporate email providers such as Gmail or Outlook. They do what you could do much better and at a fraction of the cost.

> There are specific cases where a company might decide to invest in keeping a critical piece of infrastructure in-house. For example, a government institution might consider keeping an in-house email server a requirement to avoid denial-of-service attacks in case of conflict with the country that hosts Google or Microsoft's servers. Most of the time, this is not the case, however.

## Why You Should Not Develop Authentication In-House
Authentication is essential to all technology startups. Unfortunately, it is a complex subject. Not only a simple username/password is simply not enough (and inconvenient), but sensitive stuff can be accessed if your authentication system is compromised. In a sense, authentication and authorization are probably one of the most sensitive areas for technology startups. It appears deceivingly simple from the outside, but becomes a thorny subject as you start to learn its intricacies. Is your authentication system secured by two-factor authentication? Is an SMS fallback available? Are your users using passwords which have already been leaked from other sources? Are social logins implemented to bring more users to your platform? Can your system handle hundreds of thousands of users? Are your enterprise accounts supported and linked with your newer services? These are all tough questions for every startup. But with Auth0 things need not be this way.

![Social logins at a click](https://images.ctfassets.net/23aumh6u8s0i/DfHgQGni2SKeY28WfhIIi/c67598c34a3c56509307ec1e9705b7b3/social)

<a href="">Sign up for a free Auth0</a> account and learn why more and more companies are using an external authentication solution. You can get up and running in a matter of minutes, with support for features such as:

- [A visual dashboard for managing all settings](https://auth0.com/docs/user-profile)
- [Top tier security and availability](https://auth0.com/security)
- [Username/password authentication](https://auth0.com/docs/connections/database)
- [Social logins](https://auth0.com/docs/identityproviders)
- [Enterprise federation](https://auth0.com/docs/identityproviders#enterprise)
- [Passwordless logins](https://auth0.com/passwordless)
- [Multifactor authentication](https://auth0.com/docs/multifactor-authentication)
- [Single-sign-on](https://auth0.com/docs/sso)
- [Breached password detection](https://auth0.com/breached-passwords)
- [Programmable rules](https://auth0.com/docs/rules)
- [Easy integration for mobile and web apps](https://auth0.com/lock)

![Auth0 Lock](https://images.ctfassets.net/23aumh6u8s0i/1a5r3OSTVwrGQFEPk6ebvc/6450875cba0ca0e0dba8d99daee6f78c/lock)

Let us handle authentication for you so you can truly focus on what matters: delivering your product.

For example, consider the case of enterprise federation. The enterprise sales cycle is already too long. Meetings, contracts, and due diligence slow the sales cycle. Having to build authentication and enterprise federation proof of concepts for various enterprise connections delays the process further. Not being able to support enterprise federation the way a customer requires can cost you the sale. Having enterprise federation should be a "check-the-box" item rather than a feature to be scrutinized.

![Auth0 enterprise connections](https://images.ctfassets.net/23aumh6u8s0i/41AIv6yVWo8KryBCGn3oSe/1b466ea17aa01edb270cf4893d27982b/enterprise)

Auth0 features a comprehensive enterprise toolkit that supports features like federation through all major identity providers, single sign on (SSO), auditing, analytics, and enhanced security features like multifactor authentication and anomaly detection. Many of these features can be enabled and configured with the flip of a switch and a few lines of code.

Having a modern authentication platform does not result in increased revenue alone. Freeing up your developers to focus on building the unique features of your business, on the other hand, does. 

## Other Stuff To Keep In Mind
Unfortunately, budget planning is not all about what you can do in-house or buy from external providers. It also has to do with strategy. Here are some things we have found can make a whole world of difference:

- **Marketing**: we have found marketing is not all about showing your product or letting other people know your product or service exists. It is also about creating an audience. Rather than develop a product and then try to get people to but it, plan a marketing budget that includes elements that are useful to the audience your product caters for. In other words, consider reducing the money spent (or keeping it stable) in promoting a product, and increasing the money spent on building a community around your company.

- **Keep your employees happy**: this might seem obvious, but how many times have we seen a key developer leave early on becase he or she just wasn't happy with their job? Startups must value their top employees. It it the people that fundamentally trust the company and invest more than just their working hours in it that can make or break a product. Startups don't have the time or money to cope with employee turnaround. But don't be naive: keeping employees happy is not all about compensation. Consider keeping a part of the budget dedicated to out-of-office activities that employees can enjoy. Consider buying them equipment that they can take home. Consider running polls and asking them what would improve their mood at the office. Of course, this should never cause compensations to be affected.

- **Use data to make choices**: this can be applied to any department in your organization. Whenever you make a choice, make sure you have some way of collecting quantifiable data that can later be analyzed and turned into cold, hard facts about whether that choice was right. Consider including a dedicated data team for this purposes in the budget. Give them access to as many choices as possible and listen to their results.

- **Create a planning team**: using data has to do with learning about the results of a previous choice. A planning team, on the other hand, tries to analyze things before making a choice. For instance, have a dedicated team come up with budget and time-to-market figures for the development of in-house solutions before committing to doing them. Compare that with the external alternatives. In fact, do this for the authentication aspect of your company, you will be surprised.

## Conclusion
Budget planning is always a tough time for big and small companies. However, startups depend on making the right calls to survive until they can deliver a product. Keeping sharp focus on your product lets you use your resources and time in a much more efficient way. There is no point in developing in-house solutions to solved problems unless forced to do so. Successful companies understand this from the get-go and invest appropriately in the right external services and products. Authentication is, today, one of those services: tough to get right from the ground-up, and with great choices in the market. Invest wisely and reap the benefits. The sky is the limit!


2017 Budget Planning for Technology Startups: Authentication is Key

And how Auth0 can help you focus on your business



If you've ever developed software for a client, someone's asked you “How long do you think that will take you?” If you've heard that question, you understand the frustration and pain of project estimations.

As many as [80%](http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=1237981&url=http%3A%2F%2Fieeexplore.ieee.org%2Fxpls%2Fabs_all.jsp%3Farnumber%3D1237981) of software projects run over their initial estimations. Whenever you give a client a concrete estimation, you're more than likely giving yourself too little time. There are three main factors you must account for when estimating your project's length:

* **Knowns. **You can more accurately estimate the time it takes to do things you already know how to do.
* **Known-Unknowns. **Things you haven't learned yet, but you know you'll need for this project are harder to estimate, but are at least somewhat predictable.
* **Unknown-Unknowns. **Obstacles that you cannot predict or prepare for are the things that destroy project schedules. If you don't know you'll need something down the line, you have no way of accounting for it in your estimation.

Accounting for these different factors is almost impossible, but there is one thing you're probably doing that is making the task even harder. **You're re-inventing the wheel**.

Dumping hours into developing software and features you could get off-the-shelf is a time-suck you can't afford if you want to stay on schedule. Let's take a look at how missing your estimations hurts you, and how Auth0 can make things easier.

## How You Hurt Yourself By Missing Estimations

Tom Cargill of Bell Labs once said, “The first 90 percent of the code accounts for the first 90 percent of the development time. The remaining 10 percent of the code accounts for the other 90 percent of the development time.”

<include src="TweetQuote" quoteText="The remaining 10 percent of the code accounts for the other 90 percent of the development time."/>

This quip from 1985 has rung so true with developers over the decades that it is now referred to as the “[Ninety-ninety rule.](http://www.wou.edu/las/cs/csclasses/cs161/Lectures/rulesofthumb.html)” The joke is so light-hearted that it might lead you to believe that missing your estimations isn't a big deal.

The reality is, missing your estimations hurts you on several different levels:

* **You lose credibility with your clients** when you fail to deliver on your promises.
* **Your team's morale drops** when they're constantly failing to hit their goals.
* **Your project is in danger of being scrapped** when the team and the client are both unhappy.

![Hurting yourself by missing estimations](https://images.ctfassets.net/23aumh6u8s0i/5L3Nd4XGl3S596qFJlP5Sg/1e72315dd1e9bbb1dda42377d1c4ff32/hurting-yourself-missing-estimations)

Some elements of the process are going to be beyond your control. An obstacle is going to arise that you had never considered, that no one on your team has experience with, and that's okay.

What's not okay is wasting time developing in-house solutions when there are tools available on the market that can fix your problems today.

## Stop Re-Inventing The Wheel

Let's pretend you wanted to build a user authentication system for your app. Here is a brief list of the high-level decisions you're going to need to make:

* What will your signup and confirmation process look like?
* How will you secure transactions?
* How will you store passwords?
* Will you allow password resets? If so, how?
* Will you incorporate social authentication? With which providers? Will you use OAuth or OpenID?

And that's not even touching the nitty-gritty technical side of things, like how you will salt/hash your passwords or which libraries you will use.

![Implementing login for your application](https://images.ctfassets.net/23aumh6u8s0i/3iQjp0yUSKd5obyEP5fkXe/164c0b483253f726890eefeddea08d83/implementing-your-login)

All of these decisions are going to lead you to more decisions, each of which is a potential landmine for your project. Why risk making the wrong choice and destroying your project schedule when you can implement a powerful, ready-to-use authentication system right now?

Auth0 provides a lightweight authentication system that has been developed and refined by thousands of users and developers over several years. When you use Auth0, you aren't just saving yourself months of work, you're getting years of testing and product development that you couldn't get immediately with an in-house product.

One of the benefits of those years of development is that Auth0 has been a part of almost every use-case imaginable. In order to keep up with our user's needs, Auth0 has had to develop an incredibly robust feature set.

## Making Auth0 The Bedrock Of Your Software

Auth0's massive feature set doesn't just provide a solution to your authentication needs. It can serve as the spine of your entire project. Thanks to [Auth0 Rules](https://auth0.com/docs/rules) and [User Profiles](https://auth0.com/docs/user-profile), any automation that involves collecting user data or authentication is perfectly served by using Auth0.

Need to run an automated email campaign? Use Auth0's Segment Rule to collect user data, analyze it in Segment, and use Segment's built-in [Customer.io integration to automate your emailing](https://auth0.com/blog/2016/04/19/supercharge-your-registration-process/).

Or maybe you need to run analytics on your customers based on their location, income, and other personal details? Customize your own [analytics dashboard](https://auth0.com/learn/powering-user-analytics-identity/) using data collected with Auth0 Rules. You can have it running in a couple hours as opposed to a couple weeks.

![Analytics Dashboard](https://images.ctfassets.net/23aumh6u8s0i/5XkqqmDQtc9syUMHeGcRlt/b29b1782e36478d8000e6d0b81d48382/analytics-dashboard)

After all these years, Auth0 can immediately introduce a ridiculously diverse set of features to any project, regardless of the language or library it was created with. You're paying for more than easy authentication. You're paying for the bedrock of your entire project.


Why Your Project Estimations Are Always Wrong

Doing more with less is timeless. Here's why growth hacking still matters



In the late 1990's, tech startups were expected to spend money on traditional marketing and advertising channels just like everyone else. Then the bubble burst. 

The startups founded in the cash-poor aftermath of the dot-com bubble didn't have the resources to buy ads or hire traditional marketers, so they decided to treat user acquisition like it was a programming problem.

If growth is an algorithm, with effort going in and users coming out, it should be possible to optimize it. The basic strategy consisted of three tactics:

* **Experimentation: **They couldn't rely on traditional (and expensive) acquisition channels because their resources were limited. There was no method for acquiring customers that was off the table—as long as it worked.
* **Cleverness: **To unlock the virality that was hard-wired into their products, it was necessary for teams to think laterally and do things others hadn't considered or weren't capable of doing.    
* **Iteration: **There were no magic bullets. When teams found acquisition channels that worked, they doubled down and tested different inputs in order to maximize their results. Only once it stopped working was it set aside. 

As companies like Facebook, LinkedIn, Pinterest, Dropbox and Instagram found massive success using these methods, it became clear that tech startups were different when it came to growth.

To succeed, marketers needed to understand how distribution was different on the internet and how it worked at scale. Most of all, they needed to have a “hacker” mentality—they needed to be the kind of people that worked a problem from all angles, who relentlessly pursued the “secret sauce” of growth.

## Finding The Secret Sauce  

Most if not all “growth hacking” strategies on the web are well-known acquisition strategies framed as revolutionary insights. True growth hacking emerges organically from your product, it can't be externally imposed, and as long it still works, you're not going to tell anyone about it.

It's like your secret sauce.

![Your secret sauce](https://images.ctfassets.net/23aumh6u8s0i/3FIuELJXpC0J2oXVw7Eux2/74265e4a740c952a4d15df8fe866fa00/secret-sauce)

Sometimes, of course, you won't need to tell people. Sometimes the hack is hiding in plain sight, and all that sets you apart is the fact that you saw the opportunity before others did and had the skills to seize it. 

### How Airbnb drove traffic with a craigslist integration

Back before their $112 million Series B round in 2011, Airbnb was like many other startups. They had a platform and they needed users. 

They knew there was a big online market for short-term rentals—Craigslist had proved it. But Craigslist also *owned* it. Airbnb's founders, rather than trying to beat Craigslist at its own game, [decided to integrate with the service](https://www.quora.com/How-does-Airbnb-automatically-post-on-Craigslist). 

When users listed a room on Airbnb, they were given the option to cross-post their listing on Craigslist:

![Airbnb post to Craiglist](https://images.ctfassets.net/23aumh6u8s0i/uNgJ6qhGYQ86bYUMtIXDZ/d90ea87f002884d556effd91543952d9/post-to-craiglist)
![Airbnb Craiglist integration](https://images.ctfassets.net/23aumh6u8s0i/5CCve4Bn4hOLaASHn0ajLh/e13ced3dd6de6158bb6b09f4d4c578f1/craiglist-integration)
![Airbnb listing](https://images.ctfassets.net/23aumh6u8s0i/71WRVZjRSD1YO1k4P1rI14/08a2c7a1faa2da60c00c9c86d7d40ee3/airbnb-listing)
*Source: [Andrew Chen](http://andrewchen.co/how-to-be-a-growth-hacker-an-airbnbcraigslist-case-study/)*

To demonstrate the value of Airbnb, they needed to get in front of the people using Craigslist. By allowing users to cross-post, they helped both those looking to rent and those looking to rent out:

* **Those looking to rent** got well-formatted and detailed descriptions of the places they were renting. The upfront pricing, pictures, and inviting contact form offered a far better user experience than the classic anonymous Craigslist email address—and hinted at Airbnb's features.
* **Those renting** got to offer more appealing listings while also tapping into the massive user base on Craigslist.

It was a brilliant marketing move. Rather than drum up support around the product in the form of press and PR, they built a mechanism for growth *into *the product itself. The more people that browsed Craigslist rentals, the more that saw and interacted with Airbnb's platform and the more they were able to grow.

This integration gave their product an organic lever for growth. Not long after, with 70,000 nights booked on the platform, Airbnb raised a $7+ million series A. A few years later came their gargantuan Series B, and the rest is history.

![Airbnb New Users By Month](https://images.ctfassets.net/23aumh6u8s0i/1vntVFlTa57PWGC4N62RTz/585ef2832c1ab704821aee70274624a8/airbnb-new-users-by-month)

Airbnb's Craigslist growth hack was one of the first massively successful examples of integration-based marketing. Today, no one would even think of using Craigslist to find a vacation rental. 

In the years since, many have tried to replicate Airbnb's approach, but these things rarely work twice. Craigslist has tightened its API and most of its sections have far more competition today. That doesn't mean the integration approach is dead. It just means that today, it's less likely to be Craigslist on the receiving end of such a hack—and more likely to be a giant like Airbnb.

## Growth Hacking Is About Foundations

Clever tricks can accelerate your growth, but what gets lost in many conversations about growth hacking is sustainability. 

A good growth hacker uses network advantages to bring users to a product at an extraordinary rate. A *great* growth hacker brings in users that stick around.

### How Facebook Got To A Billion Users With Repetition 

Growth hacking isn't about tactics. Tactics are interchangeable and temporary. Growth hacking is something that, when done right, exposes your product's core value to a massive audience. The key to understanding how Facebook did this is the phrase “seven friends in ten days.”

![Facebook User Growth](https://images.ctfassets.net/23aumh6u8s0i/32gz080vSsH50oVPk1UQrr/fd65e182ab2f16ca85ed9ead30829658/facebook-user-growth)

As Facebook was just leaving college campuses and becoming popular around the world, their Growth team identified that users who had **seven friends** within their first **ten days** on Facebook consistently stuck around on the platform. Those who fell short of that were churn threats. With this information, the Growth team established a new paradigm inside Facebook.

[From that point on](http://genius.com/Chamath-palihapitiya-how-we-put-facebook-on-the-path-to-1-billion-users-annotated), the one metric that mattered for the Facebook team was getting more users to seven friends within ten days.

![Facebook Design Team](https://images.ctfassets.net/23aumh6u8s0i/1B3TdQDJIOkzSIftqej2qX/11eb8c9469efa12c72284beb24aaf630/facebook-design-team)
*Source: [Fast Company](http://www.fastcodesign.com/1665049/a-visit-with-facebooks-vp-of-product-and-his-redesign-team)*

Chamath Palihapitiya, the leader of the Growth team that took Facebook to a billion users, always goes back to the user experience when he talks about this “growth hack.” 

“My biggest fear was that we spam our users and we trick them and it will alienate these people,” [he said,](http://genius.com/Chamath-palihapitiya-how-we-put-facebook-on-the-path-to-1-billion-users-annotated) “You won't see it today but you'll see in three years from now or four years from now, and it accelerates when you compound that with a competitor who actually builds a better product that doesn't alienate people.”

That's why the seven friends in ten days metric was so crucial. It wasn't a growth hack in the sense that people use the phrase today. It wasn't some quick or convenient path to growth. Having friends on the platform simply made it *fun to use. *Facebook grew because the team was highly focused on making Facebook as fun as possible for as many people as possible.

Once they had that goal in mind, Facebook's growth was dependent on their ability to execute on it over and over again. All of the thousands of experiments they ran over the years that followed revolved around driving the “seven friends in ten days” metric. 

“When you understand core product value,” Palihapitiya says, “You can basically pivot around it and create these loops that expose it over and over again. This becomes the most important and obvious thing to do.” The companies that do it right, he says, are consistently and systematically successful.

<include src="TweetQuote" quoteText="When you understand core product value, you can pivot around it and expose it over and over again."/>

## Analyze And Act

In the end, both those who make a point of defending “growth hacking” and those who attack it are usually referring to very specific marketing trends. And from crappy email spam to malicious SEO, there are plenty of things to dislike about the idea of engineering virality.

At its core, however, growth hacking isn't complex. It's another name for the most fundamental task of any startup—achieving incredible growth with limited resources. 


Growth Hacking Is Dead, Long Live Growth Hacking

667b1c82b6cc2241ff176d50c65da603?s=200 avatar

667b1c82b6cc2241ff176d50c65da603?s=200

Guest Author

Eugene Kogan

Security is a challenge at most startups. Here's some advice on how to create a data breach response plan for the worst case scenario, a large-scale data breach.



A serious data breach can have massive negative repercussions for any organization, including the loss of customers, revenue, reputation, even intellectual property. For a startup, it can mean the end of your business. 

## Security for the Lean Startup

Unfortunately, startups are often completely unprepared to deal with a major security incident that involves a breach of sensitive data. Unlike larger, more mature organizations, startups have no choice but to be lean and spend their limited resources carefully. Startups are also worth much less than bigger companies, and all of their energy is focused on growth and proving a business model. So it’s no wonder that they tend to spend less time and money on issues like security, let alone data breach response.

On the other hand, no one wants to see their fledgling company go out of business because of a security breach. So how much time and money does it make sense for a startup to invest in preparing for a breach? I think of planning for the worst as somewhat of an insurance policy. You hope that a data breach doesn’t happen to your company. You put some effort into preventing one through reasonable security controls. But just in case something goes wrong (like if that small security incident suddenly becomes a breach of your credit card database) you want to be prepared.

Now that I’m responsible for security at Auth0, issues like this are increasingly on my mind. It’s my first time working at a startup, having spent the last 15 years working security at huge organizations like AT&T, Amazon.com, and the US Department of Defense. These folks are seriously prepared for anything, from a laptop with malware to a major natural disaster. But when you join a startup, you quickly learn how to pave the road as you’re driving it. Auth0 is a rare startup, since security has been a core part of our business from day one. But even for us, it can be hard to find enough time to plan for unlikely (yet potentially devastating) scenarios like a data breach.

## Data Breach Response Plan is sort of a Big Deal

Let’s assume your startup has enough valuable intellectual property, a growing user base, and increasing amounts of customer data. It’s likely that you’re already dealing with security incidents on a regular basis. You have a decent incident response plan that is sufficient for the common security issues that small companies face, and it’s probably not a big deal to quietly take care of these in-house.

A data breach is not a run of the mill security incident. What I’m talking about here is a major “oh crap” moment when you realize your entire user database was posted on Pastebin, along with those passwords you meant to [hash](https://crackstation.net/hashing-security.htm) with something better than SHA-1 but didn’t quite get around to doing. (It’s ok, we’re a startup, right? No! Bad startup! That’s what [Auth0](https://auth0.com) is for.)

## Planning for the Worst

So how would your company respond to such a breach? Do you know the legal requirements for notifying your customers? Should you contact law enforcement? Who do you call first and how long can you wait? Every data breach is different, so I’m not going to attempt to provide specific answers to these questions. A lot will depend on how big your business is, how many users were impacted, where they live, what kind of data was lost, and so on. 

** My goal is to help startups prepare for a data breach and to come up with a simple response plan without spending too much money. **

For a small company trying to respond to a major security incident like a data breach, the best thing to do is to ask for help. It’s just not practical or realistic to have all the necessary expertise in-house, at least not until your business can justify having a very large (and expensive) information security organization.

** I recommend having the following relationships in place _before_ you need them: **

* Cyber liability insurance
* Legal council with data breach experience
* Public relations (PR) firm with data breach experience
* Incident response (IR) and digital forensics consulting firm

Having these vendors under contract prior to an incident occurring is critical. I hope it’s obvious why you’d want cyber insurance in advance, just like you’d want car insurance before getting into an accident. But there are several good reasons for lining up the rest of your response network in advance. First is the issue of timeliness. It takes time to negotiate a contract with a new vendor, even at a startup. But when you’re responding to an incident, you don’t have any time to spare. You’re already late! Also, a lot of the best vendors will be booked up for weeks in advance, working for their current customers. If your plan is to call an IR firm and hope that they can come help you later today, you will be sorely disappointed (or shocked by how much they want to charge you).

## The Costs Involved

Speaking of cost, there are ways to help reduce the upfront expense of being prepared while simultaneously reducing the cost of an eventual response. Lawyers are expensive, and I don’t have any tips on fixing that problem just yet. So pick a good lawyer with a track record of working on major data breaches, and sign a contract to have him or her on a retainer. You should be able to do this without paying much (or anything) up front.

A public relations firm will be a major asset when it comes time to communicate with your customers. The way a company handles a data breach in the public eye can have a huge impact to how people react. You want to provide just enough details but no more, be accurate so you don’t have to issue a correction later, and take responsibility when appropriate. A PR firm with experience in dealing with data breaches will be able to help you get the right message across. That can go along way to mitigating the damage to your reputation and hopefully reducing the number of lost customers. Once you have a PR firm finalized, it may be worth paying them to draft up some boilerplate press releases for potential breach scenarios, just to save time later on.

Something to keep in mind is that even if you already have a PR firm that your startup uses for standard PR needs, they might be totally clueless when it comes to security incidents. You need to ask them the right questions to find out. If your current firm isn’t up to speed, it’s worth having a second PR firm on board just for breach response. Remember, you want to take responsibility for what happened and be honest in your communications, so don't let anyone try to talk you into denying everything or shifting blame.

## Using an Incident Reponse Firm

Do you really need an external IR firm to help you respond to a data breach? If you’re a startup, the answer is almost definitely _yes_. First of all, it’s unlikely that you have a security team with deep technical expertise in digital forensics. You need that expertise to be certain that the cause and extent of the breach has been accurately identified. And if you can’t be sure of that, then you can’t be sure the breach has been fully contained. This is especially true if the cause is an intentional intrusion by an attacker, who may be actively evading your response efforts. For a serious breach that involves law enforcement, you’ll be grateful to have security consultants with LE backgrounds helping you out.

Even with a team of experts, there is never a 100% guarantee that everything has been found and cleaned up. But you stand a much better chance of doing this correctly if you engage an experienced IR firm. Also, when it comes time to do a press release, having a well-known firm on your side will help your users feel like you’re taking the incident seriously.

When choosing an incident response firm, reputation goes a long way. The firms with better reputations attract better talent, at least on average. As always, it pays to ask around for recommendations from people you trust. The bigger firms are generally all decent, and will have several advantages over the smaller firms. First, all major firms offer a zero cost retainer option, so you can sign a contract and have them ready to go without spending any money upfront. Second, they will probably be quicker to respond than a smaller firm, simply because they have more consultants available at any given time.

Another advantage bigger firms have (not just IR, this goes for PR and legal as well) is their breadth of experience. This can be especially important if your startup has customers in foreign countries with strict privacy laws or notification requirements, or if you’re using a complex or niche technology stack. Is your product built with OpenBSD, Scala, and Spark, hosted on Oracle’s cloud? You should probably make sure the IR firm has people with experience using those technologies. Startups tend to be on the bleeding edge and most security consultants simply can’t keep up.

## You Need Insurance

Up until now I’ve mostly avoided talking about cyber insurance, partially because I hate the word “cyber.” But the reality is that every significant business should have some cyber liability coverage to help absorb the financial burden of a large-scale data breach. You will need a policy that’s tailored to your company, its projected growth, and the risks associated with your industry.

The first step to getting cyber insurance is to find a knowledgeable broker. It pains me to say this, since we techies generally don’t enjoy dealing with middlemen like brokers, but that’s really the only way to go at this point (until a startup comes along and successfully disrupts this model). Again, ask your industry peers for recommendations on a cyber insurance broker, and don’t assume your regular business insurance guy will know anything about this stuff. If you start this process with the wrong broker, you may end up with an inappropriate policy that will fail you when it comes time to file a claim.

Selecting a cyber insurance policy should actually be one of your first steps, once you have a clueful broker and a basic incident response plan in place. The reason for this is that almost all agencies will have a list of approved vendors that you’re strongly suggested to use in the event of an incident. They have pre-negotiated rates with these vendors, and they are (allegedly) vetted and deemed competent. It’s usually possible to get an exception to use a vendor that’s not on your insurance agency’s list, but that means jumping through more hoops to get them approved. If you go down this road, your broker should help you out and provide advice. So if you have a particular PR or IR firm in mind that you really want to work with, you should let your broker know before you start shopping around for a policy. I don’t recommend signing any contracts until you are sure that your cyber insurance policy will allow you to work with the vendor in question. This includes legal council and other vendor categories that I haven’t even mentioned, such as credit monitoring and notification service providers.

## The 8-Step Plan

** Here’s my recommended action plan for getting your startup in a good place, ready to respond to a large-scale data breach: **

1. Think about security, work on improving it, and have a decent incident response plan.
1. Document some potential data breach scenarios that your company might face, including the kinds of data that might be impacted, the number of users you have, where they’re located, and so on.
1. Contact a few cyber insurance brokers, ideally from trusted recommendations. Pick one who is knowledgeable and willing to work with startups.
1. Work with your broker, CFO, and security team to find a policy that meets your requirements.
1. Be aware of the agency’s approved vendor list, and ask for exceptions (if you have any in mind) before buying a policy.
1. Carefully select vendors to help you in case of a breach. That includes at least legal, PR, and IR firms.
1. Sign a contract with these vendors so that they are ready to help you respond at a moment’s notice. Go for zero cost retainers if that makes financial sense for your business.
1. Review all of the above as your startup grows and changes over the year. If your revenue explodes, you will need to increase your insurance coverage sooner rather than later.

<include src="TweetQuote" quoteText="Think about security, work on improving it, and have a decent incident response plan."/>

You can never be too prepared when it comes to security. So what are you waiting for?


Data Breach Response Plan - Your Startup Needs one

Contrary to popular belief, reducing vendor lock-in helps gaining enterprise customers



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>EDITOR’S NOTE (June 22, 2018): Today, open standards alone won’t save you from vendor lock-in. Find out why they ought to now be considered “table stakes” and what “pure breed” providers are doing to help you avoid hard lock-in in this post by Auth0 Principal Architect Vittorio Bertocci.  <a href="https://auth0.com/blog/open-standards-wont-save-you-from-vendor-lock-in">Read now</a>.</strong>
</div> 

---

It’s hard to close an enterprise software deal with a large company, but once you do, you have a customer for life . . . or so the logic goes. If a big company goes through all the trouble to run through the buying process, integrate its systems, train its people and more, it’ll be a cold day in hell before it even considers ripping your software out.

This is what’s called vendor lock-in, and it’s what makes the massive headache of selling to the enterprise worth it.

But there’s a catch—because vendor lock-in is so advantageous to the vendor, it’s one of the biggest worries on an enterprise buyer’s mind. And if you’re a startup, enterprise buyers are going to be doubly worried. Getting locked in to software from a startup that might not exist in a year is their worst nightmare.

It’s counterintuitive, but one of the ways we’ve been able to win at enterprise sales here at Auth0 is through *reducing* vendor lock-in. We build upon open standards rather than creating our own proprietary standards that force involuntary vendor lock-in. In the end, we acquire and keep our customers by making it possible for them to leave at any time.

<include src="TweetQuote" quoteText="We build upon open standards rather than creating proprietary standards that force involuntary vendor lock-in."/>

## Open Standards in an App Built for the Enterprise

Your employees’ identities are split up across all the different apps that your company uses to get stuff done. This gets hugely annoying for employees of big companies who have to login to a bunch of separate systems and remember a username and password for all of them. Plus, employee user profiles are split across these systems which creates discontinuities in the user experience and inefficiency from siloed information stores.

Auth0 is a service that helps big companies bring all of those federated identities into a single place.To make that happen, Auth0 connects with the most common identity protocols used in enterprise deployments (e.g. [SAML](https://auth0.com/docs/saml-configuration), WS-Federation, LDAP) and those used in consumer apps (e.g. OAuth, OpenId Connect), all of which are open standards.

![OAuth flow](https://images.ctfassets.net/23aumh6u8s0i/48nkRUBi0TGGNfVrRDV3JY/3d05270126f3a3676c7696959732b907/oauth-flow)

By connecting these protocols together, we can run identity through a central clearinghouse that manages authorization and authentication and centralizes user profiles in a single location. Here’s how happens in 3 steps, using [OAuth as an example](https://auth0.com/docs/protocols) per the diagram above:

1. **Authorize**: Someone using a browser requests a page that requires users to be authenticated. Your website redirects the user to the Authorization Server on Auth0.
2. **Authenticate**: Auth0 will start the authentication against the requested identity provider. The protocol between Auth0 and the identity provider could be different. It could be OAuth2 again or something else. (e.g. Office 365 uses WS-Federation, Google Apps uses OAuth2).
3. **Getting the Access Token**: Upon successful authentication, the user will eventually return to your web site with a code (steps 3 and 4 in the diagram). Your web site will then call Auth0 again using the code with a request to obtain an "Access Token.” That Access Token can be used to further interact with Auth0’s API—for instance, to retrieve a user profile for the user.

At every step, we’re connecting protocols together that are open standards and building on top of others like JSON Web Tokens. Conventional wisdom says that this would hurt us in enterprise sales, reducing our value in the eyes of big companies and making it easier for them to leave.

Here are the 3 counterintuitive ways we approach selling to the enterprise having been built on open standards. In each case, conventional wisdom would say that our approach to open standards would lower our value in the eyes of enterprise buyers and make it all too likely that we would lose customers to competitors. We’ve been able to win by turning around each weakness into our source of strength.

## Make your code easy to remove

Using open standards in Auth0 makes it easier for customers to adopt our product and hit the ground running, but it also makes it easier for a customer to rip our code out. If they’re unhappy with our product, they can drop us and go with a competitor in a heartbeat, without writing much more code to get a new solution up and running.

### Necessary to integrate into complex environments

Big customers work in incredibly diverse environments with a ton of internal and 3rd party applications that all need to talk to each other and work together. A representative customer might be a bank that has 100,000 employees, all of whom rely on a multitude of different apps to do their jobs. In addition to all the 3rd party tools that employees use, it’s not uncommon to see companies managing 10+ internal tools, each built on a different tech stack that talks to others with a different protocol.

Doing a deal in this kind of environment can be incredibly tricky. You’re only able to deliver value if you can integrate your service with every application—internal and 3rd party—that the customer is running. To make those assurances, companies often resort to building in a custom software development schedule into the enterprise deal.

The problem is that custom software development consulting adds to deal complexity, making it more expensive, increasingly difficult to understand, and harder to execute. And we all know time ruins deals.

Because at Auth0, we support open standards and integrate with everything, we need to do very little in terms of customization for enterprise deals. Customers are more confident purchasing our product because uncertainty, and extra costs like custom development are removed.

<include src="TweetQuote" quoteText="Customers are more confident purchasing our product because uncertainty, and extra costs like custom development are removed."/>


### lock in via value-added functionality

Moreover, it’s by supporting all open standards that we end up delivering core value. Customers don’t want to rip us out because by supporting open standards, we actually expand the functionality of their tools. Given the modernization of the enterprise stack and the transition to the cloud, this means that building on modern open standards means that we’re helping big companies move into the future.

Before a company installs Auth0, you can imagine that different apps create identity continuity by plugging directly into each other using different protocols. But if a company uses, say, LDAP, which was created around 1993 without the cloud in mind, they won’t have mobile functionality because LDAP doesn’t play nice with iOS and the cloud apps you use every day.

![Old world - New World](https://images.ctfassets.net/23aumh6u8s0i/1daU62dqnWyIByuKLm3yHP/93242d5a11934a10ff73f367fdf49be3/old-world-new-world)

In the old world, every enterprise app lived behind the firewall, was built on heavyweight web frameworks, and authenticated using Windows Auth or LDAP. Today, not only are enterprises relying on apps in the cloud like Salesforce, the building blocks they’re using for their own internal apps rely on [3rd party services like Amazon AWS and Firebase](https://www.firebase.com/blog/2014-06-05-auth0-guest-blog.html) that run in the cloud. And it’s via modern open standards like JSON Web Tokens that makes this happen and helps enterprises transition from the old world to the new one.

Because Auth0 works with all relevant open standards, it’s not just installed—it’s made the very central hub of all identity verification for the company. Every app plugs into it using whatever protocol is best for the app. The upshot is that two apps that might not have been able to talk to each other previously, now are able to—through Auth0. In our example, Auth0 would talk LDAP and then do protocol translation to a standard supported on mobile.

## Make yourself easily replaceable

Open standards come with the communities that maintain and grow them. Within those communities are engineers and experts who are working to potentially render your expertise and your product obsolete. Your customer isn’t dependent on your personnel and can go to someone else for advice on your own product. In some sense, you’ve outsourced key parts of your value to a community that you have no control over, and that’s lowered your value in the eyes of your buyer.

### Operate within your customer’s sphere of expertise

However, giving up tight-fisted control over your product that provides you with an incredible amount of leverage, and this is particularly true in the realm of security. It can’t be overstated: security is hard. It’s much better to work with a community of cybersecurity experts who have a vested interest in finding and killing security holes than to go at it alone. Fundamentally, it’s the community behind open standards that gives enterprise buyers the confidence that your tech is built on solid ground, and will be easily supported.

Your enterprise buyer will have internal experts on open standards as well, and that will give the buyer confidence to do the deal. They’ll know that they can maintain your app internally without having to hire an outside expert or train their existing team in a new technology. That helps reduce the most dangerous kind of uncertainty—”the unknown unknowns”—the things that you don’t know that you don’t know.

### Choosing a better developer experience

Instead of locking customers into technology that only you know how to use, do the opposite—build on open standards that whole communities of developers work on. You’ll earn customer loyalty by delivering more value on top of that, instead of locking them in.

At Auth0, we offer customers [libraries and SDKs](https://auth0.com/docs) that make it easier to work with open standards in building your app. Developers then choose to work with Auth0 because we’re delivering value on top of what open standards offer. They want to use our tech—they’re not forced to use it.

<include src="TweetQuote" quoteText="At Auth0, we offer customers libraries and SDKs that make it easier to work with open standards in building your app."/>


![How Auth0 works](https://images.ctfassets.net/23aumh6u8s0i/58SCL6EJIXHRs6GqucifqK/f2801527941fadc265859dec60e4afca/rules)

Our [Rules engine](https://auth0.com/docs/rules) makes it easy to implement user-facing functionality like multi-factor authentication and encryption. Rules are code snippets written in JavaScript that are executed in Auth0 as part of the authentication pipeline every time a user authenticates to your application. Rules allow you to easily customize and extend Auth0's capabilities.

Developers choose to work with Rules because (a) we save you the hassle of wiring up your internal code—with Rules, you can write code in the browser that’s separated from the rest of your code; (b) you don’t have to add any additional infrastructure; and (c) Rules are sandboxed so they won’t break your app if they fail. When developers write Rules, they’re putting their code into the Auth0 platform, and that creates lock-in. The difference is that they’re doing it voluntarily, and receiving value in return.

## Plan for your startup death

9 out of 10 startups fail, and that’s a fact that enterprise companies know well. To [former HubSpot exec David Cancel](http://davidcancel.com/3-startup-lessons-i-learned-the-hard-way), if you haven’t won yet, you’ve either died or you’re failing—and that has terrible implications for your enterprise customer.  If a buyer has been burned in the past by doing a deal with a startup that died or got bought and then shut down the product, you can expect that they’ll be doubly concerned about your company’s longevity.

![Startup Lifecycle](https://images.ctfassets.net/23aumh6u8s0i/1eopcl5QsywSkOJ2RG68Tb/9819037369097eb266ae50eaef61cdf6/startup-lifecycle)

But acknowledge your startup’s precarious existence, and you could potentially draw even more attention to it. Stability, above all in many cases, is what enterprise customers are buying. Admitting that you’re a startup in itself could ruins your company’s chances of getting the deal.

### The longevity of open standards

If, god forbid, your startup doesn’t work out, you’ll have done your customer a solid by building on open standards. That means that they won’t have to rewrite all of their code. They can replace your defunct product and go with a [competitor](https://auth0.com/auth0-vs) with minimal hassle.

Open standards have seen thousands of companies come and go. They were around before your company existed, and they’ll be around after. SAML—a protocol that allows you to login once and have that login you into a number of separate websites—was first created in 2001. So when you build on open standards, you get a succession plan for your startup for free.

## Go from Lock-In to Customer Loyalty

By eschewing the traditional notion of lock-in where your customers are forced to rely on you—an effect that engenders bitterness and resentment—you reduce the technological barriers to switching or leaving. While potentially having a disastrous effect on the economics of the business of enterprise software, we’ve seen it to have the opposite effect.

Those constraints force you to get creative and build real value on top of what’s been commoditized and made open and free. When you do that, customers will actively choose you, and you’ll win more deals and build real customer loyalty based in free choice.

[Unlock B2B SaaS growth with modern identity management. Download free eBook here.](https://resources.auth0.com/unlock-b2b-saas-growth-iam/)


"startups"