We would be happy to try except when it has write/merge permissions .
One click and auto merge are nice to have. Having the bot (and your company) able to deploy any code changes to production (by accident, via hack, etc) is a no go.
Suggest making them optional features and just having code comments/repo read version.
Not sure if it’s possible - but if the permissions could exclude specific branches that would be ok as well.
But needs to be no way a malicious actor could write/merge to main.
I am co-founder of a 5 year old tech startup with 50 staff that introduced a 4dww / 32hr work week a little over 2 years ago.
Since are a lot of questions surrounding 4dww - Thought I might be able to offer some insights.
1. “four days but actually working longer” or “four days with reduced hours”.
-- We offer 32hrs work week, rather than the standard 40hrs in our home country. This is generally taken as 4 days, but some work 5 days with less ours (especially those with school aged children).
2. "What employers want to know is not what happens in poorly managed offices, but what happens in well managed offices where employee workload was already optimised."
-- I am going to be biased but we spent 3 year with standard work week, and I think we were highly productive as an organisation, our internal metrics, output and surveys agreed with this assessment. After 2 years, we haven't seen any noticeable / measurable decrease in output or performance compared to 5dww, or since we started.
3. "Do these companies close on a week day, like they just don’t open on a Monday."
-- We generally allow people to choose any day off they want, put have them put it in ~4 weeks before hand. Most people take either Monday or Friday, which means we always have some staff covering the days others have off. In smaller teams that speak with customers (sales/cs) they agree among the team who takes what days, and can trade, as long as we always have coverage.
4. "4 days week sounds great, if you hate your job and you already earn less than you deserve."
-- We pay top percentile as other startup/tech companies in our country's HQ. Anyone joining us shouldn't feel they are being paid any less than someone on 5dww -- and that is because we expect their output to match those of others working 5dww.
Overall we've found the move to be extremely successful at attracting and retaining talent with I believe helps us be significantly more productive than other startups I know doing 5dww.
We have a few things that I think help with our 4dww, include remote async with very flexible hours, hiring worldwide, transparent salaries and virtually no meetings in engineering.
One thing this flexibility allows us to do is ask our staff to be 'switched on' when they are working -- if for any reason they aren't being productive, we encourage them stop working, do something else, and come back later. We expect our staff aren't reading reddit, posting on hacker news, etc during work-time -- in return for the 32hrs we want to see it (almost) all productive.
I believe this, along with staff dropped the least important work gives us a similar/same output as 40hrs. With the benefit that we've been able to attract talent that otherwise may have gone elsewhere, with a turnover of virtually 0%.
Happy to answer any specifics about how we've implemented thing, or what I've seen as a co-founder leading a small (16 people) engineering team.
Retaining those 2-10x engineers because they can’t even imagine leaving your company gives you far higher productivity gains than 1 extra work day a week.
It's worked well with pretty role. However, for our Customer Success / Support team hours = hours out is more true than other roles. So for these roles its more about being able to attract people who are really good at their roles.
We don't track hours at all -- staff are expected to track their own hours and keep them to 32hrs. Occasionally something happens and people work longer hours in a week, however we then give them time off the following week.
We are a SaaS startup headquartered in New Zealand, with 16 engineers across NZ, Asia and Europe. We are now looking to build out our US-timezone team. We’re look for intermediate to staff engineers who care deeply about product. We are running full-stack typescript with React on the frontend, a well tested and comprehensive CI/CD pipeline and follow a modified version of shape up.
We offer an async remote culture, with a 4 day work week (at full pay), 20 days annual leave, 20 days personal leave, a funded home office and work-from-home stipend.
Runn builds a project and resource management platform with a focus on the human aspect of delivering great projects. We have customers across 70 countries, managing 40,000 staff, from small start-ups to fortune 100 companies.
Looks like there is only a Director of Sales position on your careers page. Was the position filled? It sounds INCREDIBLE and like a perfect fit for me.
180 minute pair programming call as well as a 60 minute tech screen? Even MAANG companies only do 2 technical rounds of "pair" programming. Why so much?
I'd like to point an inconsistency: here, the job title is "Product Engineers"; the HTML title of the referred page mentions "Software Engineering Roles"; and in the page itself it's actually written "Software Developers".
Extremely minor typo I noticed on the page you linked:
"1 internal steam"
Cheers, looks like a nice place to work. I really hope the 4-day/32hr work week starts taking off here. Whenever I start looking to change jobs, it will be the most important perk to me by far.
The 4dww has worked really well for us, we haven't found the same or increased productivity by moving to the 4dww. While also being able to attract and retain talent better.
Please don’t put basic features behind enterprise licences.
We are a small start up. We use SAML / SSO. We care about security. We care about privacy.
None of this is “enterprise”.
We stopped using competitors to you because of data privacy issues.
We would happily pay for a self host version, where we control all the data recorded.
These type of tools are extremely useful, and it hurts not having it. But they are just way too much of a privacy issue.
Self hosted and paid - is the future of data privacy.
I would love to see you (and others) off these options, it’s really a game changer and makes the switch easy from any product that is not self hosted and collects our customers data.
What do you think of uxwizz.com ? The only option is self-hosted, because focusing on the hosted version would mean competing directly against the self-hosted one, so making self-hosting harder would drive more revenue, which seems wrong.
That's great feedback; understood. What features would you consider "enterprise" in that case? Right now, nothing is paywalled in our self-hosted version, and we're still very much in the brainstorming phase here.
how companies should make money, if AWS can package it any day and sell as a service?
regarding self hosting, how can contributors make sure that you are self-hosting and paying? If code is open and already in your infra there is no way to enforce anything.
> regarding self hosting, how can contributors make sure that you are self-hosting and paying? If code is open and already in your infra there is no way to enforce anything.
The way we're thinking of addressing this is not including the enterprise features in the output binary when you install highlight.io. This makes it a bit harder to actually build the project with all the enterprise features. It it something that folks can take advantage of, though.
Runn.io | Software Engineers | 4-day work week | Remote World Wide | 70-127k USD | Transparent Global Salaries | Full stack JS
Runn builds project and resource management software for progressive businesses. Businesses that believe that driving staff engagement, interest, passion and work-life balance is the greatest contributor to delivering great projects and products.
Our software improves the work-life balance of over 18,000 people and we are on target to help 100,000 by the end of 2023.
We are a fully remote async startup with 21 people spread across 6 countries & 3 continents. We offer transparent global pay, and a 4-day work week.
This role is now closed -- we've be inundated with high quality applications! Thanks for your interest :)
I wish more tech founders would do the right thing - rather than trying to hide reality will only ends up unfairly hurting under represented groups and those who aren’t strong negotiators.
I feel I must ask where you live / what competitive salaries look like to you, because as far as I know, a software developer salary of $190,000 USD+ in Barcelona, Spain is eye-poppingly high
I think he's talking about runn where the compensation honestly looks terrible: $43k as a junior and under $80k as a senior. I wonder if the goal of transparency there isn't to avoid wasting time with the majority of people who won't put up with a salary that low.
I am sure it’s low in the Silicon Valley. Here in NZ - we are the highest paid tech juniors I know off. Most offer around 60k NZD.
Need to remove your US bias. However - the whole point of transparent is that everyone knows.
If the salary is low for you, you will never apply. But you know exactly what you’ll be paid, and know it’s the same as everyone else doing the same role/level.
That is the benefit to being transparent - it doesn’t have to be the highest paid, it’s simply fair. equal and transparent.
What are you even talking about? The median yearly take home pay (sorry, don't know the right word for it) in my middle-of-the-pack EU country is around $16k.
Let me say that again, this country is in 35th place out of 193 by GDP per capita and this is how much people make here.
Yeah, my bad. My comment is very US-centric. At the same time, cost of living is likely much higher in the US, so that also makes a difference in the comparison.
Is that double the median income of juniors in similar tech positions or the general median that contains part-time workers and jobs that require no education at all?
In the US at Big tech cos(FANG style), that would be the base salary for someone with 7-10 years experience. And then you add on generous compensation packages(stock grants, 20ish% bonus target, signing bonus).
I would say it is eyepopping for US techies who haven't made it into the "big leagues", but there are probably a million software devs in the US making that.
in norcal or new york, $190k is pretty standard for a senior role, with equity compensation on top. I get $185k with 7 years of professional engineering experience + rsus worth about $150k over 4 years, and really I could get more if I left for a bigger company, which I don't want to work at. Europe has lower salaries in general, but also a lower total cost of living and better gov't services.
6 figure salary for an executive assistant in Tennesse is quite nice. A lot of engineers I know dont make that much and the skillset gap required between both professions is quite large IMO.
Skillset gap is not what determines price. Supply and demand ratios do, which does not necessarily correlate with skillset gap.
For example, I might be able to be an executive assistant, but I imagine the quality of life of an executive assistant is worse than what I do now, so I would want even more money to be an executive assistant.
Salary transparency, like all levelling mechanisms, pushes salaries down. Your highest salaried team members are simply replaced by contractors as they realise that their remuneration is now tied to the impression it gives to their colleagues rather than the value of their own labor.
It seems to me, in my uninformed layman opinion, that it would do the opposite. Maybe it would force the outliers down but perhaps bring the average up.
These are two common scenarios I see:
- Two employees at the same level on the same team. One is paid $X higher than the other. Employee one asks for raise based on the fact they do the same job as employee two
- New hire is paid $X more than member of team who has been there receiving meager raises yearly. They can point to the new hire and request $Y more due to their experience
That said, this is conjecture and not backed by anything. Are there published works on salary transparency = lower pay for employees?
There is a 3rd scenario that I've occasionally seen: Two employees with the same title on the same team. Employee One is unhappy because they are paid 10% less than Employee Two, despite same experience and title. Employee Two ALSO unhappy because in practice they do 50% more work than Employee One for 10% more pay.
I still don't see the parent's connection of transparency to lower pay, but there is a rich scientific literature on the concept of "Comparison is the thief of joy" -- I hypothesize that turnover rates might positively correlate with transparency because they could promote intra-team competitive feelings.
The exception would be if there were a rigid structure that you know going in, similar to how e.g. government pay scales work. Since you know going in that the only input is seniority, you won't care that exceptional work is not rewarded because that was made clear from the get-go, and if that would have bothered you you wouldn't have accepted the offer in the first place.
The natural counterargument to that is that if the only input to compensation is seniority, then there is reduced incentivization for performing "above and beyond", possibly cultivating a culture of mediocrity.
It also would promote pay equity, however, since e.g. employees' implicit biases and social conditioning would not come into play under subjective evaluations.
While I support pay transparency on principle, I have never seen it work. In practise, no two employees are ever equal. Even those with the same years of experience, the same qualifications, and the same roles. One might be happy to work late. The other might be happy to pick up the phone on weekends. One might prefer working alone. The other might play better with colleagues. One might offer to take on more projects. The other might not, but they have better attention to detail. The differences go on ad infinitum. There is no "objective" way to determine the market value of each of these two employees. The best we can do is let each business make subjective judgments of each employee. We know this is far from perfect, but it could be more fair than paying two very different people the same wages just because they studied the same thing at university and worked in the industry for the same length of time. One of them will be contributing more to the business bottom line - sometimes significantly so - and they probably know it. They'll leave if they're paid the same as their lesser-performing colleague.
You can observe it by counting the contractors in any company that has salary bands, or transparency, or any other similar system. Very few high performing employees are prepared to accept that their remuneration is being constrained to prevent the lower performing employees from getting jealous. They are strongly incentivised to either leave or become contractors, increasing their remuneration even more. Only the average performing and under performing employees readily accept such an arrangement, because they are either unaffected by it, or benefit from it. You don’t need to do a study to figure out that people avoid things that are detrimental to their own interests.
This is only true if people are underpaid in their salary bands -- which certainly can happen.
However, it doesn't have to. We are still small with our experiment, but we pay 95% percentile in our market, plus provide additional benefits well above the norm.
We have no issues hiring and retaining high performing staff because we pay as much or more than they would get elsewhere in the local market.
We don't even need to speculate about it. In for example Sweden, everyone's tax return is public information. You just call the tax office and ask how much income someone declared last available year.
Do you have empirical evidence of this? I struggle to understand how salaries being in a black box helps your chances getting paid more as an employee.
It will be really difficult for all individuals to share their salaries if some of them are on low salaries and fear not being able to scale up if they publish those.
There's also an intrinsic bias in sharing salaries in that the well-paid folks are more likely to share theirs because they feel validated by the value itself.
We are also on this side and on the job boards we run [1], the companies are required to publish real salary data™ (and we also gather stats based on that).
What is real salary data™ - contrary to the flawed regulations in a few states, which basically allows putting something like 1$ - 100'000$, we require companies to be more specific and have a max range of 30-40k.
Interestingly, the majority (approx. 2/3) of companies are completely fine with publishing this information (if they are forced to) and out of the remaining 1/3, half can be convinced, and the other half is a lost cause (basically, management will not allow it)
With recent laws in California, NYC, soon nys, and the existing one in Colorado, only Washington needs to pass one for all the priciest tech hubs to have mandated transparency in job postings and internally. It's really promising.
Do you and buffer pay the same regardless of location? Honestly that always seemed more fair to me than "cost of living" adjustments which often fail to capture a lot of the nuances of actual differences in costs of living.
To answer your question as posed: to fix the power/information imbalance that is used to pay people less than they are worth.
To answer your question the way I wish to: thanks to Equifax's TWN, candidate resumes, reference checks, background checks etc - the candidate is already showing all their cards.
> the power/information imbalance that is used to pay people less than they are worth
Candidates often pad their resumes with skills they don't have. They'll pad their salary history. They'll hide things like stretches in jail. They'll list degrees they don't have. All to get a higher salary. The employer often doesn't realize for months that the employee wasn't as represented, and way overpaid.
It goes both ways.
I know you likely don't believe me, but I've been employer and employee, at min wage and professional wages. If you ever become an employer, you'll find out real fast how little power you have over employees. Anecdotally, I know employees with million dollar salaries. Is it credible that if corporations really had all this power, they'd be paid that much?
> The employer often doesn't realize for months that the employee wasn't as represented, and way overpaid.
that employee's coworkers and team members surely would realize how well the pay matches though. or at least, they could, wherever the employer makes that info public.
my own experience with internally-public compensation at a 70-engineer company: is that there's so much _error_ in setting salaries. i don't think my employer really cared if the salary they pay for equivalent work varies randomly by 20%: to them that's just the cost of doing business and they have enough margin to cover that. but when i see that my teammate, who's putting in literally 20-hr weeks and producing half the output as the rest of the team, is being paid 20% more than me? that's reason to feel that my employer isn't treating me fairly and to leave. that hurts my employer more than the 20% extra they're paying the other guy.
i felt like there was a catch-22 here: in theory erroneous salaries could be more quickly corrected if they were internally public. but it's risky to make salaries public before the employer is reasonably confident that they're accurate.
i made my case. i pushed for negotiations. i presented the ultimatum as tactfully as i could manage. and i exercised that ultimatum.
i believe the company truly just did not have the resources to expend on getting everyone's salary as accurate as would take to make me happy. it was a flat organization, in such a way that only a handful of people were responsible -- on top of their other duties -- for the determination of salaries for those 70 engineers. i think they are on track to fixing this broadly, but just not in time for me.
I've always hated the simplistic "Just negotiate, bro!" advice. I wish it came with more concrete tactics to use that work. I've never in my 20+ year career asked for more money from an employer and got it--no matter how many documents and facts I came in with.
Here's how it goes with existing companies:
[Me] Hi, I'd like a raise.
[Co] Nope.
[Me] OK, here are examples of the value I'm providing and how it's increased over time.
[Co] Your current salary accounts for this.
[Me] Other companies offer 20% more and I'm only asking for 10%.
[Co] ...
[Me] OK, I have an offer from the other company. Last chance.
[Co] Well... Bye?
Here's how it goes as a new hire:
[Co] Here is your offer letter with your salary, bonus, and equity. (it's 0.2% more than my current TC)
[Me] <gulp> I think the market rate should be much higher, based on my experience and skills.
[Co] We don't agree.
[Me] Can you be flexible with the equity?
[Co] No.
[Me] Can you offer a signing bonus?
[Co] No.
[Me] Can you be flexible with the base pay?
[Co] LOL No.
[Me] What about hours, time off flexibility, and so on...
[Co] Look, do you want the job or not? There's a line forming behind you, my dude.
I hate that a skill (negotiation) that is unrelated to my actual job has to be one of the primary drivers of my compensation.
Negotiation skills apply about everywhere in life. Not learning them can get very expensive.
> I have an offer from the other company
So take it!
> Can you be flexible with the base pay?
A better way is to make a counter-offer. May I recommend the book "Never Split The Difference" which has a lot of good information about negotiating. Remember your most important power is being able to walk away.
I sometimes ask people who claim a lot of C experience "could you give me an approximate value for 2^30?", which is vastly more difficult than 20% of $20K for an accountant.
I find it interesting the different approaches that people take. They've ranged from "I know 2^32 is a little over 4B, so 2^30 is a little over 1B", "I know max signed 32-bit int is a little over 2B, so...", "2^10 is a little over 1K, so 2^30 is a little over 1B", to "that's literally impossible and there's no way I could give you so much as an indication as to whether it's positive or negative, even or odd; I'm not even sure it's an integer..."
Doing that sort of mental arithmetic in a high pressure situation has very little to do with an accounting degree. Yes, it should be easy but I imagine I could make a lot of people flail at questions that they could answer easily sitting around a coffee table.
Yes. Give someone an hour, of course. I'd expect any minimally educated white collar professional to be able to that without a calculator.
As a verbal problem to answer in ten seconds? I'm more sympathetic with people freezing even if I certainly expect I'd be able to do it absent extreme pressure.
If someone regards an interview question as extreme pressure, I don't know what to say. Except advise the person to do more job interviews until they get used to it.
There's the elevated risk of re-offending, or being less trustworthy. For example, if they did a stretch for embezzling, they'd be placed in a position where trust is less of an issue, which would likely pay less. I wouldn't want to hire someone to operate heavy machinery if he did a stretch for drunk driving. Would you?
> I wouldn't want to hire someone to operate heavy machinery if he did a stretch for drunk driving. Would you?
Funny enough, that comes back on a background check...if it was within 7-10yrs depending on source, if you want to pay for it, iirc. JP Morgan will go back as far as they can to seek out any sort of theft or fraud charge for ANY position. Ostensibly this is about transparency for developers, so alcoholics are pretty common in corporate jobs the higher up you go in salary.
If you invent a 4-year stint at respected company XYZ to cover your resume gap, the company might pay you based on the value that faked experience brought.
It’s not that I’ll pay less because you were in jail a while, but rather that being in jail likely makes you less competitive skills and
experience wise compared to someone who worked straight through.
> Candidates often pad their resumes with skills they don't have. They'll pad their salary history. They'll hide things like stretches in jail. They'll list degrees they don't have. All to get a higher salary. The employer often doesn't realize for months that the employee wasn't as represented, and way overpaid. It goes both ways.
I'll explain why I disagree with you and downvoted you (since you are making an argument in bad faith).
1. Padding a resume is sometimes necessary to bypass automated systems. If the choice is between slight embellishment and never getting an offer, then I believe it is morally justifiable to pad the resume just enough to conform to requirements. It's really an open secret - recruiters will openly tell you to do this.
Also, to go further on this, job requirements are very often written by less technical people (HR) who will make mistakes in the number of required years in tech, or have ridiculous requirements that would limit the candidate pool to maybe...10 people on this entire planet.
2. Padding the salary history is almost impossible and easily verifiable through pay stubs. I very much doubt this happens often enough at desirable jobs, especially where people's reputation is on the line.
3. They'll hide things like stretches in jail - Again, almost impossible to hide, considering court records are public record. Even you or I could check this and not proceed with offering them a job. If the company doesn't do this diligence - that's on them, they certainly have the resources to do so.
> The employer often doesn't realize for months that the employee wasn't as represented, and way overpaid.
What about cases where the employee ends up being better than expected and brings way more value to the company than the originally agreed upon offer? How quickly is that reconciled? It goes both ways, after all.
> It goes both ways.
While it does go both ways, it's like saying a pedestrian is also causing damage to the car during a collision. The amount of resources a company/corp has is insurmountably higher than any individual could hope to achieve (barring billionaires). This is why we have multitude of protections for employees (that corporations are continuously trying to circumvent)
> Anecdotally, I know employees with million dollar salaries. Is it credible that if corporations really had all this power, they'd be paid that much?
The mere fact that they are able to pay a million dollar salary to a single employee signifies one of the following:
1. The employee is indeed a genius who brings this amount of money in or more, or contributes to the company growth in a way to justify this.
2. The company enjoys something like monopoly presence on the market and can afford to overpay for truly mediocre employees. If this is the case, then it's hard to feel sorry for the company.
You can disagree with me, but there's nothing "in bad faith" about what I wrote.
> Padding a resume is sometimes necessary to bypass automated systems
You're justifying lying. Not a good start for a relationship with your employer. Would you hire someone you knew was lying on their application?
> recruiters will openly tell you to do this
If they do, you know you're dealing with dishonest recruiters. Is that who you want to do business with?
> who will make mistakes
Just go to another company where you do qualify.
> Padding the salary history is almost impossible
Back before the internet, other people endlessly bragged to me how they got a better offer by padding their salary. When I interviewed for jobs, I'd bring a paystub to show the interviewer that my salary history was honest. They appreciated that. They were aware that such padding was routine.
> If the company doesn't do this diligence
A lot don't do that, especially smaller outfits.
> What about cases where the employee ends up being better than expected and brings way more value to the company than the originally agreed upon offer?
Simple. Document the value you brought to the company, go to the manager and start negotiating. If he won't budge, quit, and interview at the next company, being sure to present your evidence of the value you bring. P.S. if you really did bring the value, the company will be happy to raise your pay in order to keep you.
> The amount of resources a company/corp has
The only power a corp has over you is if you give it to them by being afraid to negotiate and afraid to walk away. They're not going to hire thugs to beat you and shoot your dog.
BTW, just for fun, I've been watching "Power", a miniseries about drug kingpins. I have to laugh at how they negotiate. It's always "do this for me or I'll kill you". Way to inspire loyalty! Or at least the silly Hollywood fantasy way.
> I'd bring a paystub to show the interviewer that my salary history was honest. They appreciated that. They were aware that such padding was routine.
While I agree with everything else you said, this strikes me as a poor strategy unless you have some highly assured leverage with which to negotiate your salary (e.g. you have lots of competing job offers, or you know that you're uniquely qualified for a job with few applicants).
Yes, but it is less than half of the states(though I'm not sure what percent of the population are covered), and even then, many of the bans are phrased such that pay history questions are only banned before an offer is made, or it is voluntary but employees may not know their rights.
It is still legal to rescind or modify an offer after you discover salary history in most states with a "pay history" ban in place.
I think you're right there - the transparency needed is from the companies, not the individuals. Otherwise it becomes a competition, and people stop sharing salary themselves because some doofus claims to be on 750k/year starting salary straight out of college.
Levels.fyi has some salary data too I think, and there's more and more being shared in Indeed and LinkedIn.
Indeed, I spotted a couple of typos too: "This book is free/libé", "to provide detaile information".
Also noticed that foreground colors are defined in the HTML version, while the background color isn't, and the blockquote foreground color doesn't meet the AAA level of WCAG contrast guidelines even if white background is assumed. That's rather nitpicky, and generally it's fine, but it feels like materials on UI and UX should better follow common guidelines.
Same boat as many others. We spend $5000 a month on Heroku. We run production apps and then over 150 review apps at once.
We are using paid dynos but free tier redis and Postgres. With literally a couple entires in redis and a few hundred rows in Postgres.
This is going to massively increase the bills for review apps - with 0 positives and no alternatives.
The hacks, the downtimes, the communication, the support, lack of security features, no innovation.
What exactly is heroku offering these days other than - it will cost you money to move? I can’t imagine any serious business moving to Heroku these days.
If you are dealing with a lot of "empty databases" you can basically make something like a "core app" — attach cheapest paid redis and postgres to it, then copy the credentials between apps.
I have done this before — had one "X-core" app and "x-whitelabel-1", "x-whitelabel-2", and so on, connected to the same database while each app used different database name.
I’d be really interested to know how your research goes. We are running a large production scale app on heroku. And that we have no DevOps or Infra staff is awesome. But heroku has been a huge let down lately.
Most of the reviews we have seen of the competitors are all hobby level. And last time we check some of this competitors we found their security posture was not the level we would require.
So we had to simple rule them out and either stay with Heroku or move to a big 3.
If you’re keen to share - let me know and I’ll send you my details.
Craig here from Crunchy Data. I think you're speaking to the app side of things on hobby level. On the database side of things our security posture for Crunchy Bridge I'd say is stronger than the Heroku one. By default we isolate all databases in a VPC, everything is purely single tenant where as Heroku Postgres at least when I was there had multiple forms of multi-tenancy which when doing multi-tenancy in Postgres can have risks[1]-this applies even to the major 3 cloud providers. Our team is essentially the original Heroku Postgres team so we've built with security but also user experience for Postgres in mind since day one.
Now I assume you were speaking to the 3 mentioned, render, railway, fly in terms of hobby level. All three are fairly young relative to Heroku's age, but Fly did recently get their SOC2 and the team really took it to heart and invested in it so I'd put some stock in that. I can't speak definitively to the others, but do know all three can be solid for production apps. If you've got HIPAA or other specific requirements I'd encourage a conversation with them.
Thanks Craig. I took at look at Crunchydata - however best I can tell unless we are in Enterprise Tier Heroku (or maybe not even then) we have to connect to Crunchydata via internet (with IP whitelist?) rather than through VPC peering or similar. Which is a limitation of Heroku rather than you. I assume with something like fly it could be done via VPC peering?
I just read fly had SOC2 type I recently. But I mean this hosting infra containing all our data and our customers data. People providing infra really need to take security extremely seriously and prove it.
Awesome what they are doing - just don’t feel like they are ready for primetime busines. We are a small startup (5k monthly on Heroku) but there is just no reasonable way we can tell our enterprise customers security teams are hosted on these guys and can vouch and vet their security.
We would be happy to try except when it has write/merge permissions .
One click and auto merge are nice to have. Having the bot (and your company) able to deploy any code changes to production (by accident, via hack, etc) is a no go.
Suggest making them optional features and just having code comments/repo read version.
Not sure if it’s possible - but if the permissions could exclude specific branches that would be ok as well.
But needs to be no way a malicious actor could write/merge to main.