The privacy-first tech stack for 2021

Privacy topics and anti-BigTech™️ sentiment were already growing before the letters “G-D-P-R” had become part of everyday speech and in 2021 it is bigger than ever. Large companies and startups alike are waking up to the fact that this topic is not going away and simply adding 30 more pages of Ts & Cs *(that nobody outside of an overpaid law firm will ever read) *is simply not going to cut it.

The good news is that many SaaS companies are shifting their approach to software development to an open-source, deploy-in-your-cloud and often free-to-start mentality, making it easier than ever to focus on building fantastic products without compromising your customers’ data. Below are a few of my go to products and tools for building web products in 2021

📈 Posthog Analytics — open source product analytics

Posthog is actually what inspired me to write this post so I guess they get extra points for that

Screenshot from Posthog.com

Everyone and their Dog’s instagram profile uses something like Google Analytics to try and understand who is using their products and how. The downside of 99% of these tools is the data being tracked almost always leaves your control requiring you do write hefty extensions to your privacy agreement as well as forfeiting some of the most valuable data you have to a 3rd party.

Being in the business of building multiple user-focused Health Apps we of course know the importance of good product analytics. With one of our core tenants being “Protect the User’s Data”, we agreed across the board that Google Analytics and its like were simply not suitable - even if a lawyer could come up with the perfect privacy policy. Around this time I was fortunate enough to have **Posthog Analytics** fall on my radar as a small, funded startup who believed great analytics is possible both as a service and in your private-cloud (on-premise). We trialed them internally and after what felt like a far-too-simple process deploying to our Kubernetes clusters we realised what a game changer this could be. Today we are seeing it as a core part of our private-cloud stack taking advantage of it for Insights, Cohort AB-testing, KPI reporting and even some customer support related tasks. With their latest “plugins” functionality we are finding a lot of our data processing services may simply turn into a few lines of Javascript…

Honorable mention: GoSquared — no self-hosted option but GDPR friendly and made by an incredibly talented team of Brits with a neverending focus on product quality… also disclaimer I was one of those Brits building it, so I would say that 😉

🙋‍♂️ Keycloak — User Identity & Access Management

Identity & Access Management (User management)

“Undifferentiated heavy lifting” feels like something I say on a weekly basis. In product development, nowhere is that more true than user-management. At this point I have worked on or with more than a dozen custom written user management systems. Users are unique and important — user management software is not.

An example of the Keycloak Admin GUI

I first used Keycloak in my consulting role to support a small, agile product team within a huge organisation. Due to the team’s size we wanted to remain hyper-focused on user value generating features and not on password reset forms and boring, yet important security topics. SaaS services such as Auth0 were not an option as we had strict data concerns operating in the financial space. As we were in a Kubernetes environment, we started with an off-the-shelf Keycloak deployment and overtime barely needed to modify it as we scaled it up. Keycloak offers so many different configurations it can almost be a bit overwhelming but it can take almost any identity or access related task you can throw at it.

We don’t just use Keycloak for our customer’s user management, we also use it for securing internal tools for our team member’s eyes only, federating it with Microsoft AD. What would previously have been an insecure basic auth with a shared username and password is now a centralised single-sign-on solution with roles and rights for roughly the same amount of effort.

🧑‍💻 ForestAdmin — Admin Panels as a Service

Don’t build your own admin portal ever again

I sometimes lay awake wondering which is the bigger waste of dev resources: user management software or *Admin Panels shakes fist ✊.*

Some screenshots from the ForestAdmin site

Inevitably any organisation, big or small will eventually hit a point where someone from Product, Sales or Operations need to actually step in and do something with your user or product data. “I need to reset a user password”, “*this user is my buddy — lets upgrade them for free” *or even the dreaded *“A user has requested their GDPR right to download all of their data 😨”. *Generally speaking these tasks require a developer with the right access to perform and can end up in a personal-data nightmare with potentially sensitive data being shared via Slack, emails or wherever else simply because there is no better way to get the access people need to get stuff done. Most great engineers are lazy engineers and instead of constantly performing these annoying, flow breaking tasks, they instead opt to build an Admin website that will solve this problem once and for all! What we seem to always underestimate is the coming avalanche of bugs, user management issues, feature creep, security weaknesses… I think you get my point.

ForestAdmin is a nifty solution to this problem providing a well-designed, opinionated and customisable portal for building admin panels without touching any code (at least on the frontend). The core of the application is providing tables that are backed by various data sources within your organisation (SQL databases, MongoDB, Stripe, REST APIs) and then allowing you to build different built-in or custom actions for team members to perform on top of them. Couple this with the ability to create different teams and specify their level of access to different elements of the dashboard and you have a simplistic but effective way of building useful portals for your teams. In only a few hours I was able to build a dashboard for managing our onboarding deliveries which provided more functionality than the internal dashboard that took multiple weeks for a team to build.

The best part of the Paris-based ForestAdmin is that GDPR compliance is trivial as you host a small Node.js API within your infrastructure and all calls to it are performed directly from the employee’s browser, never going via their servers. There is a generous free tier that will suffice for many <5 person teams and the pricing from then on is incredibly reasonable at around 25$/user/month, especially when you realistically consider the cost of building and maintaining your own internal admin tools.

Honorable mention: Retool — more flexible drag-and-drop builder tool out of the USA. Seems very promising but with their self-hosted version only available on their pricey enterprise plan, it may be a non-starter for small-mid sized organisations

☁️ Kubernetes — the private-cloud enabler

Not much here to say that everyone in the world hasn’t already said

A poignant statement that always sticks in mind is that of Marc Andreesen of a16z *“software is eating the world”. *Sometimes it feels like *Kubernetes is eating the cloud *with it becoming a go-to for many small and large tech companies alike. The upfront effort of Kubernetes can be high but the abilities to easily deploy any containerised software quickly outweighs its complexity.

Container orchestration itself isn’t very “screenshot-able” so here is the brilliant open source GUI for it — Lens

Interestingly, Kubernetes can be quite a polarising topic. Many people find it far too big a hammer and complain about the increased mental and operational overhead. Whilst these concerns are definitely warranted, and approaching a Kubernetes based solution is not a decision that should be made lightly, the flexibility of a generalised cloud platform coupled with the industry trend of Kubernetes-first approaches can be a real differentiator for building and scaling products at pace.

Kubernetes can be deployed by yourself (note — I don’t recommend it) or provisioned through an ever expanding number of services providers — AWS, Azure, GCP, Digitalocean and even some smaller providers here in germany like my favourite — gridscale.io

Sidenote: Neat little trick with Kubernetes is to use the “port-forwarding” functionality in combination with nginx pods to give people auditable access to internal databases etc. without resorting to hacky ssh tunneling solutions. Maybe there is a blogpost for that at some point…

🔒 LetsEncrypt — HTTPS Everywhere

Not even sure how I did SSL certificates before this…

If you’re a true security expert I am sure you can give me a 1000 reasons why LetsEncrypt is not the best solution for adding SSL security *(i.e. HTTPS (i.e. the thing that gives you the little 🔒 symbol when people visit your website)). *The reality however is that before LetsEncrypt almost every website I visited was served over plain HTTP meaning any and all traffic from my browser to benjackwhite.co.uk was completely unencrypted. As this entire article is trying to prove — that simply isn’t acceptable in 2021. It isn’t just technically minded, tin-hat wearing paranoids ditching non-HTTPS websites: most browsers will display all manner of scary sounding banners to users as soon as they notice the missing “S”.

— how lets encrypt (or other providers) can be used to automatically generate certificates_

The power of LetsEncrypt is really in its simplicity. For most use cases it provides a solid layer of security on top of your standard applications with many hosting providers managing the provisioning and renewal of certificates on your behalf. If you are lucky enough to be working with Kubernetes then the community has even provided solutions for completely automated provisioning using cert-manager.

🛠 Hashicorp — Terraform, Vault, Consul…

Not even sure how they make money as they give so much amazing value away for free…

Hashicorp and their hugely popular products (Terraform, Vault, Consul etc.) are a bit of a deviation from this list as they are less about hosting your user data and more about tooling for deploying your apps and services. Nonetheless I mention them here as the tools are vital to our infrastructure teams day-to-day operations ensuring network communications, deployments and secrets (database passwords, encryption keys etc.) are tightly controlled without losing any of the speed and flexibility needed in modern web development.

Deploying and automating the various tools and security features that companies of all sizes are starting to require would not be possible for us without the Hashicorp stack.

🥳 Phew! You made it to the end!

Pretty sure that can’t be said about most privacy policies that I have agreed to…

The tools and services here have helped me and my teams to build great, secure products taking advantage of off-the-shelf services to ensure every minute of development is spent on customer-value focused engineering. For companies working in the HealthTech or FinTech space this approach is vital but I would argue that we are not far from this being the expectation across the board.

That isn’t to say that there is nothing else you need to consider. Building a user privacy focused tech stack is a constant and evolving challenge. What tools are you using to rise to the challenge? What other gems are out there in the SaaS and OSS community that I haven’t come across yet?