The facts about ADP and Zenefits: Response to the claims made by Zenefits [pdf]

http://www.adp.com/zenefits/downloads/The-Facts-About-ADP-and-Zenefits.pdf

by cgoodmac • 11 years ago

175 76 11 years ago

Disclosure: I work at a competitor to both - posting this because I find it generally interesting from a data security and integrations perspective.

thrillgore• 11 years ago

This PDF has a better interface and user experience than anything else i've ever used with ADP on it.

knodi123• 11 years ago

seriously, you're not kidding. If ADP wants to convince me they've got programmers I can trust, a good place to start would be by hiring a UI designer above the age of 20 who can answer the question "what is a best practice".

chrisco2552• 11 years ago

If Zenefits prioritized payroll domain expertise and enterprise-level programming over UI design, they wouldn't have to feed off ADP.

tptacek2• 11 years ago

Regardless of the qualifications of the average ADP programmer, they spend what we in the business would refer to as "a cubic fuck-ton" on application security. I have no idea if they get it perfectly right, but when ADP makes an argument premised on security, I take it seriously.

MCRed• 11 years ago

This is not the first time a YC company has "hacked" their way into success-- for example AirBnBs spamming of Craigslist users and violating Craigslists ToS in other ways. In fact, these kinds of things come up so often I wonder if it's not encouraged.

It's kinda balsy, though, to get client's admin ids, and then use that to go after their data.... and then when this is cut off, to complain about it.

Especially given the entitled and, if ADP is being honest, dishonest way they portrayed the events.

radnam2• 11 years ago

How else would you suggest a 2 person startup compete with likes of ADP? This is client's data not ADP's data.

chrisco2552• 11 years ago

With the whole SnapChat snafu where 3rd party clients were leaking photos, or getting hacked, it's pretty clear that ADP has a legal mandate to protect their customer's data.

kenko• 11 years ago

That's absurd. If you can't do it right (meaning responsibly, ethically, legally, not in a better-is-better sense), I would suggest not doing it. Maybe some things are beyond a 2 person startup, without cheating. That's an ok outcome, if you haven't drunk the "all existing entities must be overcome by hook or by crook, and lo, the ends shall justify the means" SV koolaid.

myblake• 11 years ago

Zenefits is not a 2 person startup, they're worth billions of dollars, have hundreds of millions in the bank and have several hundred employees. It's probably better to think of them as a privately owned growth company than a start up at this point. (Edit: here's a source http://techcrunch.com/2015/05/06/zenefits-rising-hrs-hottest...)

markbnj• 11 years ago

It's an interesting shot back at Zenefits from ADP. I have no way to judge ADP's claims with regard to security and the volume of requests. It would not surprise me if they were true... or not. But I suspect the fourth row in the table is the one that really matters.

cgoodmac3• 11 years ago

OP disclosure: I work at a competitor to both - posting this because I find it generally interesting from a data security and integrations perspective.

pkaye• 11 years ago

What do you think of the ADP claims?

cgoodmac3• 11 years ago

If ADP's claims have any truth (and I can't say if they do), it's shocking and very bad.

Data security (SSNs, banking info) is difficult, but they're table stakes in the payroll and benefits space (ex., how do you securely share personal information across different benefits providers).

Honestly, my main takeaway is I'm happy our company built everything (payroll and benefits) in-house from scratch.

We worry less about integrations issues, and it helps with security when you have more control over everything.

It's been extremely difficult building everything from the ground up, and I've definitely questioned our approach (more than once I said, "Why don't we just integrate with X?"), but I think this validates the path we've taken.

This is a lesson I'm going to take away for whatever other software/service I may end up working on.

wnevets2• 11 years ago

Hats off to ADP for responding.

dikaiosune• 11 years ago

Enterprise integrations are expensive and can take a long time to get to market. So I can see why Zenefits would have avoided doing so for as long as possible.

Perhaps Zenefits, having using their hack-around for a while, needs to look at a proper integration? Call ADP's bluff? If ADP is telling the truth that they've never had conversations about service integrations with Zenefits before, it seems like that may be a good place to start.

eitally3• 11 years ago

As someone who's team has been responsible for an enterprise integration with ADP on more than one occasion, it's really not that hard. It's well documented on their side, setting up data feeds is trivial if you need them, and one everything is working it's pretty much set & forget reliability. Sure, as mentioned in the previous thread, ADP's portal UX is horrifically dated, but that has nothing to do with back end integration.

I think none of our integration projects had an internal cost (labor) of more than about $20k.

seekingcharlie• 11 years ago

I also managed an ADP integration & second this.

Their engineers were really quick to respond to us throughout the process too.

eitally3• 11 years ago

I'm glad they posted this. It sounds like Zenefits could get away with using a startup mentality to work around an enterprise software/platform provider's generally accepted architecture for integrations, if not their explicit TOS, and was burned. Perhaps ADP will learn from this and look at it as an opportunity, or perhaps they won't. It's not like enterprises with ADP contracts are going to switch away from them because they can't use Zenefits on top of it....

Integrating with ADP is easy, but like so many other enterprise software/platform integrations, each project has to be taken independently. Zenefits doesn't want this but ADP doesn't have any real reason to change things.

TimSchumann• 11 years ago

Integrating with ADP is easy, but like so many other enterprise software/platform integrations, each project has to be taken independently.

How are those two statements not contradictory? Seems to me that if integration was easy (read standardized) it would be agnostic of, not specific to, who was integrating.

dragonwriter• 11 years ago

"Easy" is not opposed to "time consuming and tedious". Its quite possible (and common, IME, in programming) for things to be both easy and time consuming, tedious things that need to be done one-off for each particular implementation because you are working with something that, for instance, resists the kind of abstractions that would make it generalizable.

Pretty much anything for which recipe-style cookie-cutter patterns are documented, for instance, fits this description.

devonkim• 11 years ago

Easy to me means not technically challenging. Over 90%+ of the enterprise integrations in my careers are tier 1 - 2 easy in the context of software engineering knowledge. It's usually a really convoluted form of "fill in the blanks in a form and pray it works."

But these are all complicated in that you could literally take the smartest person in the history of the world and make about the same rate of progress as if you had taken a pretty average person to do the same thing. These sorts of problems tend to be related to wicked problems. For example, there's a bazillion side effects to consider, meetings to be had about "what does this field mean to you actually?," and other things that are of business importance but are a complete snore to the programmer implementing them. You're not talking about whether to use singly or doubly linked lists or which datastructures to use in an integration almost ever, but you're talking about how well it will scale from the perspective of a business and how its own rules and patterns of use work.

Business algorithms might be something both hard and complicated of a topic, but unless your business is actually something technical such as algorithmic trading, scientific & technical research, etc. your business domain skill level is probably more about depth of knowledge than whether you're really smart or anything in itself.

Also, SOAP was a very popular "standard" but those of us stuck in the pits of writing tons of XML-RPC SOAP code for years knows that it was hardly ever more standardized in practice than "REST" is today.

slang8003• 11 years ago

Our first priority is protecting our clients and their data.

...From themselves? If someone wants to manage their account through a 3rd party that allegedly uses some non-standard way of accessing ADP then that's a risk they decided to take. ADP should be figuring out a way to give Zenefits (and any other similar companies) more secure access to their platform, not cutting them off.

wnevets2• 11 years ago

If someone wants to manage their account through a 3rd party that allegedly uses some non-standard way of accessing ADP then that's a risk they decided to take.

would the average ADP customer understand thats whats happening?

7Figures2Commas2• 11 years ago

ADP should be figuring out a way to give Zenefits (and any other similar companies) more secure access to their platform, not cutting them off.

From the PDF:

Despite having many legitimate ways to integrate with ADP properly, Zenefits chose an unsecure and indirect approach.

If someone wants to manage their account through a 3rd party that allegedly uses some non-standard way of accessing ADP then that's a risk they decided to take.

From the PDF:

Despite Zenefits serving less than 0.25% of the clients on our system, they had been responsible for up to 25.0% of the total user traffic (in other words, a hundred-fold times ordinary user traffic).

The Zenefits approach was not only putting excessive and unnecessary demand on ADP’s servers, but it was pulling sensitive information, including unmasked Social Security numbers and employee banking information, in a manner that did not comply with ADP’s standards for data security.

It sounds like ADP did what any company, large or small, would do when faced with a third party accessing its systems in an unauthorized and inefficient manner.

slang8003• 11 years ago

Despite having many legitimate ways to integrate with ADP properly, Zenefits chose an unsecure and indirect approach.

Do you really think Zenefits just chose this "lesser" method on a whim? I've never met the team from Zenefits, so I can't say for certain, but if they're not idiots then I think there's a reason why they decided not to use the regular API. Whether that's a requirement of getting their app approved by the ADP Marketplace, or some restriction on the data that they are able to get through the official API - I think that there's something that ADP isn't mentioning.

It sounds like ADP did what any company, large or small, would do when faced with a third party accessing its systems in an unauthorized and inefficient manner.

As far as unauthorized methods go - you'd patch the hole in your security to prevent them from getting through. Unauthorized methods of accessing your systems shouldn't exist, and blacklisting the domain name of the third-party isn't how you fix a security flaw. For the excessive load, they should just implement rate limiting across their system & return a 429 when someone goes over.

Of course, I really doubt that they were accessing ADP via a real security flaw - they were probably just making the same requests as users are able to, but in an automated fashion. And if that's the case then the term "unauthorized" doesn't apply, because users are clearly authorized to make those requests.

radnam2• 11 years ago

I am not sure why are you down voted. This in the unfortunate reality where incumbents like ADP have no incentives to share their data. Greater the lock-in harder it is for a customer to migrate away from their systems. In this case I would want to give Zenefits a benefit of doubt.

ketralnis• 11 years ago

incumbents like ADP have no incentives to share their data.

It's not ADP's data. It's the employer's data. The employer has decided to use it with Zenefits.

pbreit• 11 years ago

ADP already offers access. Zenefits decided not to utilize that formal access.

MangezBien• 11 years ago

I hate ADP with a burning passion (as a user of them across three different companies now) but their points are totally reasonable. Zenefits looks like a petulant child and seems to have made no good faith effort to integrate with ADP properly.

spdustin• 11 years ago

Wait... So was Zenefits scraping ADP's RUN portal?

gvb2• 11 years ago

Apparently scraping their portal via "access to our systems by convincing clients to give them administrative access to our platform."

Wow. Talk about a disaster waiting to happen.

at-fates-hands• 11 years ago

"but it was pulling sensitive information, including unmasked Social Security numbers and employee banking information"

Did ADP just admit they keep SSN and banking information in plain text on their servers???

CPLX3• 11 years ago

No, but they admitted you can access that information if you are logged into an account.

If you have figured out a way to do something like print a employee's copy of an IRS form like a W-2 or 1099 without having plaintext SSN information involved in the process I would sure be curious to hear about it.

tzs3• 11 years ago

That raises an interesting question. Why is my SSN printed on my W-2?

Presumably I already know my SSN, so do not need the W-2 to remind me of it.

function_seven• 11 years ago

Not at all. They said that Zenefits was pulling that info from their servers. ADP is probably not happy with the the prospect of Zenefits being a potential breach source for that info.

dsr_• 11 years ago

Worse, that "in a manner that did not comply with ADT's standards for... security". So apparently you can retrieve sensitive information from them insecurely.

MarkPNeyer• 11 years ago

if you can view the info you've put on then site, the yes. it sounds like zenefits was scraping the personal ui. how could you display someone's social security number to them so that a screen grabber couldn't' get it?

tzs3• 11 years ago

No. They admitted they keep it in some form that can be converted to plain text.

I would expact that they need SSN for reporting to the IRS, and bank information for direct deposit. If they are following proper security practices, these will be encrypted on the servers, and get decrypted as needed.

I'm not familiar with what clients can do via the administrative interface, so don't know if it is reasonable to provide access to the decrypted data over that interface.

scarmig• 11 years ago

I never expected to feel sympathy for ADP. This is a pretty effective PDF.

binxbolling• 11 years ago

Now where's the Zenefits rebuttal to this salvo? I think this story is really interesting on a number of levels.

aaronem• 11 years ago

They're probably too busy right now talking to their recent investors [1] to provide one.

[1] http://techcrunch.com/2015/05/06/zenefits-rising-hrs-hottest...

baakss• 11 years ago

They weren't too busy to fire off the initial complaint over social media though? Supposedly that's what prompted ADP's response, though I can't find a link to Zenefits complaint.

cgoodmac3• 11 years ago

Zenefits just released a response: http://blog.zenefits.com/adp/

joshdance• 11 years ago

Using ADP was the worst part of my week at my previous company. This PDF is better designed than anything I ever saw from ADP. And good to know of have more ideas about both sides of the story.

phantom_oracle• 11 years ago

Just swap this story around and change it to:

Big corp. starts illegally stealing data through improper means and not following T&C of small-funded startup

and there would be an uproar.

All those fluff tech-sites that treat Apples new Iphone with incremental changes as "big news" would suddenly have months of juicy news to bash the big corp to the point where their bigger media-parent companies would follow suit and damage the big corp indefinitely.

Maybe folks should just call "a spade a spade" here.

The startup violated the T&C of ADP and whether or not ADP is 100% honest of the server-volume from this company, the startup still committed an illegal action.

You can "disrupt" industries all you like, but when you break explicit contracts, you can't go crying on social media about it and expect things to work out for you.

As far as PR goes, ADP won with this line:

"We’re willing to work with our clients who use Zenefits, and with Zenefits directly, to find a solution that fulfills our clients’ needs and protects their data."

devicenull• 11 years ago

The startup violated the T&C of ADP

Here's a fun question... Did Zenefits ever agree to the TOS?

samch2• 11 years ago

"By accessing and/or using the Site, you indicate your acceptance of these terms and conditions." [1]

IANAL - It seems as though they did agree.

1: http://www.adp.com/legal.aspx

mbesto2• 11 years ago

By using the Zenefits Service, you hereby grant us permission to access your Account Information maintained by identified third parties, and make changes to this information as directed by you, on your behalf as your agent. When you use the 'sync payroll' feature of the Service, you will be directly connected to the website or APIs for the third party you have identified. We will submit information including usernames and passwords that you provide to log you into the site. You hereby authorize and permit us to use and store information submitted by you (such as account passwords and user names) to accomplish the foregoing and to configure the Zenefits Service so it is compatible with the third party sites for which you submit your information.

So basically a user of Zenefits gives Zenefits the authority to act as an agent on behalf of them. So, technically when Zenefits accesses the ADP site they are legally seen as the authorized user themselves.

If I knew that a service was going to act on my behalf towards another party and that other party wasn't happy about the way that service behaved towards them. I might question my use of letting that service act as my agent.

Zenefits is actually pretty smart here because they can say "our users want this, they've agreed to our ToS that says we act on their behalf".

beachstartup3• 11 years ago

i posted this yesterday, but the top three reasons i didn't go with zenefits (not that it matters because apparently they are taking over the world):

1. sales people were pushy dickheads that implied i was wasting their time by re-scheduling their demo due to emergency client issues, when i am their prime audience - an overworked, underpaid, understaffed startup founder.

2. they couldn't articulate how they integrate with my payroll service. it was a bunch of hand waving and "trust us". unfortunately i know how technology works and i'm not going to "trust" anyone unless they have a well defined solution.

had i known i was supposed to give them my administrator login information, it would have been a non-starter anyway.

3. the fact that their business model was basically to take business from existing insurance brokers seemed a little lame to me. why can't i just pay for your services?

obornii• 11 years ago

1. OK - I agree.

2. So - did you get mint.com to tell you how they integrated with your bank(s) ? Did your local bank tell you, for that matter, how they did background searches on their staff ?

3. You clearly don't manage a company with issues like COBRA, insurance, or payroll.

I almost didn't get past #1, but #2 and #3 were non-issues. Why? Because when you manage a business, you have to focus on your core business: So either pay to outsource HR (6K month, thats a salary right there), risk noncompliance with a broker, or go with Zenefits and worry about under-the-bed monsters that do not exist under #2-#3.

beachstartup3• 11 years ago

every single point you've made is wrong.

beachstartup3• 11 years ago

i think the only thing that's clear here is you don't actually run a business, because you're pretty much wrong, or make incorrect assumptions, on every single point.

for example: i do know the background-check procedures my bank uses on its employees. it's in the fucking brochure they give you when you open a commercial account.

shaaaaawn2• 11 years ago

It's funny watching the Zenefits response: Bring in the yComb & Celebrity Investors (Jared Leto / Ashton Kutcher) to get public opinion on their side via twitter #ADPeeved and a Change.org petition. So far at least on social media there's not a lot of noise from impacted customers. Just negotiate an MSA, pay the fee, build a proper integration and perform better Risk Management in the future (like a $4.5B business should).

c-slice• 11 years ago

Why doesn't Zenefits just become a payroll provider? Is the an enormous amount of regulation around providing payroll services?

wlonkly• 11 years ago

There sure is. I've got a tiny bit of experience with ZenPayroll, and they're separately licensed in the states they're permitted to operate in (and it's a minority of states, IIRC).

speby• 11 years ago

That [currently] is not Zenefits' business model. Their entire premise is that you can practically use any providers you want for your benefits such as various 401K providers, various health care plans, etc., as well as any payroll vendor. Zenefits makes its money as a broker when you choose to go through Zenefits to get things such as payroll or benefits administration services. But the key is that Zenefits itself is not providing the said services. They are paid on commission or rev. share with the providers that ultimately service Zenefits customers.

While they could become a payroll provider themselves, that isn't really their mission. As well, it's not so trivial to write some software "over the weekend" and have a solid payroll system. While payroll companies actually have very little regulation (this is true, and somewhat surprising), it is complex to build a payroll system that can accommodate all the various needs of clients. Just to name a few things to get started: Hourly, salary, pay cycles, 1099, fed/state/local taxes and tax codes and rates, time off tracking, punch in/punch out, check printing and electronic deposit, paper and electronic tax filing, tax payments, garnishments, time off tracking, pre/post-tax deductions, worker's compensation rates, union dues, and the list just goes on from there.

tw990• 11 years ago

http://blog.zenefits.com/adp-2/ ADP rolls out Zenefits competitor hours after claiming they were not in a lawsuit.

The truth will always reveal itself! /zenefits EE

BrandonMarc• 11 years ago

Other side of the story: https://news.ycombinator.com/item?id=9688058

The facts about ADP and Zenefits: Response to the claims made by Zenefits [pdf]

Related Stories