Gusto Engineering

Gusto | Software Engineers, Product Managers, and Product Designers [Senior Levels] | SF or Denver | Full-Time | ONSITE Gusto’s mission is to create a world where work empowers a better life. We are making the most complicated, impersonal business tasks simple and personal. Imagine payroll that brings peace of mind, HR that transforms work into a community, and benefits that help people plan for a better future. Our small business customers truly love our product and we think you’ll love building it. Come join us in San Francisco or Denver and help serve over 60,000 businesses across the country. In case you want some more technical details, here's a link to our engineering blog: https://engineering.gusto.com/ Apply here: https://grnh.se/0cagm28b1 Or feel free to email me directly! I’m [email protected].

it doesn't cost anything but there is risk involved. So nobody takes a cut, but it also isn't "free". This is a fantastic series that explained it really well to me: https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa…

Gusto uses a Rails monolith. https://engineering.gusto.com describes some of their experiences with it.

Hey Brad! I'd say it was a combination of hiring in-house experts (we did that to learn about payroll taxes), and lots of reaching out to people and not being afraid to pepper them with questions (for example, in the case of learning about the ACH system: https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa… As for Denver, a ton of factors went into choosing it. Ultimately though, we just loved the people, talent, and culture in Denver so we went with that! I'm doing great! It's so great to hear from you again.

Gusto did a great blog post series about this, I highly recommend taking the time: http://engineering.gusto.com/how-ach-works-a-developer-perspective-par…

ACH takes days to weeks to clear anyway, especially if new sender or large amounts = untrusted. There is no real exception handling so you are given the amount on credit. https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa… (From parent) > And the payee doesn’t need to share their bank info. And this is a US concept where having the magic numbers lets you pull any amount you want, with no ability to have a "push only" number...

> What does it take to update 2 "balance" values in databases? Quite a bit more than you seem to think. https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa…

https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa… A good time to remind people that the USA's money-transfer system (aka: ACH) is a giant Rube-Goldberg machine involving FTP transfers of specially formatted files. So it sounds like the Fed's FTP server is down?? Or something like that?

> Dump some file in a directory and hope something is treating that directory like a queue Or it's unencrypted files on an FTP server containing literally the lifeblood of the American economy: https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa… -_-

There's an interesting series of blog posts on the topic: https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa… And the accompanying hackernews thread - https://news.ycombinator.com/item?id=7636066 But basically it seems like ACH is slow because the federal reserve runs once a day batches.

The Gusto co-founder describes his role and changes as they grew to 100 engineers in this blog: https://engineering.gusto.com/how-my-role-as-cto-has-changed-as-weve-g… I found it reassuring I wasn’t the only founder who still felt they could provide more value by helping build and architect the product than just simply managing budgets and recruiting.

How much are you willing to spend per transaction? With Stripe or Braintree it’s trivial but expensive. Are you targeting just the US market and dollars? Going directly with a bank is cheaper but more complex [1]. And unless you’re adding significant value you’ll probably need a money transmitter license in your state. And if you’re planning on letting any asshole on the internet use this, you need an anti-fraud strategy because settlement times are measured in days and there are plenty of ways that money can be sent but never refunded. Good luck! [1] http://engineering.gusto.com/how-ach-works-a-developer-perspective-par…

Very few banks have that option, and the ones that do are bordering on user hostile, and the temporary cards don't have usable/tolerable features for this. A wire costs $50-100 (or more for international) per transaction, no matter what the amount. A bank transfer (ACH) can take several weeks or more depending on how much both banks trust each other and the type of account you have. Here's a fun read: https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa…

"... the ACH system never provides positive confirmation that an ACH debit has gone through successfully. The only response an ACH originator may get is one notifying them of a return. Because of this 'no news is good news' policy, it is wise for originators of ACH debits to wait for 3 additional business days of 'no news' to ship their product to the customer. Though the ACH system is described as a next-day settlement system, in practice, it is not because of this."[1] So your bank is being optimistic and giving you a credit, assuming that no return will happen. A pessimistic or cautious bank would really have to wait several business days to ensure no returns happen before crediting your account. [1]: https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa…

Here's a neat set of 4-part article explaining the workings of ACH from a developer's perspective. https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa…

> maybe a slow cobol mainframe somewhere Inter-bank money transfers in US are handled by a system that needs multiple "business days" for a transaction to be finalised so you're on the money here: https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa…

> But how exactly does an ACH transfer work? If you want this from a developer perspective, the subject is discussed in great detail in the following blog post series. How ACH works: A developer perspective - Part 1 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… How ACH works: A developer perspective - Part 2 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… How ACH works: A developer perspective - Part 3 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… How ACH works: A developer perspective - Part 4 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… and HN Meta Discussion : https://news.ycombinator.com/item?id=7636066

There were a few blog posts posted here from a payroll company not too far back. They explicitly kept using the term “SFTP” so I have some hope that at least a good portion of banks aren’t completely broken. EDIT: http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… I was misremembering a bit. They said “secure FTP” and then just said FTP thereafter.

While "part 1" of this series says "FTP" (implying plain-text/unencrypted data), "part 2" [0] and "part 3" [1] both say "SFTP". This is "more correct", in my experience, as encryption is pretty much always used nowadays. [0]: http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… [1]: http://engineering.gusto.com/how-ach-works-a-developer-perspective-par…

Part 2: http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… Part 3: http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… Part 4: http://engineering.gusto.com/how-ach-works-a-developer-perspective-par…

They talk about this a little in part 3: > An addendum to the ACH protocol to support same-day ACH settlement is something that is almost unanimously desired by the ACH community. The good news is that NACHA, the governing organization behind ACH, has recently announced plans to roll out a same-day ACH protocol. The challenge is coordinating the adoption of the new protocol across all participating banks. Once fully implemented, the same-day ACH system would likely cut one day from the timelines outlined here. http://engineering.gusto.com/how-ach-works-a-developer-perspective-par…

You mean an ACH transaction processing system? Zenpayroll has a nice series of blog posts: http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… http://engineering.gusto.com/how-ach-works-a-developer-perspective-par…

SFTP, luckily http://engineering.gusto.com/how-ach-works-a-developer-perspective-par…

It's a fair question, but in fairness to Carta, until recently, there have been ~zero commercial or open source solutions to building application authorization (beyond limited helper libraries or things like Active Directory, which solve only a portion of the problem). Developers have typically figured out the models on their own and implemented them in application code with IF statements, etc. and/or by building separate authorization services. Other publicly documented examples include teams at Slack (https://slack.engineering/role-management-at-slack/) and Gusto (https://engineering.gusto.com/layering-authorization-into-a-web-applic… OPA is one solution that's emerged in recent years. The author describes his team's point of view after evaluating it for their purposes. Oso (https://www.osohq.com/) is a framework for application authorization. Disclosure: I'm a cofounder. Based on the post, the Carta team started their work in 2019, but we only open sourced Oso mid-2020, so they wouldn't have known about it. And in the last few months, a few other companies have announced offerings to address this problem too. So it's understandable why Carta chose to build. Now/soon other teams like them should have more options to choose from when they encounter similar challenges too.

I read this article, the previous one, and this blog post that explains ACH: https://engineering.gusto.com/how-ach-works-a-developer-perspective-pa… This is such a fun and interesting rabbit hole. And now I get how the whole thing worked from a computing perspective. I'm now just confused as to why the scam broke down the way it did. From my understanding, it seems that Pioneer was going to freeze his account (and they did). So in order to fix that issue, he temporarily diverted funds to his Pioneer account, settle debts(?), and continue trying to get money to cover the money he now owed to Cachet. But that doesn't make sense, does it? Because this fraud was going to be detected instantly (most likely) or ~3 days later. But that is nowhere near enough time to settle debts with Pioneer and get enough money to cover the Cachet debt. It seems to me like it was an extremely long Hail Mary that was likely never ever going to be successful.

As described at http://engineering.gusto.com/how-ach-works-a-developer-perspective-par… , ACH has called itself a 'next-day' settlement system yet funds transferred on a Thursday may not be available until the next Wednesday (6 days later) since they leave several days of buffer in case of returns and do not count weekends or holidays. And that's only if the transfer is done early in the day. If it's the evening, it could take 7 days. Unless they changed something else, changing from so-called 'next-day' to 'same-day' would only reduce that by 1 day from 6 or 7 days to 5 or 6 days, which isn't really that significant and certainly isn't what people think of when they see 'same-day'. It says "for transactions that can be initiated before 2:45 PM ET on business days (not on weekends or holidays)" so it's still broken with several days of delay, but there is a line that says "RDFIs will be mandated to make funds available from same day ACH credits (such as payroll Direct Deposits) to their depositors by 5:00 PM at the RDFI's local time." Does that require them to drop the return buffer? That could at least cut it down to only 2 or 3 days delay. If it does cut the delay in half, that's a mixed blessing since it reduces the pressure to develop a better protocol or even change ACH implementations to reduce the delay to a few minutes. It's just a series of 3 requests and 3 responses - even with processing, that shouldn't take more than a few minutes. And if they added…