Building an API is relatively simple, protecting sensitive financials is not.
"Q) Does Subledger store data safely and securely?
A) Yes. Subledger runs entirely on Amazon's AWS, which itself is compliant with HIPAA, SOC 1/SSAE 16/ISAE 3402 (formerly SAS70), SOC 2, SOC 3, PCI DSS Level 1, ISO 27001, FedRAMP(SM), DIACAP and FISMA, ITAR, FIPS 140-2, CSA and MPAA. Subledger itself has not yet been certified. We take your data security and safety very seriously: when Subledger says it has received your data, it has already been stored in two separate data centers.
Q) Does Subledger provide disaster recovery?
A) Yes. Subledger makes real time backups of transactions as you create them. Our storage system has a stated durability of 99.999999999%. Subledger can optionally mirror your transactions to a separate geographic location. With multiple copies in diverse georgraphic locations, your data is extraordinarily durable.
Q) Do I need to replace what I've already built?
A) No. Subledger can exist alongside anything that's already in place.
Q) Is accessing my financial data over the internet secure?
A) Yes. All communications to and from Subledger are TLS/SSL encrypted which is the modern standard for over the internet security.
Q) Do you have strong authentication and authorization?
A) Yes. We employ a gigantic keyspace (7.3322e+78 combinations) key/secret authentication with support for rolling key updates."
Thank you for your clear and concise feedback, very much appreciated!
People felt the same way about Salesforce.com, i.e. The data is too sensitive to place in the cloud.
Yet millions use QuickBooks Online every day.
We believe strongly that a huge new API economy is being built, we're delighted to offer our accounting API, mobile app, and web app to people who do not wish to build and manage it themselves.
Intuit is 31 years old, and QuickBooks is 20. They spent a long time getting account software right before they ventured into the hosted solution, and they're a publicly traded company with the advantages that comes with.
Not to say that you can't answer the security story, but I'd be cautious of the analogy approach.
I'll point out that I did spend a lot of time, energy and money on application security at Engine Yard (and still do as board member) and I'm very proud of our security record there.