Ask HN: How are you securely onboarding people remotely?

You could try Dekko. They have DekkoLYNX, which is a secure (e2ee) video conference and DekkoVault, which allows secure file sharing, email, chat, and document sign offs. DekkoVault allows you to share sensitive information only with people, who would see it. Have a look at <a href="https:&#x2F;&#x2F;www.dekkosecure.com&#x2F;videoconferencing" rel="nofollow">https:&#x2F;&#x2F;www.dekkosecure.com&#x2F;videoconferencing</a> and <a href="https:&#x2F;&#x2F;www.dekkosecure.com&#x2F;dekkovault" rel="nofollow">https:&#x2F;&#x2F;www.dekkosecure.com&#x2F;dekkovault</a>

Adding to what Twunde said, async communication is important. However, I think chat is a bit impersonal, especially in the onboarding phase where you want them to create connections with people as well.<p>You should look at something like vlokit [0]. It&#x27;s aysnc video chat for remote teams. You can basically create a story to do introductions. Have videos of important processes etc.<p>The cool thing is that they can ask questions or give feedback in the same thread. So, you can have async communication, while making a real connection with them.<p>It can really work well for you.<p>[0] <a href="https:&#x2F;&#x2F;vlokit.com" rel="nofollow">https:&#x2F;&#x2F;vlokit.com</a>

In point order:<p>1. Have some sort of standard video chat such as Zoom, etc to hold meetings easily. Importantly, everyone should have access so expensive tools like WebEx may not be what you&#x27;re looking for. Additionally you&#x27;ll probably want an asyncronous chat client. This can be Slack&#x2F; Microsoft Teams&#x2F; Mattermost&#x2F;IRC etc, but there should be an easy way to ask questions async.<p>2. Plan out something so that new hires can easily meet the team. We personally assign new hires buddies and we also use a slack app called donut to randomly assign people to have coffee&#x2F;tea&#x2F;lunch together.<p>3. In terms of equipment, you&#x27;ll probably be shipping laptops or something similar. MacOSX and Windows both support MDM client workflows so that a new hire opens up the computer and it autoinstalls your company&#x27;s standard tools, and enforces secure configurations (search for Zero touch deployments for more info). This should definitely include encrypting the laptop as lost&#x2F;stolen laptops can be considered a data breach if they are not encrypted. Note that some companies still have larger than normal laptop processing times to ship out equipment.<p>4. In terms of restrictions for what new employees can access, you&#x27;ll usually grant access to all of the codebase but give more limited permissions to access secrets (this assumes that you have a separate secret management tool and your keys aren&#x27;t in plaintext so your milage may vary). This is often controlled by role-based access control (RBAC)<p>5. In terms of ramping up someone&#x27;s access what you&#x27;re looking for is attribute-based access control (ABAC), where you can create fancy-pants rules like grant access to X when someone has been at the company for 3 months. At 40ish engineers, you&#x27;re probably not there, but this should be something you&#x27;re asking about when IAM comes up and when you&#x27;re hiring more traditional IT or security folks. You _can_ also build out approval workflows, but these definitely slow down velocity and are more typical of larger corporations. This can significantly slow down development while not really providing much security benefit.<p>6. Re: legal&#x2F;regulatory&#x2F;cultural issues: Being based in Berlin, you have some EU laws around data usage ie EU-US Data Shield and GDPR considerations. Besides that, you&#x27;ll probably need to check with your company lawyers. Per devs stealing equipment, your finance team probably doesn&#x27;t care if a hire steals a laptop or other equipment (That laptop is probably values as less than 1000 euros. Time spent trying to recover it will probably outweigh the value of the equipment). If someone steals valuable data or IP, especially if you need to report a security breach, that is a different story. You _can_ still call the police in that location. As you grow, insider threats could become a bigger danger. Most security compliance frameworks (NIST&#x2F;ISO&#x2F;etc) require building out controls for insider threats including at a minimum audit logs etc. At 40ish engineers this is not a big concern since your interview process should hopefully be weeding out problems.<p>7. The biggest issue with going remote is all those things that you currently do in person that compose your companies tribal knowledge. Meetings, how things work, how to best configure your editor and dev environment. You may have existing documentation, but you&#x27;ll likely need to invest time in improving it. Do you take meeting notes and are those available to read by your engineering team?