0:00

Welcome back to another episode of Startups

0:02

for the Rest of Us. I am

0:04

your host, Rob Walling. In this episode,

0:06

I'm going to talk about the eight

0:08

levels of platform risk, as

0:10

well as the three factors that

0:13

contribute to platform risk. And I'm

0:15

not just going to talk about

0:17

the traditional, I have a Shopify

0:20

app or, heaven forbid, your WordPress

0:22

web host this week, but I'm

0:24

going to look at platform risk

0:26

from a sense of any type

0:28

of reliance on an

0:31

external platform. So if you use SendGrid

0:33

to send email, how does that factor

0:35

in? If you use

0:37

AWS for your hosting, or

0:39

you use an open source package

0:41

like WordPress. And honestly,

0:44

this is a framework I came up

0:46

with a few months ago, and I

0:48

jotted it down in a Trello board

0:50

I keep for podcast episode topics. And

0:53

I was just going to pull it out at

0:55

some point, probably put it in a book, I'm

0:57

sure talk about it on the podcast. And then

0:59

the WordPress WP Engine kerfuffle flared up. By now,

1:01

that's a couple weeks old. But it did remind

1:03

me that I had this and had never really

1:06

done a full refinement on it. And

1:08

so this podcast episode is a way

1:11

for me to kind of bring that

1:13

out and talk through my thoughts of

1:15

platform risk as I see it. Especially,

1:17

it's probably any startup, but realistically, there's

1:20

a little bit of a B2B SaaS

1:22

bent to it, right? Because that's the

1:24

191 investments I've made. And

1:26

so I've seen different forms of

1:28

platform risk, blindside companies in different ways,

1:30

and that is the basis for

1:33

today's episode. Before I

1:35

dive into that, tickets for MicroKonf New

1:38

Orleans are on sale.

1:40

You can go to microkonf.com/US if you'd

1:42

like to grab your ticket.

1:46

The event is being held next March of

1:48

2025. Speakers

1:51

are yet to be announced. And of course, I will

1:53

be there in New Orleans. And if you want

1:55

to get together with about 250 of your favorite bootstrapped

1:57

founder... friends,

2:01

head to microconf.com/US. The tickets right now are

2:03

the least expensive they will ever be. And

2:05

they will go up in price, I don't

2:07

know, in a few weeks or a month

2:09

or whatever. In addition, we

2:11

are going to sell out. We sold

2:14

out our Europe event, I believe we

2:16

sold out Atlanta last April. So if

2:18

you want to get a ticket, there

2:20

is no reason to wait. microconf.com/US. Let's

2:32

dive into platform risk.

2:35

So I'm going to start with these three

2:37

factors that contribute or

2:39

define platform risk. And

2:42

each of these, you might think

2:44

of on a scale, you know, whether it's

2:46

one to 10 or one to 100, there

2:48

can be a small amount of

2:51

risk for a specific factor or a

2:53

large amount. So the first one I

2:55

think of is a replacement.

2:57

So if you are on a platform,

2:59

whether that is using SendGrid to send

3:01

email, whether it is hosting on AWS,

3:03

whether you built a no code app

3:06

in Airtable or Bubble, whether you are

3:08

a Heroku app or Shopify app, is

3:11

a replacement available for

3:13

this platform? And how hard is

3:15

it to switch? And is the

3:17

pricing approximately the same? So there are more

3:19

questions than that, but those are kind of

3:22

the high level. So it's replacement. So we

3:24

might think of what is an easy replacement

3:26

where it's available, it's not that hard to

3:28

switch and it's a commodity. So the pricing

3:30

is the same. Well, that

3:32

is something like I would say

3:34

SendGrid, Postmark, Mandrel,

3:37

Mailgun. The switching cost

3:41

is real. It is a thing. But

3:43

it's connecting to a new API and it depends

3:45

on how deeply you're integrated, obviously, but that

3:48

switching cost is not catastrophic. And

3:51

pricing in that space of sending email or

3:53

even SMS, you know, I think of Twilio

3:56

and, you know, the Kajillion SMS

3:58

APIs out there. There are a

4:00

lot of replacements available, and

4:07

you are in the Shopify App Store. Is

4:12

a replacement available? How

4:18

hard is it to switch? It's

4:23

kind of like, no, there really isn't a

4:25

replacement. And

4:28

you're like, well, they kicked me out of the App

4:30

Store, or they took my API access away. It's like,

4:32

well, we can go build a

4:34

BigCommerce, a Magento, a WooCommerce

4:37

version, but it's not the

4:39

same. It's not a replacement. And

4:41

that's not really switching costs. That's

4:43

just building, spinning up a whole new product, right?

4:45

So the hard to switch is just astronomical. So

4:48

when we think about replacement from one to 10 or one to

4:50

100, that takes you

4:52

from easy to hard, at least in

4:54

my mind. So the first

4:56

factor was replacement. Second one

4:58

is customer concentration.

5:01

And the question here is, are

5:04

the majority of your customers on

5:07

this platform? Meaning that if

5:10

you were kicked out, or the API access were

5:12

shut off, or somehow the platform suddenly said, you

5:15

know, you're on Twitter's API, and they say, we

5:17

need you to pay us $12,000 a month now

5:19

to maintain it, or

5:21

80%, 90%, even 70%, 60% of your customers on this platform in

5:27

a way that essentially will decimate a huge amount of

5:29

your revenue. Now, what's

5:32

interesting is this is separate from

5:34

the third factor, which is, I'm saying lead

5:37

flow or customer flow. That's

5:39

on an ongoing basis, receiving

5:42

new customers, say from an App

5:45

Store listing or a Marketplace listing.

5:48

That's different. It's related, but it's different than

5:50

customer concentration. Because in theory, I could

5:53

go build a Twitter client, I could

5:55

be getting zero lead flow from

5:57

Twitter, but 100% of my customers are on

5:59

Twitter. could be concentrated on

6:02

Twitter or on Facebook's API.

6:04

Again, if I'm an app that, like,

6:06

postpone, for example, that

6:10

helps you post to Reddit, Instagram, Facebook, Twitter, and

6:12

all those, Grant,

6:15

he's a tiny seed founder, started postpone and it was just for

6:17

Reddit. And

6:20

so when we funded him, we said, your customer concentration

6:22

is basically 100% Reddit. We

6:25

think you should diversify into other platforms, and he was already

6:27

on board with that. You know,

6:29

across the different platforms. Now, great

6:31

example with postpone. Does postpone receive

6:33

any lead flow from being in a Reddit

6:35

app marketplace? No. So you can

6:38

have concentration and you can have the risk

6:40

of that concentration without the lead flow. And

6:43

you can have the lead flow. I guess

6:45

in theory you could have, let's say I

6:48

was on four platforms. I was like Shopify,

6:50

BigCommerce, WooCommerce, and Magento. And I

6:52

had, you know, 90% of my customers

6:55

on Shopify and, you know, only

6:57

10% across the other three. But

6:59

let's say the other three were sending me a lot of leads because

7:02

I just branched into them. And usually this is not the case.

7:05

Usually actually branching into other platforms

7:07

is a lot harder than you think. We've

7:09

seen tiny seed. I've seen tiny seed companies

7:11

and non-tiny seed companies try to do it.

7:14

And it can work, but in the majority

7:16

of cases I've seen it hasn't worked. So

7:18

the example there though was to say you

7:20

could have lead flow in those three smaller

7:22

non-Shopify apps, but not very

7:24

much customer concentration because you're kind of still

7:26

early, right? So these three of is there

7:28

a replacement, customer concentration and lead flow are

7:30

the three factors that I think of when

7:33

I try to rank order these

7:35

levels of platform risk. Okay,

7:38

so now that I've defined these

7:40

three factors, the contributing factors of

7:42

platform risk, I want to

7:44

walk through the eight levels of platform

7:47

risk. And I will talk through the

7:49

contributing factors and how they relate to each of

7:51

them. Interesting data point, as of

7:53

a week or two ago I had seven

7:55

levels of platform risk. And

7:57

the WordPress WP Engine kerfuffle basically...

7:59

basically begged the question of, let's

8:05

say you are built on WordPress, what's

8:08

the platform risk of

8:10

that? And there's different things. WP

8:14

Engine uses WordPress and they're a web host. But

8:17

what if you had a B2B SaaS company

8:19

that was built on WordPress as the core?

8:23

So it was kind of a no-code thing hacked together with

8:25

plug-ins. It's a related but a different

8:27

question. And the answer, of

8:29

course, is always, well, it depends a lot on

8:32

the specifics of how you rank these. All of

8:34

these are valid levels. It's just comparing

8:37

being built on WordPress versus being hosted on

8:39

AWS. I have ordered those in a

8:41

certain way and I think in different

8:43

situations they could be swapped a little bit.

8:45

But to me, this list is directionally

8:47

correct and it takes those three factors

8:49

and applies it to a bunch of different

8:52

scenarios that I'll give examples of. So

8:55

moving from least amount of platform risk,

8:58

consider the least amount, up

9:00

to the most amount of platform risk. Basically,

9:02

you have the most exposure and the most

9:04

risk of your business being killed. And

9:07

so I'm going to go 1 through 8, again,

9:09

where 1 is the lowest, 8 is

9:11

the highest, the most dangerous. Level

9:13

1 is almost no platform

9:15

risk. It is where you own

9:17

your own server in a cage.

9:21

With redundant power, you

9:23

run your own SMTP servers to send emails.

9:26

Platform risk here is any

9:28

development language you use, right, plus your

9:30

internet service. Basically, you are

9:32

not reliant on a host. You're

9:35

not reliant on anything to send

9:37

email. You're not built in no

9:39

code. I guess your oh, and

9:41

your risk there is where are you getting leads

9:43

from? Do you have customer concentration and where are

9:45

you getting leads from? In

9:48

this case, I'm assuming there's just almost none, right? You

9:50

have this great variety of leads coming from all over

9:52

the place and there's no

9:54

customer concentration in terms of them being reliant

9:56

on an external API. So this one's... It's

10:00

so unrealistic, I just kind of want to skip by it, because none of

10:02

us are going to do that, right? The

10:04

second level of platform risk, I think

10:06

of it as you being reliant on

10:08

a platform that is a relative

10:11

commodity, and it's easy to

10:13

switch away from. Again, relatively easy. I know

10:15

we could make an argument, I'm going to

10:17

say SendGrid and Twilio, right? An SMS provider,

10:20

email provider. Those are

10:22

commoditized, and they are relatively easy

10:24

to switch. There's no lead flow,

10:26

there's no customer concentration, it truly

10:29

is just a replacement decision. And

10:31

one might say, well, SendGrid integration will take you months to

10:34

micro it away from. Usually that's not

10:36

the case, usually it's a couple of weeks. I

10:38

believe we did this with Drip, because we went

10:40

from, we had three or four different email

10:42

providers that we were using that were APIs that

10:44

sent emails. And it would take us a matter

10:47

of weeks to switch, and we were sending hundreds

10:49

of millions of emails a month. So again,

10:51

this is why it's probably the

10:54

most realistic one that a lot of us

10:56

are exposed to. And this is where it

10:58

always bothers me, I'll be on ex-Twitter, and

11:00

someone will say, oh man, you build on

11:02

Airtable or Bubble, and there's platform risk. And

11:05

some smart outlet comes in and says, oh

11:07

yeah, well, you host on AWS, and that's

11:09

a platform, and you send emails through SendGrid.

11:11

And so that's also a

11:13

platform, and you have risk too. And it's like,

11:15

but they're not the same. And that's the point

11:17

of this list, is to have them in order

11:20

of increasing risk or exposure.

11:22

And I think being reliant on a

11:24

commodity, whether it's hosting, or whether it

11:26

is an API of some sort, I

11:30

think at the same level as like, imagine if you

11:32

have a VPS, or you have like a Docker container,

11:35

and you're on commodity hosting somewhere. And you

11:37

can basically just pull that and spin it

11:40

up in, I don't

11:42

know, half a day, a day, two days, whatever,

11:44

it's that relatively low switching cost, and it is

11:46

commoditized. I think that fits in this category as

11:48

well. So the third level of platform risk,

11:50

which is just a little riskier than the one I just

11:53

mentioned, is when you're using

11:55

these large cloud providers, Amazon

11:57

Web Services, Google Cloud. Azure,

12:01

this is where they, you

12:04

know, you still don't have customer concentration

12:06

or lead flow. That's irrelevant, right? Obviously

12:09

those are more dangerous. And

12:11

so those are in the, you know, the higher levels of platform

12:13

risk. But moving away from

12:15

AWS, GCP, Azure, whoever else, it's

12:18

not just spinning up a Docker thing and moving

12:20

the VPS or whatever. I think

12:22

the switching cost is significantly more than

12:25

moving away from an API, you know, like a

12:27

SendGrid or an SMS. Because this is the infrastructure

12:29

where your entire app is, and

12:31

you start to get reliant on a lot

12:33

of services. And so this one also has

12:36

a varying degree. It's a slider of like,

12:38

well, if I'm only using an EC2 instance

12:40

and everything's there, then that, you know, maybe

12:42

low-ish switching costs. But by the time I

12:44

have auto-scaling and I have six different types

12:46

of servers, because I have the front end

12:48

and the API and I have a database

12:50

and I have Redis servers and I have

12:52

Sidekick workers and I have, and I'm using

12:54

Amazon's, what, you know, they're proprietary, not proprietary,

12:56

but they're more like the Redshift thing. And

12:58

I'm using a bunch of stuff in Amazon,

13:00

like switching away from that at that point

13:03

becomes very, very painful. And

13:05

migrating to another platform, you just, you know,

13:07

again, that's why it's the third level, I

13:09

think, of platform risk. Now, if

13:12

it's such a pain to switch, why do I think the

13:14

risk is relatively low? Because at

13:16

least to date, AWS, GCP, and Azure are not,

13:19

they're not in the business of being aggressive. They

13:21

have no motivation to, like

13:25

their business model is selling you stuff for a

13:27

certain amount of money. And so they want you

13:29

to be happy. They keep rolling out new stuff.

13:31

They keep dropping prices, right? It's the opposite of,

13:33

you know, I'll get to it in a second, but like the

13:35

no-code providers, right, where they keep raising prices

13:37

and where any of those could go out of

13:39

business any day. And they're not

13:41

profitable, right? For the most part, I think most of

13:44

the no-code providers are, you know, have raised a bunch

13:46

of money and are still not profitable. That's

13:48

where, judge McCall, like AWS, GCP, and

13:50

Azure, I don't think are going to

13:52

be aggressive and make people want to

13:54

migrate off, unlike other

13:56

startups that are still in that

13:59

early, say, monetization. or growth phase.

14:02

So that was the third level, which was medium

14:05

to higher switching costs. There

14:07

are replacements available, again, AWS,

14:09

GCP, Azure, and others, but

14:12

there's no lead flow or customer concentration.

14:17

Hiring senior developers can really move the needle

14:19

in your business, but if you bring on

14:21

the wrong person, you can quickly burn through

14:24

your runway. If you need

14:26

help finding a vetted senior results-oriented

14:28

developer, you should reach out to

14:30

today's sponsor, lemon.io. For

14:32

years, they've been helping our audience find high-quality,

14:34

global talent at competitive rates, and they can

14:37

help you too. Don't just

14:39

take my word for it. Listener Dylan Pierce

14:41

had this to say about working with lemon.io.

14:44

The machine learning engineer they helped me hire

14:46

was very professional and even learned a new

14:49

tech stack to set up an environment to

14:51

train and deploy machine learning models. He documented

14:53

his work clearly so I could train it

14:55

in the future with additional data. I'm super

14:58

happy with the results. And long-time listener Chaz

15:00

Yoon hired a senior developer from lemon.io and

15:03

said his hire, quote, definitely knew

15:05

his stuff, provided appropriate feedback and

15:08

pushback, and had great communication, including

15:10

very fluent English. He really

15:12

exceeded my expectations. Chaz

15:14

said he'd definitely use lemon.io again when

15:17

he's looking for a senior-level engineer. To

15:19

learn more and get a 15% discount on your first four

15:22

weeks of working

15:24

with a developer, head

15:26

to lemon.io/startups. That's lemon.io/startups.

15:33

The fourth level of platform risk is the one that I

15:35

added for the WordPress kerfuffle.

15:38

And here's the interesting thing. I have

15:40

open-source software like WordPress, and

15:42

so that's kind of vague as the fourth level. Here's the thing. There's

15:45

no customer concentration. There's no lead flow. The question is, is

15:47

there a replacement? Is it easy

15:49

to switch and is it priced the same? Well,

15:52

open-source software doesn't have to be free

15:54

as in price, free as in beer,

15:56

but most of it is, right? I think

15:59

the majority of it is. Coming

20:00

in at number six, I have all your leads

20:02

coming from a single marketing channel such as Google.

20:04

So basically, it's 100% lead flow risk. Now,

20:08

I'm not including app stores in this,

20:10

like app marketplaces. I will get to

20:12

those. Those are seven and eight. But

20:15

in this case, I'm thinking of

20:17

being solely reliant on

20:19

a single flow

20:21

of leads. And I think, is that a

20:23

platform risk? I do think there is risk

20:26

there. There is no replacement, usually,

20:28

right? There's no direct replacement. If

20:31

you rank in Google and you get amazing organic

20:33

search, trying to replace that with

20:35

something else, switching costs is irrelevant

20:37

because you just can't do it, right? Customer

20:40

concentration is irrelevant because they're not

20:42

reliant on Google once they come

20:44

through SEO. But your

20:46

lead flow and your growth plateauing feasibly,

20:48

it could kill the business. And here's

20:50

what's interesting is you'll notice in these

20:52

eight levels, the lower end

20:55

ones are all kind of technology. And

20:57

it's the business factors. It's the

20:59

growth and new customers and customer

21:02

concentration that I've put at the six, seven

21:04

and eight spot. Because those are the ones

21:06

that are so hard to replace. And I've

21:08

seen several businesses killed. You

21:11

talk about Google changing their algorithm, you know,

21:13

every what, three, six, nine months, and entire

21:16

affiliate businesses that were doing

21:18

millions of dollars basically go

21:20

to zero overnight. So

21:22

the reason I have this as number six

21:25

is that if bubble 10X, their pricing or

21:27

had a big outage, you could rebuild that.

21:29

And if you're hosted on AWS or using

21:31

SendGrid or using WordPress, you can rebuild it.

21:34

The risks are there, but they're lower than

21:36

if you lose Google where there is no

21:38

replacement and you lose all your organic rankings,

21:41

it can be existential to the business. The

21:44

seventh level of platform risk, I

21:46

put a friendly app ecosystem.

21:49

So an example of this is

21:51

Heroku. Like Heroku apps in

21:54

general thrive. Heroku has not, at least

21:56

to date, and this could change, but

21:58

they have not screwed.