{"action":"created","issue":{"url":"https://api.github.com/repos/colinxfleming/dcaf_case_management/issues/18","labels_url":"https://api.github.com/repos/colinxfleming/dcaf_case_management/issues/18/labels{/name}","comments_url":"https://api.github.com/repos/colinxfleming/dcaf_case_management/issues/18/comments","events_url":"https://api.github.com/repos/colinxfleming/dcaf_case_management/issues/18/events","html_url":"https://github.com/colinxfleming/dcaf_case_management/issues/18","id":120662756,"number":18,"title":"Database side: What to use? ","user":{"login":"colinxfleming","id":3866868,"avatar_url":"https://avatars.githubusercontent.com/u/3866868?v=3","gravatar_id":"","url":"https://api.github.com/users/colinxfleming","html_url":"https://github.com/colinxfleming","followers_url":"https://api.github.com/users/colinxfleming/followers","following_url":"https://api.github.com/users/colinxfleming/following{/other_user}","gists_url":"https://api.github.com/users/colinxfleming/gists{/gist_id}","starred_url":"https://api.github.com/users/colinxfleming/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/colinxfleming/subscriptions","organizations_url":"https://api.github.com/users/colinxfleming/orgs","repos_url":"https://api.github.com/users/colinxfleming/repos","events_url":"https://api.github.com/users/colinxfleming/events{/privacy}","received_events_url":"https://api.github.com/users/colinxfleming/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/colinxfleming/dcaf_case_management/labels/priority","name":"priority","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-12-06T21:55:48Z","updated_at":"2015-12-10T05:17:56Z","closed_at":null,"body":"Since we've settled on Rails, I think the next major architecture decision we need to make is how to store our data securely and accessibly. DCAF is able to spend some money in order to outsource the security component of this rather than rolling it up from scratch, so cost should be a factor but we shouldn't just take the closest, free-est option and hack that into what we need. (If we have to spend like $25-50 a month for a solution then DCAF can swing that without issue). \r\n\r\nMy wishlist for this, more or less in order: \r\n* Extremely secure (we are storing very sensitive information, after all)\r\n* Well documented\r\n* Able to provide a separate, distinct account for every case manager\r\n* Has a ruby wrapper \r\n\r\nHere are two options for secure-looking data storage that look like they might be a very good fit:\r\n\r\n### Salesforce Nonprofit edition \r\nhttp://www.salesforce.org/nonprofit_product/nonprofit-editions-pricing/ \r\nThis is a lot of firepower but they have a REST API we could use to store and retrieve info without that much of a hassle. They limit us to 10 accounts before we start paying a premium of $30/m per user, so our CM corps is too big to have one SF account per user. \r\n**Benefits**: Free if we share Salesforce accounts between users, other funds are using Salesforce and have an okay time with it, Salesforce is pretty well documented, seems to be pretty hardcore about security\r\n**Drawbacks**: Cost-prohibitive for individual user accounts, though we could roll our own with `devise`\r\n\r\n### Firebase\r\nhttp://www.firebase.com\r\nLooks kinda like a separate database-only service, with pretty flexible rules. Seems good about security and encryption, and perusal of the settings page makes it seem like making things inaccessible to certain users after a given amount of time is trivial. \r\n**Benefits**: There's a ruby wrapper for it, affordable option, security doesn't seem to be an afterthought, googling 'firebase security breach' didn't turn up anything\r\n**Drawbacks**: Might be tough to figure out how to use -- don't know how good the documentation is\r\n\r\nOther stuff I found by googling but don't know anything about, which might be good to investigate: \r\nhttps://parse.com/\r\nhttps://fanout.io/\r\n"},"comment":{"url":"https://api.github.com/repos/colinxfleming/dcaf_case_management/issues/comments/163489553","html_url":"https://github.com/colinxfleming/dcaf_case_management/issues/18#issuecomment-163489553","issue_url":"https://api.github.com/repos/colinxfleming/dcaf_case_management/issues/18","id":163489553,"user":{"login":"colinxfleming","id":3866868,"avatar_url":"https://avatars.githubusercontent.com/u/3866868?v=3","gravatar_id":"","url":"https://api.github.com/users/colinxfleming","html_url":"https://github.com/colinxfleming","followers_url":"https://api.github.com/users/colinxfleming/followers","following_url":"https://api.github.com/users/colinxfleming/following{/other_user}","gists_url":"https://api.github.com/users/colinxfleming/gists{/gist_id}","starred_url":"https://api.github.com/users/colinxfleming/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/colinxfleming/subscriptions","organizations_url":"https://api.github.com/users/colinxfleming/orgs","repos_url":"https://api.github.com/users/colinxfleming/repos","events_url":"https://api.github.com/users/colinxfleming/events{/privacy}","received_events_url":"https://api.github.com/users/colinxfleming/received_events","type":"User","site_admin":false},"created_at":"2015-12-10T05:17:56Z","updated_at":"2015-12-10T05:17:56Z","body":"@Kevin-Wei I'm into the symmetric encryption idea, and into the idea of using Mongo! I haven't used nosql before but have always meant to -- I'll do some reading up on it this coming week. Thank you very much for the suggestion!\r\n\r\nI'm a little curious about the security aspect, since it's like the first question the DCAF board will ask about -- want to make sure that keeping patient data safe and private is as baked into the process here as flexibility and rapid development. Are you recommending we roll with Mongo at first and then swap to something else once we're past prototyping, or going with mongo the full way thru? "}}