Derek Johnson CTO of Lawlytics

(Joel Beasley at 00:00:00) Today, we are talking to Derek Johnson. He is the CTO and co-founder of Lawlytics, a legal software company. They are absolutely knocking it out of the park. And let me break this down for you. Derek and his co-founder self-funded a multimillion-dollar company and their initial product assumption was wrong.

(Joel Beasley at 00:00:20) But they listened to the market, they adjusted, and now they are thriving. So grab a beer, relax, and get ready. This episode is overflowing with value right here, right now on the Modern CTO Podcast. Here we go. This is the Modern CTO Podcast.

(Joel Beasley at 00:00:45) Holy crap. Time goes by fast.

(Derek Johnson at 00:00:51) Yes, it does. Well, if it's been seven years, then I've known you for a decade now. We've known each other for a while. In fact, I was thinking about how we started and where that was. And it's an interesting tale.

(Joel Beasley at 00:00:59) Yeah. One best left unsaid.

(Derek Johnson at 00:01:02) Sure. I think so. Yeah.

(Joel Beasley at 00:01:05) So the things I really know about you are that you went from developer to CTO and that you're absolutely killing it. You're a CTO of a multimillion-dollar company, which is fantastic. You did all that growth without a significant amount of venture funding, right? It's primarily founder-funded with their own capital, which is unbelievable because nowadays, everyone's taking tons of funding just to get the idea out. Where you guys used your own money and put up your own risk, and you made it work, and now you've got how many people?

(Derek Johnson at 00:01:45) We have just under 500 law firms.

(Joel Beasley at 00:01:48) Oh, that's unbelievable, man.

(Derek Johnson at 00:01:50) And I should clarify, it wasn't exactly my money. It was the money of my co-founder, Dan.

(Joel Beasley at 00:01:54) Yeah. Who's a fantastic guy. I know him well.

(Derek Johnson at 00:01:56) He's a lovely guy. Yeah. And this was sort of his idea. And had it not been for—actually, had it not been for you introducing me to Dan—we would not be having this conversation today.

(Joel Beasley at 00:02:07) I love it, though. You guys are great, and you were a perfect fit. In my mind, I was like, "Alright, Derek and Dan, they would do great things, put them together," and high five, wish the best of luck. And it just turned out awesome.

(Derek Johnson at 00:02:17) Yeah. Unbelievable.

(Joel Beasley at 00:02:18) So your background: developer, CTO. Now I have been reaching out. I have over 1,500 pre-registrations for the book in this podcast from developers to CTOs of mid-level startups—ten, fifteen people—all the way up to CTOs of Fortune 500 companies with 600 plus employees. Right? So that's kind of the audience, the range of these 1,500 plus pre-registrations for the book and the podcast. So from that, I have gotten an enormous amount of feedback because I've reached out to every single one of them by email. It's been a monstrous task. Right? I'm doing 50 to 100 emails a day. Every single person, I look them up, see what they're doing, write them a personalized message saying, "Hey, this is pretty great what you're doing. And here's the CTO podcast that we're doing. And if you have any experiences, write back." So people have been writing back to me. And the stuff that they're saying is unbelievable because your experience from developer to CTO—everyone's writing back to me saying, "Joel, I don't know if my experience would be valuable to you in the podcast. I have an atypical experience, a non-standard experience where I went from being a developer to being a CTO." I'm like, it blew my mind. They think that that's become more common than not.

(Derek Johnson at 00:03:49) So what did they think the process should be?

(Joel Beasley at 00:03:54) I don't know. You go the 1950s: you go to college and some mean professor teaches you, and you go out into the world and use the branded education you got and try to get a job as a C-level executive in technology.

(Derek Johnson at 00:04:15) I suppose it depends on the company because it's really easy to be a CTO for a three-person company because you're really the only one who knows how to develop anything and everyone else is there just for different purposes. But, you know, naturally being a CTO for a company that's 500 people is probably a completely different experience and likely a very different path to getting there.

(Joel Beasley at 00:04:42) Right. Which begs the question: is the developer at the three-person company who's acting as the CTO—are they the best fit to become the CTO when the company hits twenty, thirty, fifty people?

(Derek Johnson at 00:04:57) Yeah. Almost certainly not. Unless the progression is very slow, and they've been riding it out the entire time. So if they're responsible themselves for the growth, then absolutely. But if it's because they have just a really great marketing department—I'm sorry, marketing department—or because they have a great sales department or both, then perhaps not. It may get out of hand, you know. The company may grow so quickly, and they're just not fit for managing such a large company that's that's pretty demanding of the technological needs.

(Joel Beasley at 00:05:32) Dude, that's way awesome. That's a completely unique perspective, and that's exactly why we're doing the podcast because I didn't think of that at all. So what you're saying is that based on the experience that they have during the growth, that's going to position them or determine if they are able to assume that role.

(Derek Johnson at 00:05:54) Right. Yeah. I mean, I think it's presumed that they contributed enough to deserve that position. You know, in a way, it's because of them that they're in that position because the product is so great or the technology is so great that people are just banging down the door to get it.

(Joel Beasley at 00:06:13) Right. So are you involved in the business direction decisions from the beginning as the CTO?

(Derek Johnson at 00:06:20) When you're a co-founder, you kind of are, naturally. And that's how we started. We started with two people, two co-founders, and not another human being. So yes. In that case, yes. But if you are brought on as a CTO to a company that's already sort of established itself, you may not. You may only focus on the technology. So I think it's different when you're a CTO versus being a CTO and co-founder.

(Joel Beasley at 00:06:47) I agree. Yeah. Because if you're there and you're present during those critical business decisions and you're contributing to them, that's way different than just being the developer and being off in your dark hole making the application and only worrying about that and completely shutting out the outside world.

(Derek Johnson at 00:07:03) Yeah. I know very few products that would be able to sell themselves on the technology alone. You know, there's so many—and I wish I had known this when we started—there are so many other components to it that are so much more difficult than the technology, such as marketing and sales and support, all the customer-facing stuff. You know, we wanted to be a SaaS product at the beginning. And naively, we thought the SaaS product equals customers pay and they never talk to you. Well, that couldn't be further from the truth. Just because you have a product that is online only doesn't mean you don't have to have a superb support staff on top of it to help people out.

(Joel Beasley at 00:07:44) Yeah. And you know, that's one of my biggest pet peeves when I do quotes for people for apps. So they feel like because it's an app or because it's a technology SaaS product that you bypass the other—the fact that it's a business, right?

(Derek Johnson at 00:07:59) Like, it's somehow an easier business to have a SaaS product versus, you know, a tire repair shop or whatever.

(Joel Beasley at 00:08:07) Exactly. And the only time that I would believe there's truth to that is what I call "utility apps."

(Derek Johnson at 00:08:14) Mm-hmm.

(Joel Beasley at 00:08:15) And that would be your file conversion style apps, you know, the small little thing, nothing that's going to be generating significant revenue.

(Derek Johnson at 00:08:23) Well, that's the thing is those aren't really businesses.

(Joel Beasley at 00:08:26) Right. But what I think happens in the market is that they apply that utility idea to things that actually need full business support.

(Derek Johnson at 00:08:34) Sure. Yeah.

(Joel Beasley at 00:08:37) I just see that happening. Now what do you think—here's a good one. I have been looking, recruiters just bombarding my LinkedIn. It's an epidemic, right? And they are always sending me job posts. So "if you know anybody," whatever, "Hey, dude. I'm not doing your job for you. Right? You know, you find your people. You're not getting into my friends and bothering them as well."

(Derek Johnson at 00:08:59) Right.

(Joel Beasley at 00:08:59) So I see a lot of CTO job postings. And what I'm noticing is that a large number of them want the CTO to be programming full-time at an existing company where their size is 20 people. Now, what do you think about that?

(Derek Johnson at 00:09:18) Well, it's kind of silly. How many developers?

(Joel Beasley at 00:09:23) Let's just say that the company is large enough to support 20 employees as a business staff, right? So let's say six of them are engineers.

(Derek Johnson at 00:09:32) Yeah, full-time. I just—you know, as a CTO, I do still write code because I enjoy doing it and I don't think I'll ever give that up. But at the same time, it cannot be my full-time job. It just can't. You know, there's so many other aspects to being a CTO which is quality control, onboarding new developers, making sure the platform is something that developers actually want to work on, and you can't do any of that if you're writing code. So writing code full-time as a CTO seems a bit odd unless it's a startup that has existed for a year or so. But beyond that, I would be concerned.

(Joel Beasley at 00:10:20) Yeah. And that's what—that's where my mind went. So two things are happening. The first one is that they may have 20 people and be that size, but if they want their CTO to program full-time, they don't understand what they need. Right? Because if you put a job posting for a CTO that programs full-time, you need another developer.

(Derek Johnson at 00:10:41) Right. Well, that should be their first job as CTO would be to build the development team.

(Joel Beasley at 00:10:46) Exactly. That, or they have a large staff, and because—to be honest, I didn't know how many developers. I just guessed, "Let's say four to six." But they may—another thing that they may have is they may have a large infrastructure, a large company staff, but they have maybe one or two developers or the CTO previously was a single developer with an assistant, right? And that's a red flag to me. Because if you have a company large enough to support 20 employees and you have that sort of cash flow and you are not reinvesting into your product at the rate of four to six engineers—you're a product company, you're a technology company—and that should be at least 30% of your budget at the minimum. Right?

(Derek Johnson at 00:11:33) No, I couldn't agree with you more. In fact, even thinking about a 20-person company that's a SaaS product, and they only have one engineer—I mean, that's ludicrous. That's fictional, I hope. And maybe—maybe it's because engineers, you know, this is definitely something that we've struggled with for many, many years—and maybe it's because engineers are more expensive rather than hiring a support staff member, for example. So let's say you have a problem or you have a task that needs to be done for every new customer that's onboarded. You can either have a—you can hire a support person, you know, a human being to do that task manually over and over and over, which is obviously not very scalable. Or you can hire the engineer who builds an automated way to solve that problem. And it's just—I think it's easier. It's cheaper to hire a support staff or a temp, you know, or something like that than to recruit a new engineer. That's maybe the bottom line.

(Joel Beasley at 00:12:43) So I want to give the listeners some context because you're giving out some awesome—you're dropping knowledge bombs, right? You're sharing your experience. And we understand that you're legal software and you're CTO and you went from developer to CTO. But how many employees—you have about 20 employees at your company, right?

(Derek Johnson at 00:13:01) I think we have just under 20. Like, 19. Yeah.

(Joel Beasley at 00:13:04) Okay. With around 500 clients. Now what is your composition like? You were there from the beginning. Kind of tell me about when you brought on people and then where you're at right now as far as your whole company, your developers, your support staff. Can you kind of give me a little story about how the growth—

(Derek Johnson at 00:13:23) Sure. Yeah. Yeah. I'll try and keep it short. So the product that we have, the easiest way to describe it to technical people, which I assume will be listening to this, is it's a content management system tailored for attorneys. So unless you're a law firm, you have no interest in our content management system. If you are an attorney, you probably should be really interested in it. But so we started out with the idea that we could build a product that would eradicate any need for a web designer. You know, some highly trained person who builds websites traditionally from a web agency. So we wanted to eliminate that need and we thought we could build a CMS that would do that. We were wrong. We were absolutely dead wrong. It turns out that you need either a spectacular product, something that dozens and dozens of engineers and product designers are working on to solve the problem of web design, or you just have to be a traditional web agency. And currently, we're kind of in between. So now we have two designers, we have two developers, so it's still a pretty lean team. We have three support people. They're the ones that are answering support tickets and answering the phone when someone has a question. Then we have—and this is the interesting thing. As you're probably aware, a website without content isn't very good. And a lot of attorneys don't really have time. Some of them do, and that's great. But a lot of them don't have time to write their own content. So after years and years and years of them asking, "Do you write content? Do you write content?" And telling them no, we're just the product. We're just the product. Eventually, we caved and built a content division that services customers who frankly don't have the time or the ability, you know, to write really compelling content that's specific to their law firm. So that's where about six of the staff members are. So we have six people in content. We've got three people in support, two designers, two developers, a CTO, and a CEO.

(Joel Beasley at 00:15:25) Excellent. So how long after you started did you bring on your first—so it started with you and Dan. And when did you bring in your first person and why?

(Derek Johnson at 00:15:37) We immediately started recruiting designers because we knew that the customer facing—the websites that our CMS is producing, you know, they needed to look good. And I was obviously busy building the product. I couldn't build the sites that the product generated, unfortunately. So I think we recruited right away for designers. And we had two designers, you know, they were pretty new. They didn't really innovate for us. We weren't really looking to them to innovate. When we first hired our first innovator, I would say it was a good two years into the business. And I should clarify that the product didn't actually go into production until maybe a year and a half after that. So six months after production, that's when we started recruiting for innovative people.

(Joel Beasley at 00:16:28) Interesting. So how long from the day you wrote your first line of code till you had your first user, like test user, person actually deploying it into production?

(Derek Johnson at 00:16:37) Right. Yeah. We released into beta about a year and a half after we started development and started the business. Fortunately, my cofounder, who was an attorney for many, many years, has many, many contacts, other attorneys that are friends with him, and he had been mentioning that, you know, we're working on this product and it'd be great for you. And there were just attorneys that were chomping at the bit to participate in the beta.

(Derek Johnson at 00:17:05) So I think we had 10 to 20 people in the beta. And when I say beta, not the traditional beta, because this actually was their website, you know, which as an attorney—frankly, as any business I think today—your website is pretty critical. And these people were just willing to sort of try it out, and it worked out great for them.

(Joel Beasley at 00:17:28) Excellent. And then, so I'm a big preacher, right, and proponent of saying release your beta as quickly as you can and get people on it in the most basic form, and then let those people tell you what to do. Right? And you guys have had success with a long initial build time. And so I'm curious as to, was that intentional, or how did that come about?

(Derek Johnson at 00:17:53) Intentional. Intentional in the sense that we were cheapskates, you know. We were trying to—we bootstrapped the whole thing. We were trying to do it with a very low budget. You know, we couldn't—we didn't raise any money. We couldn't go out there and pay engineers a $140,000 salary. So I guess it was intentional in the sense that we were trying to do it on a shoestring budget. I hope that's a real expression.

(Joel Beasley at 00:18:23) That's a thing. Okay. Good. Good. Yeah.

(Joel Beasley at 00:18:25) I've got two of them on my body right now.

(Derek Johnson at 00:18:26) No. Good. Yeah. I'm actually not wearing any shoes.

(Joel Beasley at 00:18:29) Oh, excellent. Yeah. It would only be awkward if they weren't below my ankles. So—

(Derek Johnson at 00:18:34) Right. Right.

(Joel Beasley at 00:18:34) Yeah. Um, what is that?

(Derek Johnson at 00:18:38) I don't know. But we're gonna edit it out. I'll tell you that much.

(Joel Beasley at 00:18:40) Definitely editing that out. It's like a dad joke, but, like, really, really bad.

(Derek Johnson at 00:18:46) You do have a mustache right now, I imagine.

(Joel Beasley at 00:18:50) I—the listeners—or goatee? Goatee? It is imperative for the listeners to understand that I have no facial hair.

(Derek Johnson at 00:18:58) And his shirt is not tucked in, he swears.

(Joel Beasley at 00:19:02) I do have a pocket protector. Oh, jeez. No. But, man, I find myself making more dad jokes now that I have a little bit of a girl.

(Derek Johnson at 00:19:09) Well, you have an excuse. Right?

(Joel Beasley at 00:19:11) Yeah. So it's like, you got an 11—I've got an 11-week-old baby girl, and that thing has, like, completely changed my life. Alright. I've got a couple more questions before we wrap this up, because, you know, we messed around at the beginning, so I'm not sure—

(Derek Johnson at 00:19:24) Well, at least we got it. Yeah. Yeah. We got it right.

(Joel Beasley at 00:19:26) Um, when did you realize, like—so as a CTO, when you're in that developer growing, there becomes this skill you have to cultivate or develop where you learn that you're overwhelmed, and this is the moment when you need to bring someone on. You need to clone yourself. Right? I need to clone to execute this process for me, and then I will make sure that process is operating. And then you free up a chunk of your time for you to make yourself busy or doing other things to grow the product and business, and then you get overwhelmed again and you hire someone. Uh, when was the first time that you knew that you felt, like, I'm overwhelmed, I need another assistant developer to come in here and write some stuff for me?

(Derek Johnson at 00:20:08) I would say it was after we went into production, after we started receiving, you know, customers—new customers, non-beta customers, like actual paid customers. I think once we reached even 50 customers, as you imagine, the more customers you have, the more bugs are discovered, the more features are requested. Absolutely. So you are kind of bombarded at that point when you have a lot of people using the product. I mean, if you've only got three people using the product, they might not find everything and it may not be that big of a deal. But, yeah, certainly the more customers we had, the more pressure I felt. And, uh, yeah, that's when we did it.

(Joel Beasley at 00:20:55) Excellent. So you felt the pressure. You identified it. You pulled someone on board. You delegated some tasks to them. How did you, uh, when you hired that person, what were you hiring? Were you hiring junior, mid, senior? What were you looking for?

(Derek Johnson at 00:21:07) You know, our history is so atypical. I'll tell you—I'll answer your question, but it might not be helpful. So, um, the developer right now who's sort of my right-hand man, someone I trust with writing all the code—you know, if I left tomorrow—his name is Sean. And believe it or not, he started as a junior web developer. He's currently now at the VP status after, I wanna say, he's coming up on his third anniversary. So it took him like three years. But the thing about hiring is it's so fucking hard. It really is. You know, you've gotta sift through a bunch of shitty developers. Am I allowed to say that?

(Joel Beasley at 00:21:52) Yeah. You're allowed to say that.

(Derek Johnson at 00:21:53) Okay. Good. And it's really draining. You know, at the end of the day, it's very discouraging when you're seeing developer after developer and they all start out with, you know, I'm the best, I'm awesome, I'm perfect for this job—fucking perfect. And they never are. So, um, we were hiring, uh, basically we're hiring a senior position and a junior position. We hired Sean in the junior position, and I knew right away that this guy was too smart to be a junior for very long. Um, and he was only a junior developer because he had just started Rails development. You know, he already knew everything about the web. He'd already known how to build websites and he knew different languages, but we wanted Rails, and he was brand new to Rails. So he had just done one of those three-month accelerators or whatever those things are, and it's worked out great. So I think the lesson from that is, even if you hire at the lower level, if you find bright people—like, really incredible people—you know, hang on to them. Never let them go.

(Joel Beasley at 00:23:03) Oh, 100% agree. Those people that have that spark, uh, it's hard to verbalize, but when you see it, you know it. Yeah. And you grab on and you invest in your people, you know, and then you grow your company on a solid foundation. You know, if you get—I love one of my favorite things, I feel like a broken record because I've been saying it so much since doing this book and all this content—is, uh, you get a B team, you get B results.

(Derek Johnson at 00:23:30) Yeah. Oh, absolutely.

(Joel Beasley at 00:23:31) It's just so true. If—I was speaking at a conference in Brazil yesterday over video conference, and one of the things I talked about was, uh, you know, hire the expert. Right? That's, like, if I could go back in time and talk to myself previously, I'd say, look, hire experts off the bat. And that doesn't necessarily—like, when you're talking about Sean, right, um, he can be an expert and just have a low amount of experience in that one category.

(Derek Johnson at 00:24:02) Right. Right.

(Joel Beasley at 00:24:02) But if he acts like an expert, if he has the qualities and the traits and the habits of an expert, right, then that makes all the difference in the world. And then I published an article last night after doing that talk and thinking about it that talked about validating experts. Right? Because that's something that we don't talk about a lot. If you go—you can read management. I've read a lot of books. Like, I'm a big fan recently of reading tons of books, and never once have I—

(Derek Johnson at 00:24:32) Just recently. Never before. Yeah. About five years. You just learned to read. Okay.

(Joel Beasley at 00:24:38) Uh, no joke. I have read—before 2010. Okay? Before 2010—

(Derek Johnson at 00:24:46) Mhmm.

(Joel Beasley at 00:24:47) Um, and I'm, like, what? 21 then? Before 2010, I had read one book of Goosebumps.

(Derek Johnson at 00:24:57) A great series. I don't mean to—yeah. That's a fantastic series.

(Joel Beasley at 00:25:02) I think it was a 62-page book or something like that. And then the book Ender's Game.

(Derek Johnson at 00:25:08) Oh, one of my favorites.

(Joel Beasley at 00:25:10) Yeah. The only—Oh, wait.

(Derek Johnson at 00:25:11) I might have loaned that to you, actually.

(Joel Beasley at 00:25:13) You did not. Okay. We talked about it because I saw it on your bookshelf, and it was, like, that's when I found out that there was a—it was a series. Right. Right. Right. Right? So, um, alright. So, man, you gave lots of valuable experience. And that's the thing that I don't think was being understood when I was reaching out to people is that your experience, the truth of what you went through, is the value. People say, I don't have value, I just have this story about this. That's the value. Uh, I really want to be a billionaire. That's, like, a huge thing, and it's not about money. There's nothing I want to go buy. Right? I just believe that this is like a game. This life is like a game, and there's points, and the points are money. And I wanna get my points as high as possible in the game.

(Derek Johnson at 00:26:05) Right? Sure. I know a lot of people would disagree with that, but—

(Joel Beasley at 00:26:09) 100%. And that's perfectly fine. So—

(Derek Johnson at 00:26:11) Yeah. Yeah.

(Joel Beasley at 00:26:13) So what I decided to do was I took, like, a monkey see, monkey do approach. Like, if I wanna be a homeless crackhead, I can go inject drugs into my veins. Right? Right. Right. So I go to myself and say, hey, if you want to be a billionaire, if you want to simply, you know, create as much impact as you can in life, you have to go look at the monkeys that are doing that and see what they're doing and then do that. So I went and, rather than reading, like, a business book of, like, you know, just be business-y, that would be, I guess, the standard route, I took the route of reading the life stories of the billionaires so I could understand who they are as humans. Right? Yeah. Yeah. Because you can give me a list of management skills, and that does nothing for me if I can't, you know, derive who you are as a person and how you think.

(Derek Johnson at 00:27:02) Sure.

(Joel Beasley at 00:27:03) Yeah. So I read, you know, those books—Elon Musk, Richard Branson, Jeff Bezos. And one of the things that I noticed between all of them is that they had a lot of struggle. Right?

(Derek Johnson at 00:27:13) Of course. Yeah.

(Joel Beasley at 00:27:14) Yeah. And, you know, have you identified, like, uh, like, what have been the tough parts of the struggle in your business and your growth that have made you wanna say, look, there's some days when you wanna quit. I don't care who you are and what you do. There's some days where you just wanna be like, fuck it. Like, I'm done. And, like, what are—like, how's that happened to you? And don't you lie. And then, and then what did you do? How did you deal with that? How did you process that?

(Derek Johnson at 00:27:44) Yeah. I wish I could tell you how I dealt with it, because I still haven't. Um, uh, number one thing for me is, um, is working remote. When I started out, it seemed like such a glamorous thing. You're gonna let me work from home? You mean I don't have to, you know, dress up? I don't even have to comb my hair? Um, you know, seven years later, it's not—it's not as fun. You know? I find myself at the library or at Starbucks, you know, because it's—it's being around other people. You know? There's something about being around other people, even if you're not talking to them. You know? It's the sense of claustrophobia or the sense of I just can't be in one place. It also ruins your house, by the way. You know? You can't come home from work and enjoy your house because you're coming home from your house. So, um, anyone who feels that they're working from home and they don't like it, find a co-working space, you know, or at the very least, go to your public library. Your taxes are already paying for it. So, um, yeah. So working remotely is difficult for me. Um, I just—and I should explain our actual brick-and-mortar office is in Tucson. You know, it's in Arizona, uh, and I'm in Florida, and I'm just not a big fan of deserts, you know, so that's why I haven't moved out there. So, uh, yeah, other than remote working, I would say, oh, jeez. Um, I haven't had any other struggles.

(Joel Beasley at 00:29:22) Alright. So the struggle—Just kidding. So for you, when it comes to remote working, the struggle is real when it comes to the human factors.

(Derek Johnson at 00:29:33) Yeah. So I'm not married. You know, I don't have any kids running around. So it's basically myself here and my dog occasionally goes from my bedroom to the couch and back and forth. And that's the real entertainment that I have here. I love Alice. Yeah. She's a great dog.

(Joel Beasley at 00:29:53) Yeah. I wish I had a little, uh, like, sound effect for, like—

(Derek Johnson at 00:29:58) Yeah. Or her barking. Yeah. But I should say, um, uh, another struggle is, um, disagreeing with your cofounder. You know?

(Joel Beasley at 00:30:05) Oh, that's a big one.

(Derek Johnson at 00:30:06) It hasn't happened in a long time, fortunately. But I would say, you know, the first three years, when you're getting to know this person, when you're getting to work with this person on a full-time basis, you know, you will have disagreements. And it's kinda one of those choose your battle things, you know. It's almost like being in a relationship. Is this really worth arguing over? And for the—you know, mostly it wasn't. Um, but all that kinda just disappears, you know. You become friends with the person, hopefully. You become friends, you know, you wanna spend time with them, you wanna talk to them. And fortunately, that's where we're at today.

(Joel Beasley at 00:30:44) No. That's excellent. Yeah. It's definitely a relationship and it follows all the same rules of a relationship—

(Derek Johnson at 00:30:51) Yeah.

(Joel Beasley at 00:30:51) —just without the sex.

(Derek Johnson at 00:30:54) No sex. Yeah. There's no upside. Right. Especially if your cofounder is an attorney.

(Joel Beasley at 00:31:03) Right. Right. Definitely don't wanna bring that in. Uh, but real quick. So it's December right now. Yesterday I was sitting down thinking about how I made my money this year. Okay? Very odd. It's very atypical. At least to me, it's atypical for me. Other people might be listening to say, oh, that's how I make money.

(Derek Johnson at 00:31:21) I do that all the time.

(Joel Beasley at 00:31:23) People call me up out of nowhere. Sometimes the 911-type situation where their CTO has hijacked the company, or a situation where their shareholders found out that the system they were building didn't exist and the invoices were faked and, like, huge amounts of money were lost. Uh, situations where IP was completely lost. Like, they had catastrophic system failures and they were old school with internal servers. They didn't have redundant backups in the cloud and, like, all of this stuff. So those are actual things I accepted money for this year to deal with. Right?

(Derek Johnson at 00:31:51) Wow.

(Joel Beasley at 00:31:51) So, and for the emergency stuff, it's great because those cost the most. Right? So I wanted to put together value. Like, so my goal with this podcast and this book is to share everything I know for free. I don't want anyone to have to pay me for, like, learning this knowledge. Right?

(Derek Johnson at 00:32:14) Sure.

(Joel Beasley at 00:32:14) I just wanna deploy it at scale, and then they'll say, alright, Joel's smart. Let's talk to Joel if we need him to help us with any of this stuff. So the thing I came up with to provide value to CTOs was this thing I call—uh, came up with it yesterday, so it's new. It's fresh.

(Joel Beasley at 00:32:30) So feel free to laugh at it. I call it the Year-End CTO Audit Checklist. Oh, okay. And it's very long. It is very long.

(Joel Beasley at 00:32:39) So our PR department will—we need Jenny. This girl is amazing. Our podcast producer is Jenny. She's from Australia. She's moving to New York City December 5th.

(Joel Beasley at 00:32:49) Oh, no. Because she's got a ton of clients.

(Derek Johnson at 00:32:51) Sounds like, yeah, sounds like she's probably busy today.

(Joel Beasley at 00:32:53) She's super busy. So she is fantastic putting all this together, and everyone listening or everyone that's has been on the podcast knows because they interact with her. But she is fantastic, producer at moderncto.io, if you wanna be on the show. So I put together this, the CTO checklist for auditing, so that you don't need me, so that you can do these basic things. And so I'm gonna run them by you.

(Joel Beasley at 00:33:20) Okay. Alright. And then you tell me, make fun of them or do whatever you want. Give me your honest opinion of them, and I'll definitely explain why. So the first thing I have on here is things that a CTO should be doing is making sure that all the repos—if they're a product company—I mean, everyone's a product—everyone has technology as a product in their company.

(Joel Beasley at 00:33:40) You can't be a tech company without it. Right? I think it's fair to say that 80 to 100% of all the companies have a Git repo or some equivalent of it. Right?

(Derek Johnson at 00:33:52) I mean, I would hope.

(Joel Beasley at 00:33:54) Okay. So on the audit checklist, this came from a specific issue that we had earlier this year, is a developer had cloned a repo, but he cloned it in his personal developer account and then included it in the project. So it was pulling the cloned repo from his account, and his account went offline. He deleted that repo after he had left the company, and then that company had trouble building the repo when they were building.

(Derek Johnson at 00:34:23) True story?

(Joel Beasley at 00:34:25) It's a true story. Okay. Yeah. So they called me, and I found a copy of the repo on their server. Right?

(Joel Beasley at 00:34:34) Because when you build it, it sucks it in. Right? And so then I took that repo out, and I put it back into their organization account and then linked to the new one.

(Joel Beasley at 00:34:45) Right? Because if they ever were to switch servers, that repo wouldn't be there to freshly pull in.

(Derek Johnson at 00:34:50) Sure.

(Joel Beasley at 00:34:50) Okay. So one of the things I have on the checklist is make sure that all the repos that you're dependent upon, that your developers have made modifications to or anything like that, that you have them outside of the personal developer's account and put them inside the organization's account. Right. So the organization has control over copies of those repos that have been modified that they need to build their applications.

(Derek Johnson at 00:35:17) Sure. Am I saying yes or no?

(Joel Beasley at 00:35:19) I'm just running it by you. Okay. Right. Do you have that situation? Do you have—if you brought a developer in, tell me what you do.

(Joel Beasley at 00:35:27) You bring in a developer on a contract on a special basis. Right? And they need a modification to a repo like Devise or just hypothetical.

(Derek Johnson at 00:35:35) Sure.

(Joel Beasley at 00:35:35) They clone Devise. They make the modifications. Right? It doesn't get back included in the master project because the pull request doesn't get accepted. Right?

(Joel Beasley at 00:35:42) So now you have this dependency of this repo in a contractor's personal account, and you're dependent upon that. Would you allow that to happen, or would you take that repo and put it into your organization's account so you can control it?

(Derek Johnson at 00:35:58) Well, I mean, if it's IP, you know, it needs to be protected at all costs, obviously. The thing is, there's a necessary amount of risk when you bring on a new developer because they will be cloning the repo to their own machine, you know. And we don't know what they're doing with that machine. They could be working at Starbucks and they could leave it there. They could be doing anything with it, you know.

(Derek Johnson at 00:36:23) But we do have an organization, and we would never allow—you know, these are private repos. We certainly don't want them to be public. So it would stay in the organization.

(Joel Beasley at 00:36:35) Perfect. So you would never allow a private or a modified public repo to sit on the developer's personal account. You would always bring it into the organization's account and make it private.

(Derek Johnson at 00:36:50) Yeah. Absolutely. Perfect.

(Joel Beasley at 00:36:51) Alright. So just the checklist of going through and making sure that these outside parties have come in and done work, that you're not dependent on that. So that is on the checklist. Another thing that's on the checklist is to make sure you have all of your intellectual property agreements organized in folders by people's names and that they're definitely backed up in a place where you're the only person that has share access to it. What do you think of that?

(Derek Johnson at 00:37:16) Yeah. I mean, I agree with it. It's not something that I do personally, but I agree with it. And by me not doing it personally, doesn't mean the company isn't doing it. It's just not me that's doing it.

(Joel Beasley at 00:37:29) So where is Sean's IP agreement?

(Derek Johnson at 00:37:33) I would imagine there's a printed copy in our CEO's desk, you know, in his file cabinet.

(Joel Beasley at 00:37:40) So the CEO—because he's a lawyer, he took the lead on the paperwork audit. That may have been the case. See. So for me, my partners aren't lawyers.

(Joel Beasley at 00:37:53) Right? They're more business and venture-type people. So they make it my responsibility to organize all the IP paperwork.

(Derek Johnson at 00:38:04) I see.

(Joel Beasley at 00:38:04) Anyone I have come and go. Because I'll have—you know, right now, I've got five different corporate clients with three to four developers on each project, and I see, you know, maybe two developers come and go every month based on the workload. Right?

(Joel Beasley at 00:38:22) Or the specialty that we need. Like, if we're doing some AR stuff, we'll have an AR specialist come in. Right? So I have to maintain these sets of documents and make sure that everything is signed, everything's organized, and everything's in its spot because those IP agreements, man, they'll kill you.

(Derek Johnson at 00:38:36) Yeah. But that almost sounds like administrative work.

(Joel Beasley at 00:38:40) Oh, that's a part of the CTO. Oh, well, I hate it. And, again, the CTO is—it's not, I don't wake up in the morning and stretch and be like, Paperwork. Paperwork. No.

(Joel Beasley at 00:38:54) And it doesn't even take me, you know, long at all. I just make sure that I go through and I have it. Right?

(Derek Johnson at 00:39:00) Well, I think the important thing is to, you know, retain that information, retain those agreements. How you do it may be irrelevant. Right.

(Joel Beasley at 00:39:10) Well, I have one—

(Derek Johnson at 00:39:10) As long as it's safe.

(Joel Beasley at 00:39:11) So these are based on true stories. Right? Yeah. So I had one guy who added all his IP agreements in a Dropbox, like, a technology Dropbox for his company.

(Joel Beasley at 00:39:21) But his number two and his number three were on the share.

(Derek Johnson at 00:39:24) Oh, okay.

(Joel Beasley at 00:39:25) Yeah. That's no good. That is no good, and things went south. So they were able to delete them. And if you delete the only copy—luckily, Dropbox had this feature and we recovered it, but it potentially was a large mess.

(Derek Johnson at 00:39:41) Yeah. No. That sounds awful because, you know, aside from the fact that they were trying to take those contracts and delete them, it sounds like there was some sort of dispute, you know, and that's never good.

(Joel Beasley at 00:39:55) That's never good. We like high fives and, you know, shipping products. We don't like disputes. Yeah. Yeah.

(Joel Beasley at 00:40:02) Number three on the list is one of my personal favorites and something I had to do, is making sure that all your alerts and alarms on all your devices for—like, whether it's Amazon or whatever—or for uptime, that they're all working properly and they're set up. Sure. Because, like, I'll give you an example. We had—we added a feature to one of our services at a company where we needed to actually host on its own EC2 instance this server, and then we would, you know, connect to it remotely. And someone forgot to follow our checklist and put an uptime alert on it, and it went down.

(Joel Beasley at 00:40:44) Oh. So I realized that these little things come and go. People have needs to boot up servers and pull them down whether they're testing something. See that? I think that's where they really get it is when developers—when they're trying something new, they usually will test a couple of open technologies, decide which ones they wanna go with.

(Joel Beasley at 00:41:00) Right? And I think one of the things that gets lost is the normal workflow of, like, alright. I tested it. I like it, and now I'm gonna integrate it in my production. Your mind isn't on those things of, like, setting up the alerts and the alarms all the time unless it's, like, right in front of you.

(Derek Johnson at 00:41:14) Well, it also depends on your architecture. For us, we're using Heroku still. Yeah. And a lot of that's just built in to Heroku. We also use New Relic.

(Derek Johnson at 00:41:23) I think between the two of them, not a whole lot gets past us.

(Joel Beasley at 00:41:27) Right. Perfect. So that's a great, you know, response to making sure your alerts—just going in there and making sure every year, I just like to go look. Sure.

(Derek Johnson at 00:41:36) Yeah. Do an audit. Yeah.

(Joel Beasley at 00:41:37) Yeah. Because, you know, they could update their systems and release some feature and have a new checkbox for you. Right? There could be some advancement that you need to know about, or they could have had an error in their data doing some sort of internal data migration where you're the 1% of accounts that the feature got flipped off for. Like—

(Joel Beasley at 00:41:54) Yeah. For sure. Not to scare people, but their stuff. I, once a year, number four, I back up my most prized important IP, the stuff that matters the most to me. I back it up offline.

(Joel Beasley at 00:42:10) I do. I know.

(Derek Johnson at 00:42:11) Sounds like a really good idea.

(Joel Beasley at 00:42:13) It's—I know. I've had people be like, uh, I'm on a triple redundant RAID. And I'm like, okay, bro. Look. It's a computer. Computers are vulnerable to, you know, anything.

(Joel Beasley at 00:42:25) So the things that are most important to me for my intellectual property, things that—think about it. All that code at your company, Derek, seven years, let's say, you know, 3 to $500,000 a year, you got a multimillion dollar code base. Sure. Okay. So, you know, what's the harm in just taking that text and putting it on an external drive?

(Derek Johnson at 00:42:46) Yeah. Yeah. No. We do off-site database backups. And by nature of that, we do have, you know, a copy of the source code, you know, where that backup code, you know, exists and operates.

(Joel Beasley at 00:43:05) Right.

(Derek Johnson at 00:43:05) So we do. To answer your question, yeah, we do have that.

(Joel Beasley at 00:43:08) And the purpose of this—But yeah. Is not for me to preach on how to do it. It's just—here's the checklist item. Whatever you're comfortable—I'm just bringing it to your attention. Hi.

(Joel Beasley at 00:43:16) I'm Joel. We're humans. We forget. Right? I'm just saying do a checklist item that your IP is backed up however you feel comfortable.

(Derek Johnson at 00:43:24) Right. Right.

(Joel Beasley at 00:43:24) You know? I usually just grab the backup of my backups. So you have, like, a list of previous backups. I usually just grab a full dump of the backup of everything that's important.

(Derek Johnson at 00:43:35) So we talking about database or code? Everything. Okay. Right. Yeah.

(Derek Johnson at 00:43:40) I mean, naturally, we do have database. Heroku has it built in and, and then we take those and we store them off-site as redundancy.

(Joel Beasley at 00:43:49) Right. Perfect. Yeah. Because then you don't have to worry about getting all the end of it. One of the things that takes really long to transfer is, like, we have all the individual files.

(Joel Beasley at 00:43:57) Right? And so it's way easier to just transfer a large backup, at least in my opinion.

(Derek Johnson at 00:44:01) Oh, absolutely. Yeah. They compress it down, and it's pretty quick. Yeah. And I said—

(Joel Beasley at 00:44:06) One of the ideas that came to me—I was like, I've had people give me, like, pushback on this, Derek. That's why I'm bringing this up. And they'll say, oh, you don't need to protect it, like, that much. And I said, have you seen how McDonald's, like, protects their fry recipe?

(Joel Beasley at 00:44:21) It's like in a—

(Derek Johnson at 00:44:21) How do they do that?

(Joel Beasley at 00:44:22) It's in a bank vault where, like, two people, like, the two of the owners have—it's like the equivalent of launching nuclear missiles, how it's stored.

(Derek Johnson at 00:44:31) For disgusting fast food.

(Joel Beasley at 00:44:34) Yep. Fried right to your face. Yep.

(Derek Johnson at 00:44:37) Are we allowed to say that? Is that a—

(Joel Beasley at 00:44:39) McDonald's is not a sponsor. Right. Okay.

(Derek Johnson at 00:44:43) But I mean—yeah. Yeah. Okay.

(Joel Beasley at 00:44:44) In fact, we are against diabetes. And so—

(Derek Johnson at 00:44:51) But we are sponsored by Blue Moon.

(Joel Beasley at 00:44:53) Blue Moon. Official—

(Derek Johnson at 00:44:55) We're not, but we would like to be.

(Joel Beasley at 00:44:56) Official sponsor of Derek's beverage. Friday afternoons. Friday afternoons. There we go. And then another thing I have here—we go.

(Joel Beasley at 00:45:07) Number five, review all your authentications across all your services and make sure that none of your previous contractors or developers or anyone that has had access that has come and gone have lingering access. I've seen this happen. Yeah.

(Derek Johnson at 00:45:22) Well, see, I would say that, you know, sort of the modern way that we do things with AWS and with Heroku, they make it super easy to cut someone off at a moment's notice. 100%. Yeah. So as long as you're using, you know, the IAM and you've got different users and they have their own permissions, you can act like they never existed.

(Joel Beasley at 00:45:44) Exactly. But I'm talking things like let's say you do a Facebook integration. Uh-huh. So you can log in with Facebook and—

(Derek Johnson at 00:45:49) Oh, right.

(Joel Beasley at 00:45:50) Yeah. Buried inside that, inside three submenus is a users list. Yeah. Yeah. Yeah.

(Joel Beasley at 00:45:55) That's what I'm talking about.

(Derek Johnson at 00:45:57) Right. Yeah. Delete those users. Yes.

(Joel Beasley at 00:46:01) I have people everywhere in my Google auths. Right? Multiple developers, people come and go from projects.

(Joel Beasley at 00:46:08) And it's not even that there's any sort of negativity or anything from them. You just—No. Not—It's like you lock your front door. Right? Right.

(Derek Johnson at 00:46:15) You well, you wanna be able to sleep well at night.

(Joel Beasley at 00:46:17) Exactly. So that's why I have just—I just go through my services. And the way I do it is by going to my billing often. Go to my billing, and I see what I spent money on, and I'll see, oh, look at that feature that we, you know, spent a block of, you know, a 150-hour block on. That was a Facebook feature.

(Joel Beasley at 00:46:32) I gotta go check the Facebook stuff.

(Derek Johnson at 00:46:33) Mhmm.

(Joel Beasley at 00:46:34) Yeah. And then the last thing is that I like to do, and it's not as technical as the other ones, but it's to review all the projects that have become stale. So, like, I don't know about you, but throughout the year, I start things and then, like, some business emergency will happen or some very distracting event will occur, and a project won't complete. It'll just be distracted by the incoming part of life, and it'll sit out there. And I like to go through and look at anything that has become stale, that didn't—I just like to do, like, a little cleanup.

(Derek Johnson at 00:47:15) Yeah, no, I think it's a great idea. I think the difference in what you do and what I do is, you know, we only have one product. You're working on several different products.

(Derek Johnson at 00:47:24) So when we create a feature, we try not to be distracted. That feature is going from start to finish no matter what happens. But there are definitely—we use Pivotal Tracker for our stories and keeping track of development. There are absolutely stories in there that are stale as stale can be, and there's just so much going on. It's hard to keep track of that stuff.

(Derek Johnson at 00:47:49) So I think it's brilliant, yeah, to take a moment and sort of analyze and see what you've got laying around. And if need be, delete it. Absolutely. Yep. So that's it.

(Derek Johnson at 00:48:01) That is—wow. I feel good. I feel really, really good. Now, are you going to have, like, is there a site for this?

(Joel Beasley at 00:48:09) Moderncto.io. Thank you so much for listening to the Modern CTO podcast. Share this. Get the word out. Thank you guys so much.

(Joel Beasley at 00:48:21) I couldn't do it without you. I appreciate it. You guys are the absolute best.