05 Risks¶
Source page: 05-risks.html
5. Key risks, build-vs-buy, and rejected alternatives¶
| Decision | Recommendation | Why |
|---|---|---|
| Workflow execution engine | Build on Oban Pro | BEAM + Oban covers durable multi-day flows natively; avoids embedding n8n (licensing, tenant isolation) or operating Temporal |
| Event backbone | Postgres transactional event log now; Kafka only on documented triggers | Transactional consistency between state and events for free; RabbitMQ rejected (queue, not log); building a distributed log in-house rejected outright |
| Analytics store | Timescale continuous aggregates now; ClickHouse on documented triggers | One database at v1; reporting behind a repository interface keeps the later swap mechanical |
| System of record | Postgres — Cassandra and SurrealDB rejected | Transactions, joins, and ecosystem (Oban/pgvector/Timescale/RLS) are load-bearing; alternatives forfeit them for scale or features this product doesn't need |
| Public API surface | GraphQL-primary + thin REST facade | One schema as source of truth; REST facade + webhooks keep long-tail integrators (Zapier-class, suppliers, agencies) low-friction; GraphQL-only rejected for partner-ecosystem friction and query-cost tooling burden |
| Visual automation canvas | Build (React Flow) | Differentiating UX; runtime underneath is Oban |
| E-signature audit trail | Buy (Dropbox Sign/Documenso) | Legal defensibility is not a place to innovate |
| QuickBooks Desktop sync | Buy or partner if possible | Notoriously painful; a known company-killer to underestimate |
| Mobile offline sync | Build carefully | Off-the-shelf sync rarely matches per-tenant custom-field schemas |
| Hiring | Plan explicitly | Elixir talent is excellent but scarce; recruiting strategy is part of the architecture decision |
| GenAI strategy | Local purpose-tuned LLM (Apache-2.0/MIT weights preferred) behind an adapter interface | Hedges the unknown future cost/stake of hosted LLM APIs; costs shift from variable API spend to fixed GPU hosting + tuning/eval burden; adapter keeps a hosted-API escape hatch and enables side-by-side evals |
| Data licensing & retention | Negotiate perpetual rights to appended records before signing enrichment contracts | Retention terms on provider exit vary by contract; field-level lineage enables surgical purge either way. Have counsel review — not legal advice |
| Outreach compliance (TCPA/CAN-SPAM) | Cold outreach via mail + ads only; text/email reserved for engaged or consented contacts; send-time DNC checks | Texting appended numbers without consent is the classic contractor lawsuit; suppression is architecture, not policy |
| Lead routing / resale | Legal review before routing or selling leads outside the company | Can trigger state data-broker registration and privacy-policy obligations; provider contracts often prohibit resale of appended data |
| License drift | Review licenses at every major upgrade | Terraform, Sentry, RudderStack, Redpanda, and Timescale all moved from open source to source-available in recent years; "was open source when we adopted it" is a live supply-chain risk (see §6) |