Lend Academy Network Forum

P2P Analysis/Investment Sites => BlueVestment => Topic started by: Nathan on August 21, 2014, 03:52:19 PM

Title: The end of BlueVestment?
Post by: Nathan on August 21, 2014, 03:52:19 PM
Attached is the new Lending Club Commercial API Access Agreement.

This is what was sent to myself and a few others yesterday by Lending Club's VP of Retail Investing. I encourage you all to read very carefully. The new agreement for the individual users to sign is almost a copy paste of this. I would like to point out a couple of points which I (as the owner of BlueVestment) am unable to agree to:

"You have instituted adequate and appropriate safeguards and precautions to ensure the security of data and information that you send to or receive from the Site, whether through the API or by other means. You will maintain sufficient procedures to detect and respond to security breaches involving such data and information and agree to inform Lending Club as soon as practicable when you suspect or learn of malicious activity or any other security breach involving such data or information and to take corrective action. You agree to provide Lending Club information regarding the corrective action taken and with such other information regarding the malicious activity or breach as Lending Club reasonably requests. You also agree to assist Lending Club, at your sole expense, with any corrective action Lending Club determines, in its sole and absolute discretion, it is required to take."

- So that means that if a user (falsely or incorrectly) claims that their account was "hacked" and makes a fuss about it to Lending Club, LC can force me to pay for five years of credit card monitoring for all of my customers because they felt it was prudent to protect the Lending Club brand. I'm obviously all about protecting my customers but what is unacceptable is being at the legal and financial mercy of whatever Lending Club feels is best for themselves.

"You have no rights with respect to the API or any portion thereof. Without limiting the generality of the foregoing, you agree that you shall not (i) modify or create derivative works of the API; (ii) sublicense, lease, rent, assign, distribute, repackage, rebrand, or otherwise transfer or disclose the API, any portion thereof or any documentation to any third party; or (iii) cause, assist or permit any third party (including any end-user) to do any of the foregoing."

- Meaning that I cannot help anyone figure out the API for themselves if they need help

"All remarks, discussions, ideas, concepts, know-how, techniques, information, orders, data, strategies, account history, graphics or other submissions communicated to Lending Club or our agents by or through the API (collectively, "Submissions") shall be deemed and remain the property of Lending Club, and Lending Club shall be entitled to use any Submission for any purpose, without restriction or compensation to the individual who has provided the Submission. Lending Club shall not be subject to any obligations of confidentiality regarding Submissions except as expressly agreed by Lending Club or as otherwise required by Applicable Law. Nothing contained in this Agreement shall be construed as limiting Lending Club’s responsibilities and obligations under our Privacy Policy."

- How is this acceptable? I submit data to them on my customers' strategies and now that data becomes theirs? Heck it isn't even mine! It belongs to my customers.

[Cannot publish, distribute, post, etc] "any information relating to Lending Club, its products, services or accounts on any webpage or other medium that also displays information relating to products, services or accounts offered by or held with entities that Lending Club determines in our sole discretion compete with, harm, detract from, or otherwise impact Lending Club in any way;"

- This is a big one. This basically means that I couldn't write a blog post or do an interview or make a forum post here regarding how LC might be doing in any negative light whatsoever. How is this going to inspire trust in me from my customers.

"Attempt, directly or indirectly, to dissuade persons or entities from using the Site or Lending Club’s products or services"
"Indicate or imply that you prefer, directly or indirectly, any products or services offered by any Competitor of Lending Club;"
"Attempt to persuade or prompt Lending Club investors to use any products or services offered by any Competitor;"

- More of the same. How can people trust me or my business if I'm restricted from voicing my opinion.

"Impose any restrictions, conditions, disadvantages or fees in connection with Lending Club products or services that you do not impose equally on all products or services offered by any Competitor;"
"Promote any products or services offered by any Competitor more actively than you promote the products or services of Lending Club;"
"Engage in activities that harm the business or brand of Lending Club;"

- Lending Club for any reason can do whatever they want in order to protect their brand. Even at the expense of fairness. I'm all about a corporation to want whatever they want, but I as another business owner cannot expose myself and my customers to this risk.

"Make any disparaging statements or representations, either directly or indirectly, whether orally or in writing, by word or gesture, to any person or entity whatsoever, about Lending Club, our affiliates or subsidiaries or our or their respective directors, officers, employees, agents, representatives, consultants, accountants, shareholders, attorneys or advisors."

- The list goes on and on.

"You agree to provide such information as Lending Club may request in writing, within 30 days of your receipt of such request, concerning your use of the API in order to allow Lending Club to verify that such use complies with the terms of the API Documents."

- So now they reserve the right to 'inspect' my systems. YOUR data.

"You agree that any claim or cause of action brought by you shall be brought in an individual capacity and not as a member of a class or representative action, and that you shall not request that any court or tribunal hearing such claim or cause of action consolidate more than one party’s claims or causes of action. You further agree that you shall not participate, except by order of the court, in any class or representative arbitration or judicial proceeding involving claims or causes of action arising from or related to the API Documents or the subject matter thereof."

- So if Lending Club commits a violation to the community, the owners of sites like BlueVestment cannot get together and form a class action lawsuit but rather must fight it all out separately.




So my friends and customers... this looks like it may be the end. I'll keep running for the next couple of days but I'm certainly not liking this trend. Do you agree or disagree? Am I making a fuss about nothing or am I pointing out legitimate concerns?

All the best,
Nathan
BlueVestment
Title: Re: The end of BlueVestment?
Post by: jpildis on August 21, 2014, 04:34:50 PM
I support you 100% and I don't think it's fair the LC is taking such a heavy handed approach.  I would probably do the exact same thing, especially since you've been providing your wonderful service for fee.

I plan to light up by account representative on this topic and I encourage others to do so too.
Title: Re: The end of BlueVestment?
Post by: rawraw on August 21, 2014, 05:26:45 PM
I understand their intentions, but this is absurd.  I've been thinking of switching to a paid service as of late, but hadn't because it didn't seem Bryce has partnered with any of them.  Guess it's time to start looking again, right after I send an angry email to Lending Club.
Title: Re: Re: The end of BlueVestment?
Post by: BlueVestment on August 21, 2014, 05:40:51 PM
I understand their intentions, but this is absurd.  I've been thinking of switching to a paid service as of late, but hadn't because it didn't seem Bryce has partnered with any of them.  Guess it's time to start looking again, right after I send an angry email to Lending Club.
It's a real shame. Bryce and I have a great relationship and he and I built out the p2p picks api together. I'm just sad that this is what's ultimately going to be the nail in the coffin.
Title: Re: The end of BlueVestment?
Post by: Randawl on August 21, 2014, 05:42:08 PM
 :o      Wow.


I'll be in contact with LC as well about this one.  You can count on that.

. . . And I thought Google's T&C/agreements were ridiculous.
Title: Re: The end of BlueVestment?
Post by: Fred93 on August 21, 2014, 05:42:16 PM
Lawyers gone wild.
Title: Re: Re: The end of BlueVestment?
Post by: rawraw on August 21, 2014, 06:59:25 PM
I understand their intentions, but this is absurd.  I've been thinking of switching to a paid service as of late, but hadn't because it didn't seem Bryce has partnered with any of them.  Guess it's time to start looking again, right after I send an angry email to Lending Club.
It's a real shame. Bryce and I have a great relationship and he and I built out the p2p picks api together. I'm just sad that this is what's ultimately going to be the nail in the coffin.
I sent them an email.  They replied back asking for specifics, so I copied/pasted the few bits from above I thought were absurd and responded back with them.
Title: The end of BlueVestment?
Post by: BruiserB on August 21, 2014, 07:00:37 PM
I hope you can find a way to keep your service going and I will be making my disapproval of this known to Lending Club. However, I do understand that you can't take on personal liability for a service you provide for free.  Since you are not charging, I would argue that you aren't a "commercial" service at all.


Sent from my iPad using Tapatalk
Title: Re: The end of BlueVestment?
Post by: brycemason on August 21, 2014, 09:09:13 PM
I appreciate the intent, but I don't think this was the right approach. Nathan, I think we should gather up the 3rd-party players, have a conference call, and pound out a revision and pass it by them. If everyone groups together, then we have some leverage in that if nobody agrees to use the API, there is no third-party ecosystem.
Title: Re: The end of BlueVestment?
Post by: Nathan on August 21, 2014, 09:19:51 PM
I appreciate the intent, but I don't think this was the right approach. Nathan, I think we should gather up the 3rd-party players, have a conference call, and pound out a revision and pass it by them.

I agree that we should get with everyone and hash something out. But as it stands, I can't operate off this agreement. So I'll keep running until LC decides to shut me down but if a resolution comes instead then that's a win for all parties (well, us at least). That's essentially why I added a question mark at the end of title of this post. I'm not sure it's the end but I wanted my users to be aware of what was going on.

I've been operating for coming on two years now and now Lending Club is calling me to tell me that I'm hitting them too hard with my calls to get available cash and notes owned by users. Not sure why all the sudden this became an issue. I wouldn't have to scrape this information if they had a usable production API that provided this info. I'm not liking the pre-IPO brand protection trends I'm seeing. If I were to sign that agreement, I would be violating it just by posting this. Hell, I'd be violating it by even posting a comment about me getting a larger return from Prosper than LC. Where is the fairness in that?
Title: Re: The end of BlueVestment?
Post by: brycemason on August 21, 2014, 09:45:56 PM
Take a chill pill and reply all to my email. Let's make it happen.
Title: Re: Re: The end of BlueVestment?
Post by: BlueVestment on August 21, 2014, 09:47:18 PM
Take a chill pill and reply all to my email. Let's make it happen.
Lol fair enough.
Title: Re: The end of BlueVestment?
Post by: mchu168 on August 21, 2014, 11:34:19 PM
I'm a big fan of the BlueVestment service.  As a decent sized retail investor, let me know what I can do to help - I would be more then happy to lodge a complaint with LC.  Please don't go!
Title: Re: The end of BlueVestment?
Post by: rawraw on August 22, 2014, 12:22:22 PM
What is the plan? Do you want to do your group thing or do you want us to complain as well? I got an API guy looking for feedback. But I'm just a foot soldier :-)
Title: Re: The end of BlueVestment?
Post by: brycemason on August 22, 2014, 04:56:41 PM
Right now is the time for the third-party players to make a counter proposal. It's premature for retailers to complain, IMO.
Title: The end of BlueVestment?
Post by: BruiserB on August 22, 2014, 05:33:50 PM
Sounds good.....no reason to complain yet.  But if/when Lending Club makes it impossible for the third parties to continue, then they will hear from me.  I understand their lawyers want them to be protected, but they need to work with the third parties to ensure a secure way of doing business.  It would be nice if they would address the deficiencies of the API so that it wouldn't be necessary to give login credentials in addition to the API key.  That would go a long way to closing any security holes.  Also I thought the agreement for API access I signed already gave up a most of my right to recourse against LC.  Lawyers run amok as already stated.....


Sent from my iPad using Tapatalk
Title: Re: The end of BlueVestment?
Post by: lascott on August 22, 2014, 05:51:21 PM
Also I thought the agreement for API access I signed already gave up a most of my right to recourse against LC. 

API: https://drive.google.com/file/d/0B5lA7Kfp45ULWGtGVE1kSnJRTHM/edit?usp=sharing (https://drive.google.com/file/d/0B5lA7Kfp45ULWGtGVE1kSnJRTHM/edit?usp=sharing)
Title: The end of BlueVestment?
Post by: BruiserB on August 22, 2014, 09:14:33 PM
Exactly.....all kinds of disclaiming and harmless-holding was already agreed to by me.  :-)

So if I want to give my API key to a third party site, that's my business, and LC should not be putting further requirements on the third parties.


Sent from my iPad using Tapatalk
Title: Re: The end of BlueVestment?
Post by: BlueVestment on August 23, 2014, 07:10:55 PM
Exactly.....all kinds of disclaiming and harmless-holding was already agreed to by me.  :-)

So if I want to give my API key to a third party site, that's my business, and LC should not be putting further requirements on the third parties.


Sent from my iPad using Tapatalk

Thanks to this entire thread, the LC VP of Retail Investing called me up yesterday to discuss the issues. I'm cautiously optimistic from his attitude of wanting to work with us (the automated community as a whole) and wanting to move forward with a more acceptable solution. For what it's worth, Lending Club's concern is largely this: automated investors are taking over a large part of Lending Club's users where many users are seldom interacting with the Lending Club site other than the summary page. LC is realizing that the "Lending Club Experience" is now wearing the facade of BlueVestment and other third-partiers. They are worried about hard-won LC customers being influenced negatively by what may now become the defacto investment experience provided by us third-party guys.

I get it. It makes sense. But there needs to be some wiggle room so individuals can build up their businesses and make commitments without worrying about the Sword of Damocles hanging over our heads. I can't speak for everyone but I can say that while I feel comfortable enough with the existing relationships I have with the LC team, whoever comes after that may have a very strict opinion of the agreement. So for the moment, Bryce and I will continue to work together (when he's not busy telling me to calm down) and come up with some language that can be more universally accepted.
Title: Re: The end of BlueVestment?
Post by: Fred93 on August 23, 2014, 09:23:32 PM
Appreciate your efforts.

When I interacted with them a few weeks back, I emphasized that their best course of action is to work together with the ecosystem, instead of wage war with it. 
Title: Re: The end of BlueVestment?
Post by: lascott on August 23, 2014, 10:36:04 PM
Exactly.....all kinds of disclaiming and harmless-holding was already agreed to by me.  :-)
So if I want to give my API key to a third party site, that's my business, and LC should not be putting further requirements on the third parties.
<snip>
For what it's worth, Lending Club's concern is largely this: automated investors are taking over a large part of Lending Club's users where many users are seldom interacting with the Lending Club site other than the summary page.
<snip>
A little confusing aspect is that (underlined part) they have this graphic on their summary page, campaigned to my LC email via pushing their "automated investing" (renamed from PRIME to boot), and provide a 30 second head start to their "automated investing".  It is also doing this balancing act depending on your available cash level compared to others.
(https://forum.lendacademy.com/proxy.php?request=http%3A%2F%2Fi.imgur.com%2FQT7gwjt.png&hash=7ab77c2f58b5b5758e2f8ea26a54a3eb)
Title: The end of BlueVestment?
Post by: BruiserB on August 23, 2014, 11:24:47 PM


Thanks to this entire thread, the LC VP of Retail Investing called me up yesterday to discuss the issues. I'm cautiously optimistic from his attitude of wanting to work with us (the automated community as a whole) and wanting to move forward with a more acceptable solution. For what it's worth, Lending Club's concern is largely this: automated investors are taking over a large part of Lending Club's users where many users are seldom interacting with the Lending Club site other than the summary page. LC is realizing that the "Lending Club Experience" is now wearing the facade of BlueVestment and other third-partiers. They are worried about hard-won LC customers being influenced negatively by what may now become the defacto investment experience provided by us third-party guys.

I get it. It makes sense. But there needs to be some wiggle room so individuals can build up their businesses and make commitments without worrying about the Sword of Damocles hanging over our heads. I can't speak for everyone but I can say that while I feel comfortable enough with the existing relationships I have with the LC team, whoever comes after that may have a very strict opinion of the agreement. So for the moment, Bryce and I will continue to work together (when he's not busy telling me to calm down) and come up with some language that can be more universally accepted.

The way I view it, Lending Club provides the marketplace, and the third party developers bring different tools to interact with the marketplace.  Much like the NYSE or NASDAQ provide the stock exchange, but investors can choose from various brokers ranging from discount to full-service to interact with the exchanges.

If they realistically want to get people to use their automated investing, then they really need to allow for more sophisticated filters and allow a client to have several filters active simultaneously.  They wouldn't ever be able to directly offer something like Bryce's P2P-Picks or LendingRobot's Expected Returns filters as these would basically be an admission that their own scoring model is flawed and would be in conflict with their belief that there are no "best loans" available for picking.  Maybe this will become true over time as they continue to refine their modeling and scoring, but for now I do think many of us will attest to seeing improved performance by using simple filters as well as the more complex proprietary algorithms.

I do hope that they will realize that the third parties are in fact bringing more people and dollars to the marketplace.  I was nearly ready to give up on LC at the end of last year, but since finding the third party tools available I have instead more than doubled my investment in Lending Club this year.  If I can't use these tools, I will go away and invest elsewhere.


Sent from my iPad using Tapatalk
Title: Re: The end of BlueVestment?
Post by: thezfunk on August 24, 2014, 02:20:18 AM
I am going to channel my inner 'Core' here and say that this development has confirmed the suspicion I have had for awhile that they don't like these 3rd party sites and would prefer they don't exist.  They don't have to outright ban them, just make their lives so miserable they quit on their own.

If I can't use what I want to invest how I want to invest then I will pull out of LC.  I can be treated like a second rate investor somewhere else.

Sent from my SCH-I535 using Tapatalk

Title: Re: The end of BlueVestment?
Post by: rawraw on August 24, 2014, 08:08:32 AM
Thanks to this entire thread, the LC VP of Retail Investing called me up yesterday to discuss the issues. I'm cautiously optimistic from his attitude of wanting to work with us (the automated community as a whole) and wanting to move forward with a more acceptable solution. For what it's worth, Lending Club's concern is largely this: automated investors are taking over a large part of Lending Club's users where many users are seldom interacting with the Lending Club site other than the summary page. LC is realizing that the "Lending Club Experience" is now wearing the facade of BlueVestment and other third-partiers. They are worried about hard-won LC customers being influenced negatively by what may now become the defacto investment experience provided by us third-party guys.
Which is why they should work with you guys.  I hope they realize that many of us wouldn't have the same balances or even an account without your services.  The stuff is just too burdensome to do manually at large volumes.  I still expect they are going to buy one of you guys.
Title: Re: The end of BlueVestment?
Post by: BlueVestment on August 24, 2014, 08:12:57 AM
Thanks to this entire thread, the LC VP of Retail Investing called me up yesterday to discuss the issues. I'm cautiously optimistic from his attitude of wanting to work with us (the automated community as a whole) and wanting to move forward with a more acceptable solution. For what it's worth, Lending Club's concern is largely this: automated investors are taking over a large part of Lending Club's users where many users are seldom interacting with the Lending Club site other than the summary page. LC is realizing that the "Lending Club Experience" is now wearing the facade of BlueVestment and other third-partiers. They are worried about hard-won LC customers being influenced negatively by what may now become the defacto investment experience provided by us third-party guys.
Which is why they should work with you guys.  I hope they realize that many of us wouldn't have the same balances or even an account without your services.  The stuff is just too burdensome to do manually at large volumes.  I still expect they are going to buy one of you guys.

I go back and forth one whether or not someone will be bought out. At the moment I'm not holding my breath for it. None of the services out there provide any feature that either A) LC couldn't easily build out themselves if so inclined or B) Is a market they want to get into (such as pick recommendations). If LC were to buy out one of the services they would arguably spend the same amount or more time handling the integration compared to just building the product out on their own. In my professional career I've played the whole purchase vs develop game and everyone grossly underestimates integration costs.
Title: Re: The end of BlueVestment?
Post by: rawraw on August 24, 2014, 08:22:05 AM
Now it makes sense why they are pushing automated investing so heavily, though.  You have them scared Nathan :)
Title: Re: The end of BlueVestment?
Post by: SBryantMS on August 24, 2014, 02:37:15 PM
Have you considered the alternative:  Buy out the best Third party tool and shut it down.  Non-compete with the original principals. Wait six months and repeat. 
Title: Re: The end of BlueVestment?
Post by: wiseclerk_com on August 25, 2014, 03:56:08 PM
Have you considered the alternative:  Buy out the best Third party tool and shut it down.  Non-compete with the original principals. Wait six months and repeat.

If closing third party tools would be the goal -  which I do not know - then I think it would be much easier to use the legal terms to restrict the API usage that much that it becomes unattractive/undoable for the 3rd party tools to continue.
The fallout would be different. If the tool providers discontinue the tools, then the tool users would be dissatisfied but after all the tool provider discontinued it. If on the other hand LC bought the tool and then shut it out the dissatisfaction would be directed at LC directly.

Overall I agree with rawraw and
Quote
The way I view it, Lending Club provides the marketplace, and the third party developers bring different tools to interact with the marketplace.  Much like the NYSE or NASDAQ provide the stock exchange, but investors can choose from various brokers ranging from discount to full-service to interact with the exchanges.
however we have yet to see the first p2p lending marketplace that fully embraces and encourages an indepently developed ecosystem upon a provided API.

And I agree with BlueVestment that the spelled out terms would not instirr confidence in me would I run a 3rd party tool, even if LC backs off to a less strict version. After all they can always restrict API access at a later time should they change their opinion.

Title: Re: The end of BlueVestment?
Post by: BlueVestment on August 25, 2014, 03:59:37 PM
Have you considered the alternative:  Buy out the best Third party tool and shut it down.  Non-compete with the original principals. Wait six months and repeat.

If closing third party tools would be the goal -  which I do not know - then I think it would be much easier to use the legal terms to restrict the API usage that much that it becomes unattractive/undoable for the 3rd party tools to continue.
The fallout would be different. If the tool providers discontinue the tools, then the tool users would be dissatisfied but after all the tool provider discontinued it. If on the other hand LC bought the tool and then shut it out the dissatisfaction would be directed at LC directly.

Overall I agree with rawraw and
Quote
The way I view it, Lending Club provides the marketplace, and the third party developers bring different tools to interact with the marketplace.  Much like the NYSE or NASDAQ provide the stock exchange, but investors can choose from various brokers ranging from discount to full-service to interact with the exchanges.
however we have yet to see the first p2p lending marketplace that fully embraces and encourages an indepently developed ecosystem upon a provided API.

And I agree with BlueVestment that the spelled out terms would not instirr confidence in me would I run a 3rd party tool, even if LC backs off to a less strict version. After all they can always restrict API access at a later time should they change their opinion.

This is great insight. I would absolutely agree that if shutting down 3rd party tools were the goal, there are better ways to do it than buying people out and providing non-competes.
Title: Re: The end of BlueVestment?
Post by: Fred93 on August 25, 2014, 04:32:52 PM
I believe the explanation is much simpler.

The folks at LC are largely ignorant of the ecosystem.  They don't understand or appreciate the 3rd party sites.  How can this be?  Well first off, they aren't users of them, as we are. 

So they don't see the benefits, but do discuss among themselves and their lawyers fantasy fears.

So I believe first we have to overcome the ignorance. 

One of the things I suggested to them is that they form a group of API users, with whom they discuss problems, concerns, website changes, policy changes, etc.  I suggested this could be done with a mailing list or forum.  This was just an idea for a way to get a dialog going.  Such a dialog could help to educate internal LC people about the ecosystem.
Title: Re: The end of BlueVestment?
Post by: wiseclerk_com on August 25, 2014, 05:39:06 PM
@Fred93

possible

But at least upper management and marketing department of LC should be aware, as the tools
 - are not new
 - got some visibility as they were presented at events like Lendit and reviewed on some expert blogs
 - as I understand are used by some of the larger/institutional investors which should be in the focus
 - do fulfill a need of a segment of investors that LC site-tools seem to leave open (otherwise investors would not use these 3rd party tools)

But Nathan and Bryce should be able to gauge that better than I am.
Title: Re: The end of BlueVestment?
Post by: Fred93 on August 25, 2014, 06:41:40 PM
What you say sounds logical, but does not match the facts I've observed from my conversations with LC folk. 

I think this is an important point, because it directs how we should think about what to say to them.

Title: Re: The end of BlueVestment?
Post by: Simon on August 25, 2014, 07:11:46 PM
This is a great discussion - and one that will continue to happen each year. I agree with Bryce that now is the time to make third-party voices heard and not shut out. Lending Club needs to know that they stand to benefit, not lose, from a vibrant p2p lending ecosystem, and a generous API agreement (that still maintains their security requirements, etc) is a part of how that ecosystem is catalyzed.

If you guys want this covered in an article on LendingMemo send me an email.
Title: Re: The end of BlueVestment?
Post by: thinkfastsuit on August 25, 2014, 10:57:01 PM
I support you 100% and I don't think it's fair the LC is taking such a heavy handed approach.  I would probably do the exact same thing, especially since you've been providing your wonderful service for fee.

I plan to light up by account representative on this topic and I encourage others to do so too.

I was somewhat surprised as well when I received the new commercial agreement, but overall I believe this is a positive step for Lending Club in continuing to develop their API developer community. Over the past several months, I've had numerous conversations with a couple of the VP's at Lending Club and wholeheartedly believe they've decided to embrace this spin-off service line and foster the creativity, but in so doing have also done further risk assessment and are putting some necessary controls into place. Having lead IT departments through the past decade of conversion from paper to electronic medical records in the healthcare industry, I watched this industry progress through its adolescence, where everyone with a computer and some medical credentials were writing "best of breed" systems to fit every niche, into a market consolidation because may of these niche systems were focused solely on functionality and neglected things like patient privacy and security. This move ultimately led to large lawsuits and a shift in the regulatory tone, which caused the cost to operate in the healthcare IT space to increase significantly. Similarly, Lending Club, and peer lending platforms in general, I believe are in this adolescent stage where every 13 year old kid with a Mac Book could write an API wrapper and post it on the web, and this is beginning to cause significant risk to the reputable companies, and endanger the privacy and security of their clients. Many of the existing third party sites do use screen scraping technologies, which require users to provide their full Lending Club username and password to this third party. With these credentials, a third party site - or worse someone who hacks a third party site, could do whatever they want with your account including liquidate your holdings and transfer the cash from your Lending Club account to any bank account they pleased. The abstraction provided through the API, and the use of API specific credentials help to limit a Lending Club user's exposure by providing limited access to a third party site on the user's behalf. At present, if a third party site were to compromise your API credentials, the most malicious activity that could be performed would be investing all your free cash in undesirable loans or creating a bunch of portfolios in your account - but your money is still IN YOUR ACCOUNT. As recently as a month ago, Lending Club has communicated with the developer community and released beta API functionality to accomplish some of the things that are currently only accomplished via screen scraping - this is a very positive move in fostering development and creating a functional but more secure environment in which Lending Club's users can have confidence in the security of their accounts even though they are providing their API credentials to a third party site.

Ultimately, you must keep in mind that financial tech is an industry - and one  deep rooted in capitalism. This move may not be advantageous to all third party sites, but I think it is beneficial to Lending Club's clients who place their trust in the third party sites that will continue to innovate and adapt, and embrace these necessary changes.
Title: Re: The end of BlueVestment?
Post by: AnilG on August 25, 2014, 11:06:51 PM
The early employees at LC are well aware of ecosystem. I have been using API at PeerCube for almost 2 years. Every time I had issues with them, they always have been quick to respond. But it helps to show respect as you would show to anyone else.

Their current challenge is that they are growing much faster, new people unaware of the culture, gaps in communications, and rapid developments to get ready for IPO.

Personally, I believe publicly complaining about API agreement before contacting LC staff is not the right way to go about doing business and building good rapport.

Also, LC is right to worry about security aspects of commercial services. I was surprised the API agreement didn't call for tougher security measures.

The folks at LC are largely ignorant of the ecosystem.  They don't understand or appreciate the 3rd party sites.  How can this be?  Well first off, they aren't users of them, as we are. 

So they don't see the benefits, but do discuss among themselves and their lawyers fantasy fears.

So I believe first we have to overcome the ignorance. 

One of the things I suggested to them is that they form a group of API users, with whom they discuss problems, concerns, website changes, policy changes, etc.  I suggested this could be done with a mailing list or forum.  This was just an idea for a way to get a dialog going.  Such a dialog could help to educate internal LC people about the ecosystem.
Title: Re: The end of BlueVestment?
Post by: Fred on August 26, 2014, 02:54:02 AM
If I were to sign that agreement, ....

Have you made a final decision on this?
Title: Re: The end of BlueVestment?
Post by: rawraw on August 26, 2014, 07:01:02 AM
I support you 100% and I don't think it's fair the LC is taking such a heavy handed approach.  I would probably do the exact same thing, especially since you've been providing your wonderful service for fee.

I plan to light up by account representative on this topic and I encourage others to do so too.

I was somewhat surprised as well when I received the new commercial agreement, but overall I believe this is a positive step for Lending Club in continuing to develop their API developer community. Over the past several months, I've had numerous conversations with a couple of the VP's at Lending Club and wholeheartedly believe they've decided to embrace this spin-off service line and foster the creativity, but in so doing have also done further risk assessment and are putting some necessary controls into place. Having lead IT departments through the past decade of conversion from paper to electronic medical records in the healthcare industry, I watched this industry progress through its adolescence, where everyone with a computer and some medical credentials were writing "best of breed" systems to fit every niche, into a market consolidation because may of these niche systems were focused solely on functionality and neglected things like patient privacy and security. This move ultimately led to large lawsuits and a shift in the regulatory tone, which caused the cost to operate in the healthcare IT space to increase significantly. Similarly, Lending Club, and peer lending platforms in general, I believe are in this adolescent stage where every 13 year old kid with a Mac Book could write an API wrapper and post it on the web, and this is beginning to cause significant risk to the reputable companies, and endanger the privacy and security of their clients. Many of the existing third party sites do use screen scraping technologies, which require users to provide their full Lending Club username and password to this third party. With these credentials, a third party site - or worse someone who hacks a third party site, could do whatever they want with your account including liquidate your holdings and transfer the cash from your Lending Club account to any bank account they pleased. The abstraction provided through the API, and the use of API specific credentials help to limit a Lending Club user's exposure by providing limited access to a third party site on the user's behalf. At present, if a third party site were to compromise your API credentials, the most malicious activity that could be performed would be investing all your free cash in undesirable loans or creating a bunch of portfolios in your account - but your money is still IN YOUR ACCOUNT. As recently as a month ago, Lending Club has communicated with the developer community and released beta API functionality to accomplish some of the things that are currently only accomplished via screen scraping - this is a very positive move in fostering development and creating a functional but more secure environment in which Lending Club's users can have confidence in the security of their accounts even though they are providing their API credentials to a third party site.

Ultimately, you must keep in mind that financial tech is an industry - and one  deep rooted in capitalism. This move may not be advantageous to all third party sites, but I think it is beneficial to Lending Club's clients who place their trust in the third party sites that will continue to innovate and adapt, and embrace these necessary changes.
Interesting!  And welcome to the forum.
Title: Re: Re: The end of BlueVestment?
Post by: BlueVestment on August 26, 2014, 07:32:45 AM
If I were to sign that agreement, ....

Have you made a final decision on this?
While there seems to be some contention on whether or not me voicing my concerns publicly was the appropriate way address this issue, it has raised the desired level of awareness and a dialogue has been opened with all parties. We are going to see if we can draft some language that would be more mutually beneficial and present it to LC for review.
Title: Re: The end of BlueVestment?
Post by: lascott on August 26, 2014, 08:52:50 AM
I support you 100% and I don't think it's fair the LC is taking such a heavy handed approach.  I would probably do the exact same thing, especially since you've been providing your wonderful service for fee. I plan to light up by account representative on this topic and I encourage others to do so too.
<snip>
As recently as a month ago, Lending Club has communicated with the developer community and released beta API functionality to accomplish some of the things that are currently only accomplished via screen scraping
<snip>
Maybe my aging memory but I don't recall that?!? 

Fred93 documented several of these ( http://www.lendacademy.com/forum/index.php?topic=2376.msg20382#msg20382 ).  Seriously the API doesn't provide your cash balance... the most basic thing. We owe him a lot of gratitude for the effort he made and testing to providing timing data as well.
Title: Re: The end of BlueVestment?
Post by: BruiserB on August 26, 2014, 10:08:04 AM
I support you 100% and I don't think it's fair the LC is taking such a heavy handed approach.  I would probably do the exact same thing, especially since you've been providing your wonderful service for fee.

I plan to light up by account representative on this topic and I encourage others to do so too.

I was somewhat surprised as well when I received the new commercial agreement, but overall I believe this is a positive step for Lending Club in continuing to develop their API developer community. Over the past several months, I've had numerous conversations with a couple of the VP's at Lending Club and wholeheartedly believe they've decided to embrace this spin-off service line and foster the creativity, but in so doing have also done further risk assessment and are putting some necessary controls into place. Having lead IT departments through the past decade of conversion from paper to electronic medical records in the healthcare industry, I watched this industry progress through its adolescence, where everyone with a computer and some medical credentials were writing "best of breed" systems to fit every niche, into a market consolidation because may of these niche systems were focused solely on functionality and neglected things like patient privacy and security. This move ultimately led to large lawsuits and a shift in the regulatory tone, which caused the cost to operate in the healthcare IT space to increase significantly. Similarly, Lending Club, and peer lending platforms in general, I believe are in this adolescent stage where every 13 year old kid with a Mac Book could write an API wrapper and post it on the web, and this is beginning to cause significant risk to the reputable companies, and endanger the privacy and security of their clients. Many of the existing third party sites do use screen scraping technologies, which require users to provide their full Lending Club username and password to this third party. With these credentials, a third party site - or worse someone who hacks a third party site, could do whatever they want with your account including liquidate your holdings and transfer the cash from your Lending Club account to any bank account they pleased. The abstraction provided through the API, and the use of API specific credentials help to limit a Lending Club user's exposure by providing limited access to a third party site on the user's behalf. At present, if a third party site were to compromise your API credentials, the most malicious activity that could be performed would be investing all your free cash in undesirable loans or creating a bunch of portfolios in your account - but your money is still IN YOUR ACCOUNT. As recently as a month ago, Lending Club has communicated with the developer community and released beta API functionality to accomplish some of the things that are currently only accomplished via screen scraping - this is a very positive move in fostering development and creating a functional but more secure environment in which Lending Club's users can have confidence in the security of their accounts even though they are providing their API credentials to a third party site.

Ultimately, you must keep in mind that financial tech is an industry - and one  deep rooted in capitalism. This move may not be advantageous to all third party sites, but I think it is beneficial to Lending Club's clients who place their trust in the third party sites that will continue to innovate and adapt, and embrace these necessary changes.

I hope that it is true that Lending Club will soon provide full details necessary to effect trades through the API so that I can purge my login details from third party sites.  I agree this is the biggest risk area....either a developer is malicious or someone malicious hacks a developer's site and steals credentials.  Since this is a risk created more, in my opinion, by Lending Club than by the third-party sites, I found it somewhat shocking that it seems Lending Club is asking the third-parties to bear all the risk and expense of any data breach caused by the current arrangement.  If the API is properly structured, it seems risk would be decreased significantly.  If there is no chance that user credentials could be compromised, then there is no need to ask the third-parties to bear responsibility for a compromise. 

I have no issue with Lending Club wanting to better define the relationship between themselves, the third-party execution sites, and the customers, but it should be done in a way that is fair and that each party takes responsibility for any risk that they themselves create.
Title: Re: The end of BlueVestment?
Post by: rawraw on August 26, 2014, 11:10:28 AM
Yea, you 3rd party guys should pressure LC into having API specific passwords as part of this process.  Then it limits the liability of LC and the API guys in case of problems.
Title: Re: The end of BlueVestment?
Post by: thinkfastsuit on August 26, 2014, 01:14:22 PM
Yea, you 3rd party guys should pressure LC into having API specific passwords as part of this process.  Then it limits the liability of LC and the API guys in case of problems.
As of the latest release of the API (version 1.4) - this is the case. There is an API specific credential for just this purpose.
Title: Re: Re: The end of BlueVestment?
Post by: rawraw on August 26, 2014, 01:15:32 PM
Yea, you 3rd party guys should pressure LC into having API specific passwords as part of this process.  Then it limits the liability of LC and the API guys in case of problems.
As of the latest release of the API (version 1.4) - this is the case. There is an API specific credential for just this purpose.
Yeah but without the cash balance in API it's not useful
Title: Re: The end of BlueVestment?
Post by: thinkfastsuit on August 26, 2014, 01:21:20 PM
I support you 100% and I don't think it's fair the LC is taking such a heavy handed approach.  I would probably do the exact same thing, especially since you've been providing your wonderful service for fee.

I plan to light up by account representative on this topic and I encourage others to do so too.

I was somewhat surprised as well when I received the new commercial agreement, but overall I believe this is a positive step for Lending Club in continuing to develop their API developer community. Over the past several months, I've had numerous conversations with a couple of the VP's at Lending Club and wholeheartedly believe they've decided to embrace this spin-off service line and foster the creativity, but in so doing have also done further risk assessment and are putting some necessary controls into place. Having lead IT departments through the past decade of conversion from paper to electronic medical records in the healthcare industry, I watched this industry progress through its adolescence, where everyone with a computer and some medical credentials were writing "best of breed" systems to fit every niche, into a market consolidation because may of these niche systems were focused solely on functionality and neglected things like patient privacy and security. This move ultimately led to large lawsuits and a shift in the regulatory tone, which caused the cost to operate in the healthcare IT space to increase significantly. Similarly, Lending Club, and peer lending platforms in general, I believe are in this adolescent stage where every 13 year old kid with a Mac Book could write an API wrapper and post it on the web, and this is beginning to cause significant risk to the reputable companies, and endanger the privacy and security of their clients. Many of the existing third party sites do use screen scraping technologies, which require users to provide their full Lending Club username and password to this third party. With these credentials, a third party site - or worse someone who hacks a third party site, could do whatever they want with your account including liquidate your holdings and transfer the cash from your Lending Club account to any bank account they pleased. The abstraction provided through the API, and the use of API specific credentials help to limit a Lending Club user's exposure by providing limited access to a third party site on the user's behalf. At present, if a third party site were to compromise your API credentials, the most malicious activity that could be performed would be investing all your free cash in undesirable loans or creating a bunch of portfolios in your account - but your money is still IN YOUR ACCOUNT. As recently as a month ago, Lending Club has communicated with the developer community and released beta API functionality to accomplish some of the things that are currently only accomplished via screen scraping - this is a very positive move in fostering development and creating a functional but more secure environment in which Lending Club's users can have confidence in the security of their accounts even though they are providing their API credentials to a third party site.

Ultimately, you must keep in mind that financial tech is an industry - and one  deep rooted in capitalism. This move may not be advantageous to all third party sites, but I think it is beneficial to Lending Club's clients who place their trust in the third party sites that will continue to innovate and adapt, and embrace these necessary changes.

I hope that it is true that Lending Club will soon provide full details necessary to effect trades through the API so that I can purge my login details from third party sites.  I agree this is the biggest risk area....either a developer is malicious or someone malicious hacks a developer's site and steals credentials.  Since this is a risk created more, in my opinion, by Lending Club than by the third-party sites, I found it somewhat shocking that it seems Lending Club is asking the third-parties to bear all the risk and expense of any data breach caused by the current arrangement.  If the API is properly structured, it seems risk would be decreased significantly.  If there is no chance that user credentials could be compromised, then there is no need to ask the third-parties to bear responsibility for a compromise. 

I have no issue with Lending Club wanting to better define the relationship between themselves, the third-party execution sites, and the customers, but it should be done in a way that is fair and that each party takes responsibility for any risk that they themselves create.

About a month and a half ago lending club announced to developers they would be migrating toward REST API and asked for volunteers in the Beta program. If you requested to participate, you should've gotten more information a couple weeks ago regarding the Beta program and enhanced functionality including cash balance available through the API. This cannot be used in production as of yet, per the specific terms of the testing program - but it's coming.
Title: Re: Re: The end of BlueVestment?
Post by: thinkfastsuit on August 26, 2014, 01:23:54 PM
Yea, you 3rd party guys should pressure LC into having API specific passwords as part of this process.  Then it limits the liability of LC and the API guys in case of problems.
As of the latest release of the API (version 1.4) - this is the case. There is an API specific credential for just this purpose.
Yeah but without the cash balance in API it's not useful
First, see my comment above regarding this functionality coming soon. Second, you do not need to know the cash balance to submit an order through the API; if you submit an order and there is not sufficient funds - you get an INSUFFICIENT_CASH response. This is all in the API developer documentation from Lending Club...
Title: Re: Re: Re: The end of BlueVestment?
Post by: rawraw on August 26, 2014, 01:25:42 PM
Yea, you 3rd party guys should pressure LC into having API specific passwords as part of this process.  Then it limits the liability of LC and the API guys in case of problems.
As of the latest release of the API (version 1.4) - this is the case. There is an API specific credential for just this purpose.
Yeah but without the cash balance in API it's not useful
First, see my comment above regarding this functionality coming soon. Second, you do not need to know the cash balance to submit an order through the API; if you submit an order and there is not sufficient funds - you get an INSUFFICIENT_CASH response. This is all in the API developer documentation from Lending Club...
Cool deal man. Appreciate it
Title: Re: Re: The end of BlueVestment?
Post by: BruiserB on August 26, 2014, 01:39:45 PM
Yeah but without the cash balance in API it's not useful
First, see my comment above regarding this functionality coming soon. Second, you do not need to know the cash balance to submit an order through the API; if you submit an order and there is not sufficient funds - you get an INSUFFICIENT_CASH response. This is all in the API developer documentation from Lending Club...

It seems to me the cash balance would be needed, unless the API will allow a partial filling of an order when there is "insufficient cash."

For instance, if 15 notes pass my filters and an order is filed via the API, and I only have enough cash for 10 of them, will it buy 10 for me?  If so, which 10?  My highest priority ones?  I have been under the impression that the cash balance was needed so that the third party site knows before placing my order that I have enough cash for 10 notes, then it can pick the first 10 that meet my highest priority filters and file the order.  I guess an alternative would be to have the third party sites file orders for 1 note at a time until the cash is gone, but I would think that wouldn't be efficient for either the 3rd parties or for Lending Club.

I'm really happy to hear a new API is being tested and hope it is available for use soon.  Lending Club needs to continue to push to get this out as it would make the risk to credential compromise moot.  Lending Club should then implement some additional security....perhaps text message authentication or something similar if a customer logs in from an unfamiliar computer or tries to change e-mail address or bank account info.  As of now, to change bank account info you would have to wait for and confirm small deposits, so it's not like someone could clear your account out all that quickly even if they had access to your credentials....but extra measures could be put in place to make it even more difficult.
Title: Re: Re: The end of BlueVestment?
Post by: lascott on August 26, 2014, 01:40:41 PM
Yea, you 3rd party guys should pressure LC into having API specific passwords as part of this process.  Then it limits the liability of LC and the API guys in case of problems.
As of the latest release of the API (version 1.4) - this is the case. There is an API specific credential for just this purpose.
Yeah but without the cash balance in API it's not useful
First, see my comment above regarding this functionality coming soon. Second, you do not need to know the cash balance to submit an order through the API; if you submit an order and there is not sufficient funds - you get an INSUFFICIENT_CASH response. This is all in the API developer documentation from Lending Club...
As well as the points made above it that doesn't give us the functionality that we users want.  We want to have a cash limit/cap.  So  tell the "3rd-party-tool" (BlueVestment, LendingRobot) do not submit note orders that take our cash below our "$1,000" cash limit because in a week or two I need to take that money out for something (as just one example).   With chunks of payments almost random coming one some days of the week and with only a portion of notes invested in going through and the other portion being canceled the cash balance bounces all over the place in an unpredictable manner.

I get these emails daily where the resulting y money value pops into my account at differing times.
Quote
x Note(s) issued and $xxx.xx was invested.
y Note(s) did not issue.
Title: Re: The end of BlueVestment?
Post by: rawraw on August 26, 2014, 01:43:44 PM
I suggested two factor authentication recently and they forwarded it up. It'd be nice for things like Folio and changing bank
Title: Re: Re: The end of BlueVestment?
Post by: thinkfastsuit on August 26, 2014, 01:46:36 PM
Yeah but without the cash balance in API it's not useful
First, see my comment above regarding this functionality coming soon. Second, you do not need to know the cash balance to submit an order through the API; if you submit an order and there is not sufficient funds - you get an INSUFFICIENT_CASH response. This is all in the API developer documentation from Lending Club...

It seems to me the cash balance would be needed, unless the API will allow a partial filling of an order when there is "insufficient cash."

For instance, if 15 notes pass my filters and an order is filed via the API, and I only have enough cash for 10 of them, will it buy 10 for me?  If so, which 10?  My highest priority ones?  I have been under the impression that the cash balance was needed so that the third party site knows before placing my order that I have enough cash for 10 notes, then it can pick the first 10 that meet my highest priority filters and file the order.  I guess an alternative would be to have the third party sites file orders for 1 note at a time until the cash is gone, but I would think that wouldn't be efficient for either the 3rd parties or for Lending Club.

I'm really happy to hear a new API is being tested and hope it is available for use soon.  Lending Club needs to continue to push to get this out as it would make the risk to credential compromise moot.  Lending Club should then implement some additional security....perhaps text message authentication or something similar if a customer logs in from an unfamiliar computer or tries to change e-mail address or bank account info.  As of now, to change bank account info you would have to wait for and confirm small deposits, so it's not like someone could clear your account out all that quickly even if they had access to your credentials....but extra measures could be put in place to make it even more difficult.
The API is designed to fulfill partial orders per the documentation. The last time I tested this (albeit this was many months ago), it did not work as described so I simply handled this in code (censoring proprietary order execution method here). It is advantageous for third party sites to know your cash balance so that we don't waste cycles (and time) evaluating rules and submitting orders for accounts that don't have funds available to invest. Again, there is a lot of opportunity for optimization in your rule and order processing via code - and this is again a proprietary differentiator for third party sites.
Title: Re: The end of BlueVestment?
Post by: AnilG on August 27, 2014, 12:35:46 AM
Two factor authentication has its own weakness but it is still a better option for user security. But none of these solutions solve the "insecurity" with third party access to your account. With current username/password or API Key, your security is as good as third party claims, not much IMO. I doubt any of the third party sites will meet PCI compliance audit with storing your credentials typically required for financial transactions and by financial institutions.

What platforms need is a secure way to allow third party to access your account and perform transactions on your behalf. Anything short of token-based system and your authentication information never hitting and stored on third party site, similar to the systems used by Credit Card processors, is opening up Lending Club and third party sites for lot of pain if there were to be a security breach. That has been my recommendation to platforms like Lending Club. If they are interested in having a third-party ecosystem, implement a PCI compliant token based authentication system and share the cost with third party sites. With the early stage of most platforms, I don't see anyone implementing it yet. But LC is in the best position now to set the standard assuming they want a third-party order execution based ecosystem.

I suggested two factor authentication recently and they forwarded it up. It'd be nice for things like Folio and changing bank
Title: Re: The end of BlueVestment?
Post by: AnilG on August 27, 2014, 12:40:07 AM
Did you just break your NDA with Lending Club by disclosing this information publicly? If I understood the T&C to participate in REST API program correctly, you were bound by NDA and not to disclose any information related to the program publicly.  8)


About a month and a half ago lending club announced to developers they would be migrating toward REST API and asked for volunteers in the Beta program. If you requested to participate, you should've gotten more information a couple weeks ago regarding the Beta program and enhanced functionality including cash balance available through the API. This cannot be used in production as of yet, per the specific terms of the testing program - but it's coming.
Title: Re: The end of BlueVestment?
Post by: refinerr on September 12, 2014, 06:59:02 PM
I was reading through the legal documents LC sent over earlier this week to me when I requested an API for a TPA.  Within the agreement it states you agree to not provide your log in credentials to any third party. What are the consequences of this to the everyday end user like myself?
Title: Re: The end of BlueVestment?
Post by: brycemason on September 12, 2014, 07:43:36 PM
You don't provide the username/password, you provide your authorization token.
Title: The end of BlueVestment?
Post by: BruiserB on September 13, 2014, 11:13:08 PM

You don't provide the username/password, you provide your authorization token.

Actually you provide both.  Both automated platforms I've used request the username/password so they can get cash on hand info prior to loan release. My understanding is that if/when LC provides cash on hand in the API, this won't be necessary.


Sent from my iPad using Tapatalk
Title: The end of BlueVestment?
Post by: BruiserB on September 13, 2014, 11:14:54 PM

I was reading through the legal documents LC sent over earlier this week to me when I requested an API for a TPA.  Within the agreement it states you agree to not provide your log in credentials to any third party. What are the consequences of this to the everyday end user like myself?

So far there haven't been consequences.....


Sent from my iPad using Tapatalk
Title: Re: The end of BlueVestment?
Post by: brycemason on September 14, 2014, 01:44:19 PM

You don't provide the username/password, you provide your authorization token.

Actually you provide both.  Both automated platforms I've used request the username/password so they can get cash on hand info prior to loan release. My understanding is that if/when LC provides cash on hand in the API, this won't be necessary.


Sent from my iPad using Tapatalk

Fair. Soon you won't have to.
Title: Re: The end of BlueVestment?
Post by: refinerr on October 03, 2014, 10:46:40 AM
Thank you Bruiser and Bryce!