I seem to have pushed a button here - but I am the wrong person to address. Personally, I care very little about all this. But the target audience doesn't.
Not sure why you think you pushed a button. I was just answer you as "a matter of fact". We really don't want to store your data. We care about you not losing your data, but we don't actually want a copy. We're *way* too busy for that stuff.
Any company with a proper IT structure should go to iXsystems. But smaller ones with less than 20 people and no dedicated IT guy? Don't think so. They just wouldn't dare to deal with support over the Atlantic, with everything that comes with it (pricing structure, time zones, languages, ...)
I don't know about that. iXsystems has a few customers that have less than 20 employees. It's really about right-sizing and how much you are willing to pay for support/hardware/etc. Id wager that if you don't have a dedicated IT guy the business is probably incapable of figuring out that TrueNAS and ZFS is better than some Dell machine (which would also be much cheaper).
As long as it's open source, it can be audited - at least in theory. I could also rely on something like
http://en.wikipedia.org/wiki/Red_Flag_Linux because I bet they audited everything in there quite well. But that's a digression. As I said, I am not paranoid. This is not an issue for me.
That sounds very reasonable, and this is what I was looking for. Thank you.
Yeah, in theory is great. Let's take a walk down memory lane.... flashback to April 2014 when Heartbleed was announced. :P
The harsh reality is that anyone capable of auditing the code is certainly capable of using FreeBSD itself, and for people that can use FreeBSD it is often a better choice for almost every reason you can think of.
Look at how long Heartbleed actually existed before being caught. Look at how many years Truecrypt was basically labeled as safe despite their being no official audit of any kind. Anyone that thinks its safer because it can be audited is just fooling themselves.
When I worked in a previous career (nuclear power) if there wasn't a 3rd party unaffiliated audit of the exact version you wanted to use, you weren't using it unless your organization did the audit. We had zero developers, so that was a non-starter. :P