How a 20-year-old convinced Facebook’s former security chief to invest in his data privacy start-up

At 19 years of age, Irish entrepreneur Shane Curran grabbed the attention of some of the world’s top venture capital firms. He managed to raise over $3 million in seed funding last year from the likes of Sequoia Capital and Kleiner Perkins, household names in Silicon Valley.

Less than a year later, Curran has already gotten more investors on board — and one name in particular sticks out. Evervault, his data privacy start-up, now counts Facebook’s former chief security officer, Alex Stamos, as a backer. Stamos participated in a $16 million investment round announced by the company on Thursday.

The deal was led by Index Ventures and also backed by Sequoia Capital, Kleiner Perkins and Frontline Ventures. The firm has now raised more than $19 million just under two years since it was founded, despite not yet having a product that’s commercially available.

Explaining how he managed to convince Stamos to invest, Curran said the computer scientist was won over by Evervault’s fundamental premise: that privacy should be built into every company’s app from the get-go, rather than discarded as an afterthought for their compliance teams to deal with.

“For him, he’s coming from a security background at Facebook where privacy was much more of a regulatory problem,” Evervault’s co-founder and CEO told CNBC. “Obviously he’s experienced first hand what the pain in the ass is with privacy and security in general.”

Stamos left Facebook in August 2018, a few months after the social media giant suffered a huge data scandal involving controversial data firm Cambridge Analytica. Since then, he has joined Zoom as an advisor to help the company address privacy and security issues that surfaced recently following a surge in popularity for the video-conferencing app.

Curran said that talks with Stamos were done entirely over remote meetings — and he still hasn’t met him in-person to this day — due to lockdown restrictions brought about by the coronavirus pandemic. He had already met with lead investor Index in a Dublin coffee shop last fall.

“We were immediately super intrigued,” Ari Helgason, a partner at Index, told CNBC. “Who was this 19-year-old who has won lots of science prizes, just finished high school and then jumped right into building heavy-duty, enterprise-grade encryption? That was already very unusual and enough to pique our interest.”

Funding talks between Index and Evervault properly kicked off around late February and early March, Curran said. Presentations were made and term sheets agreed remotely, and the round closed earlier this month. Alongside Stamos, other angel investors in the financing included Eventbrite CEO Kevin Hartz, Datadog CEO Olivier Pomel and Figma CEO Dylan Field.

Evervault is still in the “development phase,” Curran said, and its software isn’t yet publicly available. It’s developing what’s known as an application programming interface, or API, a system that will be integrated into companies’ apps to ensure privacy is baked in from the start.

“It’s this idea of a privacy cage, where basically we let you process your most sensitive data in an encrypted way, so that individuals never sacrifice your privacy but companies still get full utility over your data,” Evervault’s CEO said.

The aim will be for Evervault to initially sell its technology to companies in the financial services and health care sectors, because they handle what Curran calls “scary data” — personally identifiable information where, “if it were to go missing, it would be a major issue.”

Longer term, Curran wants “everyone” to use Evervault’s technology: “If you look at the magnitude of the problem, there’s 4.5 billion people on the internet now, and the reality is very few of them — if any — have full privacy, so that’s a pretty large market opportunity regardless of the companies we integrate with.”

The need for such privacy-preserving technologies has been heightened by the coronavirus pandemic as well as stricter data protection regulations. Hackers are increasingly exploiting the Covid-19 crisis for their own personal gains, while the EU’s GDPR framework and California’s CCPA have forced firms to beef up their compliance teams.

With $16 million of extra cash in the bank, Evervault plans to continue investing in developing its product and hiring more people — the group currently has only eight employees. It also aims to expand beyond its Dublin headquarters, but this have effectively been put on hold until it’s possible to fly abroad again.