Building a Privacy Startup From Zero to Exit, and Leading Its Turnaround When It Failed

The challenge

For a privacy product, credibility is the product. People who use a VPN, encrypted email or secure calls have to trust that nobody can read their data, including the company that runs the service. When I joined as co-founder in 2014, there was no product, no team and no code.

The market was global, and many of the people who needed privacy most lived in countries with heavy internet censorship. The product had to work for them, at a price that let the company pay for itself.

After the first phase, revenue exceeded costs. Then investors took over and the founding team, including me, left. Within about 12 months the company was in serious trouble: its security-critical systems needed context that the new team didn’t have, and the investors asked me to return.

My task: in Phase 1, build the product, the team and the business from zero. In Phase 2, stabilise the company, restore its security standards and prepare it for sale.

What does privacy by design mean for a product like this?

Privacy by design means the protection of personal data is built into the system itself. In its strongest form, often called zero-knowledge or zero-access design, the operator has no technical way to read user content, because the data is encrypted and the keys stay with the user. Open-source components make that claim checkable, because anyone can audit the code. The EU later made “data protection by design and by default” a legal duty in Article 25 of the GDPR, which has applied since May 2018.

What I did

1. Built a privacy and security platform from zero as CTO and co-founder

   I joined before any product, team or code existed. I led the market research, the competitive analysis, the full technical architecture and a distributed engineering team. The platform combined a VPN with Tor integration, encrypted email, secure chat and video calls based on WebRTC, an anonymous proxy and encrypted file storage, sold as a SaaS subscription to people and businesses.

   Technical details

   • Infrastructure: 30+ VPN server locations for users in 60+ countries.
   • Platforms: apps for Windows, Mac, Linux, iOS and Android.

2. Designed security so that even the operator had no access to user data

   I built the communications infrastructure so that even the operator had zero technical access to user data. It was a design constraint, enforced by the architecture. The stack used only open-source components, chosen so that every component could be audited independently.

3. Took the product into the Arabic-speaking market

   I led the research that identified the Arabic-speaking market as a high-priority target: nearly 130 million internet users, high government censorship and Skype blocked in several countries. I built the business case, and in April 2015 we launched a localized Arabic site for the 24 countries where Arabic is an official language. This was a business decision before it was a technical one. By the end of Phase 1 the company had 20,000+ users and 1,200+ paying subscribers, monthly revenue had grown 120x in 11 months, and revenue exceeded costs.

4. Returned to lead the turnaround: diagnosed, simplified and stabilised

   When the investors asked me back, the goal was stability. I diagnosed what had degraded, restored the security standards, reduced operational complexity and rebuilt the team’s clarity, with people who had not built the original system. Phase 2 meant deciding what to cut: fewer services, simpler operations and technical debt removed selectively. Every technical decision was filtered through cost and sustainability.

5. Prepared the platform for due diligence and a sale

   The Phase 2 mandate included making the platform understandable to any external party: operational clarity, a clear security posture and architecture documentation good enough for due diligence. The company was then successfully sold.

   Technical details

   • What buyers check in technical due diligence: the team and how much depends on one person, architecture and infrastructure, delivery processes, documentation, and security and compliance, including open-source licence obligations.

Results

Across the two phases, the work delivered:

• A privacy and security platform built from zero: VPN with Tor, encrypted email, secure chat and video calls, anonymous proxy and encrypted file storage.
• 20,000+ users and 1,200+ paying subscribers in Phase 1, with monthly revenue up 120x in 11 months and revenue above costs.
• Users in 60+ countries and 30+ VPN server locations, including an Arabic-language launch for the Middle East.
• A turnaround in 2016 to 2017: security standards restored, operational complexity reduced and a team that could run the system.
• A platform ready for due diligence, and a successful sale of the company.

What I learned

Deciding what to cut is as hard as deciding what to build, and just as important.

In Phase 1 the work was to build: the product, the team and the market. In Phase 2 the work was to subtract: fewer services, simpler operations and technical debt removed selectively, with every decision filtered through cost and sustainability. The decline between the two phases also showed how much a security-critical system depends on knowledge that lives in people’s heads. Making the platform understandable to people who did not build it is what made the company stable again, and ready for a buyer.

Evidence and further reading

• Article · The Hacker NewsPrivatoria: best VPN service for fast, anonymous and secure browsingA review of the service, which it called “one of the best VPN services” (October 2015).
• Press release · NewswireSecurity provider Privatoria enters the Arab marketThe Arabic-language launch and the research behind it (April 2015).
• Service · this siteOperation Partner: managing partner, co-founder, board memberHow I join companies as a co-founder or operating partner today.
• Related projectFounder of Topping, a web statistics platform built from scratchAn earlier company I founded and built from zero.

More about Privatoria: EU-Startups, ProPrivacy, PressRelease and Crunchbase.

Skills and technologies

• Startup CTO
• Co-founder
• Technical turnaround
• Crisis leadership
• 0-to-1 product building
• Privacy by design
• Zero-knowledge architecture
• Security architecture
• VPN
• Tor
• WebRTC
• Encrypted email
• Open-source stack
• SaaS (B2B and B2C)
• Market research
• International expansion
• Due diligence readiness
• Exit preparation
• Team building

← All projects