Safeguarding data rather than building walls around the database

“Ireland is geographically nestled between Europe and the US, and growing up here you get a blend of both influences. That’s not to say we don’t have our own strong identity and culture.” Shane told me. “There is something special about the storytelling here. Since the middle ages, Ireland has been world-renowned for music, literature, and the arts: everything from Celtic monks illustrating The Book of Kells to James Joyce and contemporary artists today.”

“Personally, I’ve always had a cultural affinity with the US and deeply resonate with its founding principles — namely, a sense of individual agency and liberty. I think these beliefs are widely held by many in Ireland, which makes Ireland a good place to build a company with deep connections to the US compared to other countries in mainland Europe.”

“There has been a clear cultural shift where these things matter more to younger internet users. Under the hood, cryptocurrencies use tried-and-tested cryptographic primitives like elliptic-curve cryptography (ECC) and have exposed previously-unaware people to the power and importance of cryptography,” he said.

“All of the noise around “crypto” has made it much harder to reinforce a consistent and clear narrative. In the past couple of years, some unnecessarily complex product offerings have directly contributed to overcomplicating the entire space, which has devalued creating a useful product that solves a problem for companies. For most developers, security and privacy are always a priority, but rarely priority #1. These overly complex product offerings in crypto have put people off implementing the best possible security.”

“I think privacy is the end result of well-implemented security. Consumers want their data protected and actively seek privacy in new products. There’s a tension here, however, as very few consumers want to pay for privacy through increased friction or worsened user experience,” he said. “There is a further paradox in how privacy regulation has been designed, in that the only companies that can afford to comply with regulations like GDPR are big tech companies. The people who love to build software don’t typically love reading regulations. Encryption helps with this. GDPR has 99 Articles, but developers just want a few lines of code.”

“Building walls around software sounds great, but the challenge is that security teams need to be right every day, whereas hackers only need to be right once. Relatedly, much of the calories expended in cybersecurity recently have been for tools that detect or monitor cybersecurity incidents rather than creating robust preventative measures,” Shane said.

“The issue isn’t that data breaches happen; most software inevitably gets breached at some point. What does matter is that the data that is leaked or exfiltrated is plaintext data. Theoretically, a company should be able to post their entire encrypted database on a billboard in Times Square and not worry about any sensitive data being leaked. This is where encryption comes into play. We believe encryption is the most important tool in cybersecurity, but it’s also the most difficult tool to implement correctly. Poorly implemented encryption is no better than no encryption at all, so we’ve been very focused on designing a platform that’s secure by default and hard to implement incorrectly.”

“Our core design principle is to craft best-in-class developer experience (DX), but with even better security. This is a lot harder than I initially thought it would be. I had assumed that an average developer had a reasonably strong understanding of encryption and how it should be implemented, but we have had to invest heavily in education. Developers understand why encryption is important, but they frequently assume that it’s not suitable for their use case and will come at a cost down the line.”

“Our goal is to make security the default by making it easy, so that developers can focus on building great products without being forced to make sacrifices. We want to provide developers with all the tools they currently have for processing data, but without restricting them just because they've implemented encryption.”

“Despite the conventional wisdom that startups can easily rebuild things at a later date, the early design choices often become "sticky" and can be difficult to change. This stickiness is why it's crucial to carefully consider design choices and ensure they align with the company's long-term goals, even if it seems way too early.”

“Because every failed request to Evervault is potentially important, like a payment, health record exchange, or authentication flow, we can never afford to drop requests. As a result, we need to be very careful when making changes and releasing updates. This can create tension between the desire to ship quickly and the need to ship correctly. The notion of “move fast and break things” has never been an option in our engineering culture,” said Shane.

“We shouldn’t be as worried about releasing, for example, small developer experience improvements in our Dashboard as we should be with code changes that could potentially degrade the performance of the core infrastructure.”

“It's been difficult to create an abstracted product that is still intuitive and easy to understand for our users. Sometimes products can be a little bit too magical, and we made a number of these mistakes in the earliest days when developers didn’t even realise a feature was working because it happened so seamlessly. That’s been a strange paradox!”

“All encryption does is split a single piece of sensitive data into two parts of sensitive data (the encrypted data and the key). When developers implement encryption, they usually keep the key in the same place as they keep the encrypted data. Doing this defeats the purpose of encryption because a potential attacker who has access to your application just has to take the encrypted data from your database and decrypt it using the key that’s also available to them.”

“For any sensitive data to be stolen, Evervault and our customers must be breached simultaneously. It’s difficult to quantify exactly how much this reduces risk, but the reduction is almost certainly exponential. That being said, with the potential threat posed by state-level actors or well-resourced attackers, we still have to take that risk extremely seriously, so we’ve always designed our security model to just store as little data as possible,” he told me. “Even if somebody managed to get full access to our infrastructure, we don’t store any of our customers’ data and we don’t even store the full key for our customers.”

“The “bank” model also gives us a lot of flexibility to provide our customers with commercial guarantees alongside the technical guarantees, where we can indemnify customers against any potential breaches assuming they have integrated Evervault according to our guidelines.”

“We subscribe to the Werner Vogels philosophy of “Dance like nobody's watching; encrypt like everyone is. Encrypt everything.” Our goal is to encrypt the web, by making encryption accessible enough to a point where building an encrypted app is as easy as building an app without encryption. This will be a forcing function for companies to integrate security much more easily than they currently do. Right now, we’re focused on startups handling sensitive data and folks facing specific compliance like PCI DSS and HIPAA compliance.”

“Our first question during conversations with potential customers is, “what data are you most scared of losing?”. This has been the best way for us to have startups verbalize and think about what they should be securing.”

“Historically, many startups in the "YC trope" have prioritized other aspects of their business over security, often delaying security measures until they lose customers. This almost always happens eventually, and can occur much earlier if the company prioritizes enterprises. While it would be ideal for startups to think about security when building products, the reality is that their survival is most important. Startups need to verify that they are building something people want, and part of that process is identifying who their customers are. Some customers may require security by design, particularly if it handles sensitive data like financial or healthcare information.”

“The challenge in building security startups is that startups feel like they have to win their place in the market, whereas enterprises and incumbents feel like they have to avoid losing the foothold they have built over many years. For a large enterprise, the consequences are generally immediately catastrophic if they get security wrong. Media reports and losing customers generally induce enough anxiety for enterprise CISOs not to sleep well at night. If a startup gets security wrong, the effects may not be as immediately apparent, and a security vulnerability could go undetected for much longer.”

“Startups generally start with compliance as a first step, as they go from selling to other startups to selling to enterprise customers who ask to fill out a security questionnaire before they even look at a demo. At this point, there’s the jarring revelation that they need to “become compliant” — fast. They rush to Google and spew in an alphabet soup of compliance certifications — SOC 2, ISO 27001, PCI DSS, GDPR etc. Six-figure deals hang in the balance. Some great companies make this a lot less painful — we partner with Vanta and Secureframe — but I think it’s a mistake to design security solely for the compliance teams, not for the real enemy — hackers!”

“Security is different to compliance. True security goes beyond just having a security team and checking off a list of basic requirements. Instead, it needs to be a culture and a design consideration throughout the product (and indeed, an entire organization). Only once security is a cultural tenet can a company truly prioritize and protect its security.”

“Encryption hasn’t really changed in the last 100 years. For example, many developers still use the RSA algorithm, first published in 1978. That’s not necessarily bad, though — good encryption is encryption that has stood the test of time.”

“I believe encryption needs a Steve Jobs character who liberates encryption and makes it accessible to normies. Signal’s encrypted messaging and Apple’s privacy strategy in recent years have both been good bellwethers of what’s to come in consumer technology, but the same hasn’t been true for B2B software.”

“FHE allows somebody to manipulate encrypted data while it’s still encrypted — even if they don’t have the keys. That idea has existed in academia since 1978 (less than a year after the publication of the RSA algorithm), but only in the past ten years or so (since the publication of Craig Gentry’s PhD thesis) has there been any meaningful movement on a plausible FHE scheme. FHE is very promising but, unfortunately, still too slow to use for any general-purpose use cases at scale. It also doesn’t solve the challenge of managing keys.”

“Historically, Silicon Valley companies (or companies that aspire to emulate the “Valley mindset”) have had a tendency of over-innovating on organizational design (academically interesting, but impractical examples like holocracy spring to mind here) at the expense of creating net-new technology,” he said.

“We’re building our core team in Dublin. That hasn’t been done before, at least at the scale we’re aiming for. Two of the greatest Irish success stories, Stripe and Intercom, were largely built in the Bay Area before building out operations here. It’s exciting to be part of a cohort (alongside companies like Tines and Inscribe) working on big problems from Dublin. At Evervault, we believe in the office as a center of gravity, and I think that’s lending itself well to the complex problems we tackle every week.”

“Knowing that this effect exists gives founders a superpower in overcoming the effects of Conway’s Law simply by designing a company the same way they want their products to look. Product design and organizational design are inextricably linked. Teams should own an individual product but still derive cohesion and interoperability from a simple reporting structure and clear communication between teams.”