Security credibility

At a time when data security is top-of-mind for companies large and small, one of the biggest hurdles that startups confront when selling to enterprises is the lack of an effective data security program.

A startup hoping to sell to Nike, for instance, will likely face a very demanding IT security assessment before the multi-national juggernaut entrusts the startup with its customer data. The complexity of that assessment might delay the sales process for weeks, and if the startup’s security protocols don’t stack up, all that work will have been for nothing.

SafeBase wants to help startups avoid those pitfalls. The company, recently co-founded by Stan Chang, Adar Arnon, and Al Yang, integrates cloud security applications to automatically monitor, maintain, and present a startup’s security programs for potential customers and the general public.

“There is a niche where startups aren’t ready to pay the big money for a full-on audit of their security systems,” said Chang, who alongside Arnon, earned an MS/MBA from the John A. Paulson School of Engineering and Applied Sciences and Harvard Business School in 2020. “We help them stand up those individual systems through an automated process, but more importantly, we want to show off their work through a public-facing security status page that they can host on their website.”   

The startup grew out of the MS/MBA program, where Chang and his co-founders initially focused on helping small businesses streamline the process of responding to data deletion requests from customers, to comply with the  European Union’s General Data Protection Regulation and the recently-enacted California Consumer Privacy Act.

After entering the Y Combinator startup accelerator in June, the co-founders turned their focus to constructing data security programs, a major pain point for many startups, Chang said.

Through an automated onboarding process, SafeBase customers answer a series of simple questions about their security programs, such as whether they utilize OAuth 2.0 for user login or enforce 256-bit Advanced Encryption Standard encryption on their data at rest. The SafeBase software verifies that information through integrations with the most popular cloud tools, and then automatically generates a status page summarizing a startup’s security systems.

“We take this jumble of different things and organize it, making it very easy to understand for both the startup and whoever is visiting the status page,” Chang said. “Our customers can customize that status page, so they configure how customers view the information. And the page is connected to their systems, so that all of the information displayed remains up-to-date.”

One of the biggest challenges the co-founders have faced is building out the integration framework that automatically generates the status page. The software must be able to connect structured data from many different sources.

“How Google reports security settings is different from how Amazon reports them,” he said. “Making sense of everything and then pulling it all together in a unified view with useful insights is our biggest challenge now from a technical perspective.”

Chang and his co-founders have relied on the leadership learnings and technical aptitude they refined during the MS/MBA program to tackle that challenge and overcome the hurdles of launching a startup during the era of COVID-19.

Adapting to remote work after Harvard shut down its campus in mid-March was difficult at first, Chang said. The team adjusted to the new reality, and even found some silver linings to being in the first-ever remote Y Combinator class. For instance, Chang has found it easier to get “face time” with mentors all over the country via videoconference. The advice they’ve received from Y Combinator staff and alumni has been invaluable as they continue to reach out to potential customers, listen to feedback, and drive their ideas forward.

“No one sees how hard it is at the beginning, where you have this grand vision, but you have to scope it down to the smallest thing that you can build today,” he said. “That’s the toughest thing I had to wrap my head around.”

In the short term, the team is focused on growing their customer base and building out the product, enhancing and smoothing out the automation process.

For Chang, who has aspired to launch a startup for years, the process has been nerve-racking and exciting.

“If I’d faced these challenges five years ago, such as going fully remote this early on in a startup’s life, I most likely would have just given up. But after going through this two-year experience at Harvard, I’ve learned that as a team, we are working towards a common goal, and that it is crucial to keep having difficult conversations without putting our egos on the line,” he said. “This is the farthest I’ve ever come to building a company and the growth I’ve experienced has been highly rewarding.”