He spent a million dollars on compliance before writing a product feature. Then he turned that tax into a $105 million company.
Mahmoud Abdelkader was sitting in the rubble of a company he had just sold when his old customers started calling. They didn't want the payments business Balanced Payments had built. They wanted the invisible scaffolding underneath it - the year's worth of security work, the million dollars in compliance infrastructure, the legal and regulatory plumbing that nobody ever talks about. They just wanted to handle sensitive data without handling sensitive data.
That call - arriving not from a eureka moment but from practical need - became Very Good Security. In 2016, Abdelkader and his Balanced co-founder Marshall Jones turned their compliance education into a product: a proxy layer that sits between companies and their customers' sensitive data, tokenizing it before it ever touches a company's servers. Zero Data. Handle everything. Own nothing.
By 2020, VGS had raised $60 million in a single round from Andreessen Horowitz, Goldman Sachs Growth, and Visa - three of the most powerful names in finance and venture, betting together on one Egyptian-American founder from Bay Ridge, Brooklyn. Total raised: $105 million. Customers: 700+, including Fortune 100 companies. Category created: data security as a service.
After six years building the company to scale, Abdelkader stepped back in late 2022, handing the operational reins to a new CEO. He now invests in the next generation of fintech infrastructure - Ramp, Vercel, Alloy, Mercury, Stytch - and experiments with AI from his website at mahmoudimus.com, where his online handle stands as a Latinized reminder that he never took himself too seriously.
Every company is a data company. Most of them just don't know it yet.
- Mahmoud Abdelkader, VGS Co-FounderBorn: Ismailia, Egypt (near Suez Canal)
Raised: Bay Ridge, Brooklyn → Maryland
Education: BSc Computer Engineering, University of Maryland
Online handle: @mahmoudimus
VGS HQ: 207 Powell St, San Francisco, CA
Interests: Cryptography, reverse engineering, AI, fintech
Mahmoud Abdelkader grew up 60 kilometers from Cairo, in Ismailia - a city built by the Suez Canal, where his uncle served as a tugboat captain for the Suez Canal Authority. In 1992, when he was eight, his parents made a calculation: the United States offered something Egypt could not. Better opportunities for their children. They left without speaking a word of English.
The arithmetic of that decision shaped everything. His father, who had been a CFO in Egypt, found work as a deli line cook in Brooklyn. His mother, who had worked for Egypt's tax authority, started as a dry cleaner cashier, eventually rose to regional director at Sears, then returned to school at 45 to earn her accounting degree. The household ran on a simple standard: a 98 on an exam was not a cause for celebration. "Why wasn't it a 100?" The question, repeated often enough, becomes a work ethic.
The family settled in Bay Ridge, Brooklyn - PS 185, Eckert Heights Middle School - before relocating to Maryland in 2000, where Mahmoud attended Dulaney High School and went on to study Computer Engineering at the University of Maryland, College Park.
"I don't think I would be where I am today, without being an immigrant. It's just realizing that you really have nothing to lose."
This isn't startup-founder modesty. Abdelkader watched his parents rebuild their lives from zero, twice - once in America, once again when they pushed themselves further. The pattern became his default setting: when you've seen what 'starting over' actually looks like, launching a company stops being scary.
Post-college, Abdelkader built high-frequency trading systems and algorithmic trading platforms at Wachovia Securities (now Wells Fargo). He was there when the 2008 financial crash hit. The formative encounter with system-level failure - watching the infrastructure of global finance buckle - made risk legible in a way no classroom could.
The observation was simple: every company in a regulated industry has to build a compliance function. PCI-DSS for payments. HIPAA for health. SOC 2 for enterprise software. Most end up constructing "a secondary company inside of their own company" - Abdelkader's phrase - just to meet legal obligations that have nothing to do with their actual product.
VGS's core concept: companies handle sensitive data without storing it. A tokenization layer replaces real card numbers, SSNs, and credentials with aliases before they touch a company's servers. Use the data. Own nothing that can be breached.
LendUp (now Mission Lane) went live in under a month using VGS, instead of the typical year-long compliance build. This "aha moment" confirmed the model: the pain Balanced had absorbed for $1M could be sold as a product to every regulated company.
VGS created and leads what it calls "data security as a service" - a new category between security vendors and payment processors. PCI, SOC 2, HIPAA, GDPR compliance acceleration. 700+ customers. DoorDash, Brex, and Fortune 100 names among them.
Moving payment instruction is just moving data. Why can't we move data of any type similarly?
- Mahmoud Abdelkader on the insight behind VGSI don't think I would be where I am today, without being an immigrant. It's just realizing that you really have nothing to lose.
On the immigrant mindsetIt took us about a year and a million dollars of investment just so that you can build a security posture so you can start building your payments business.
On founding Balanced Payments - the pain that created VGSSecurity is an obstacle to usability.
The observation that sparked VGSThis margin is my opportunity.
On identifying market gapsBeing a CEO is now a risk-management game. It's like how do you minimize the risk while continuing to try shareholder value and achieving the mission.
On the evolution of the founder roleInvest in relationships early. Make sure you surround yourself with the people that you want to work for and work with.
Advice to younger foundersThere is a specific type of founder who builds companies out of frustration rather than aspiration. They are not chasing a market; they are solving a problem they personally suffered. Mahmoud Abdelkader is that type of founder - twice over.
Before Y Combinator, before VGS, before everything, Abdelkader was employee number four at Milo.com, a startup building automated product matching systems under CEO Jack Abraham. He helped grow it from a small team to 35 people. In December 2010, eBay acquired Milo for $75 million. It was his first complete view of the startup arc - from early chaos to exit - and it came before he turned 30.
The lesson was not about wealth. It was about pattern. A tight, talented team, a clear technical problem, a market that needed the solution: the formula was repeatable.
The next pattern came out of Y Combinator's Winter 2011 batch. Balanced Payments - co-founded with Matin Tamizi and Jareau Wade, all Milo alumni - built developer-friendly payment processing for peer-to-peer marketplaces. Abdelkader served as CTO. They raised $3 million. Then came the tax: before writing a single product feature, they spent $1 million on compliance and security infrastructure. PCI-DSS requirements, legal review, security posture. A full year. A full third of their capital. Just to be allowed to touch payment data.
When Stripe acquired Balanced in 2015, Abdelkader walked away with something more valuable than the exit: he understood exactly what the compliance layer cost, how long it took, and how many companies were paying that same tax independently. Every fintech. Every healthtech. Every regulated SaaS business. They were all building the same invisible scaffolding, separately, expensively, and badly.
The founding story of VGS is not a garage epiphany. It's a phone ringing. Former Balanced customers, after the Stripe acquisition, calling to ask if they could get just the security infrastructure piece. Not the payments. The vault. The proxy. The compliance layer.
Abdelkader and Marshall Jones - Balanced's VP of Engineering - said yes. They built VGS in 2016 as a pure data security play: a transparent proxy that intercepts sensitive data, replaces it with a format-preserving token, and stores the original in a certified, audited vault. Companies interact with the token as if it were the real data. VGS holds the actual sensitive information. If a company gets breached, there's nothing to steal.
The first real proof: LendUp (later Mission Lane) deployed VGS and went live in under a month, instead of the typical year-long compliance build. Abdelkader has called this the "aha moment" - the point when the abstraction became a product, and the product became a category.
In November 2022, Abdelkader published "Passing the baton of leadership at Very Good Security" on LinkedIn. After six years and three funding rounds, VGS had become a genuine company: 700+ customers, Fortune 100 logos, a category it had created. He described the company as being "in excellent hands" and himself as deserving a sabbatical to recharge. Chuck Yu became CEO in April 2023, bringing a Visa background to a company whose most prominent investor was also Visa.
Abdelkader now operates as an investor and advisor. His portfolio includes Ramp (corporate card infrastructure), Vercel (frontend deployment), Alloy (identity decisioning), Envoy (workplace OS), Mercury (banking for startups), and Stytch (developer-focused authentication) - a coherent thesis around financial and developer infrastructure. His website describes him as "experimenting with AI," consistent with someone who understands that data security and AI are about to become the same conversation.
After stepping back from VGS's day-to-day, Abdelkader backed companies building infrastructure for the next decade of fintech and developer tools. The pattern: software that sits under other software.
His username "mahmoudimus" is a playful Latin-style conjugation of his own first name. It appears on GitHub, Twitter/X, and his personal site. He's had it since the early internet. A nerd move that aged well.
His uncle was a tugboat captain for the Suez Canal Authority in Ismailia, Egypt - the canal that connects the Mediterranean to the Red Sea. Abdelkader grew up 60km from Cairo, near one of the world's most important trade routes. Infrastructure ran in the family.
He was on a Wall Street trading floor during the 2008 financial crisis. He was raising a $60M round in December 2020 - mid-pandemic. He has watched two of the largest systemic shocks of the 21st century from inside the action, both times kept building.
At Balanced Payments, Abdelkader spent $1 million of a $3 million raise - one third of the company's capital - on security and compliance before a single product feature. That lesson became VGS. Sometimes your biggest problem is your best product idea.
His GitHub (github.com/mahmoudimus) contains projects on cryptography, reverse engineering, and security tooling. He lists reverse engineering among his passions. The man who built the world's data vault does it in his spare time, for fun.
His household graded achievement on an unforgiving scale. A 98 on an exam wasn't celebrated - "Why wasn't it a 100?" was the question. His mother went back to school at 45 to earn her accounting degree. The standard was never external. It was built-in.