In November 2022, Neha Nupoor left Uber with one day's notice. The way she tells it, she wore a smile as large as the one in the photograph. It is a useful opening image because nothing that followed was especially tidy. There was a co-founder, a coveted place in Y Combinator's Winter 2023 batch, and, at first, no settled idea. There was also the practical residue of her old job: the memory of what it takes to make artificial intelligence behave inside a company large enough to have teams, systems and data scattered around the world.
Nupoor and Kaushik Srinivasan had worked on customer-support AI at Uber. One problem was stubbornly unglamorous. Preparing and cleaning the training data took more than three months, assembled from multiple teams. The models attracted the excitement; the dataset swallowed the calendar. Their first company answer was FiddleCube, a platform for generating synthetic data to fine-tune language models. In her launch announcement, Nupoor proposed examples that ranged from a children's model speaking like Dora the Explorer to an open model trained to write code. The pitch was broad, technical and cheerfully concrete.
The useful thing hiding behind the model
Her attraction to the work was not framed as destiny. She described YC as a place to explore curiosities and learn whatever she wanted. That matters because FiddleCube would not remain still. As generative AI moved from experiments into browsers, copilots, chat boxes and ordinary workplace software, the enterprise problem changed shape. Companies no longer worried only about how to prepare data for a model. They had to ask where their data went after everyone started using one.
FiddleCube became Compliant LLM. The new focus is the traffic between employees, third-party AI tools and company information: sensitive details in prompts, unauthorized access, prompt injection, embedded AI features, and the awkward reality that an approved application can contain an AI system that nobody separately approved. The company's vocabulary now includes data-risk observability, adversarial testing, policy enforcement and audit trails. The nouns grew stern. The underlying instinct did not change much. Nupoor kept following the operational mess around AI.
That continuity is more revealing than the pivot itself. At Uber, she led automation of customer support using AI agents and real-time workflows, work credited with cutting annual operating costs by tens of millions of dollars. FiddleCube tried to compress the time required to create useful training material. Compliant LLM tries to reveal and govern what happens after AI is loose in an organization. In each case, the model is only the glamorous object in the middle. Nupoor's attention lands on the machinery around it.
An engineer who leaves the notebook open
Long before the security language, Nupoor left a public trail of smaller experiments. She wrote tutorials on RiotJS, Webpack 4, Vue and JavaScript interview questions. One HackerNoon tutorial showed readers how to build a custom Node command-line tool. The sample command was “Cthulhu,” and its purpose was to wake the fictional monster. Enterprise software could use more sea monsters. The piece ended with an invitation for constructive feedback and a note that she needed to improve her photographs of sticky notes.
The archive is not merely technical. Her Medium biography bundled “Javascript. Doodling. Fitness. Life.” She wrote about reading, manners, work and the friction of saying no. In one childhood memory, a crowded house sent her under the bed with a book so nobody could interrupt. She read enough Hindi fiction to grow bored with the language lessons at school, then chose Sanskrit and became fascinated by Kadambari, the labyrinthine seventh-century story by Banabhatta. This is not the usual path into enterprise security, which may be precisely why it is interesting.
At Jabalpur Engineering College, where she studied from 2008 to 2012, her listed projects concerned smart antennas for CDMA systems and the design of a microstrip patch antenna in the Ku band. She interned at Scientech Technologies and Delhi Metro Rail Corporation. Later came software roles, including Directi and Primaseller, and then Uber. A former Primaseller colleague described her as meticulous and technically strong in JavaScript, while also remembering her as a doodler. It is an unexpectedly accurate miniature: precision, code and a pen wandering in the margin.
The governance air gap
In 2025, Nupoor gave the current problem a memorable name: the “governance air gap.” Traditional security products can see network traffic, yet natural-language prompts, multi-turn context and agent actions do not behave like ordinary malicious signatures. An AI gateway may inspect a narrow point in the path while missing embedded AI elsewhere. Meanwhile, an employee can paste proprietary material into a tool because it is useful, because it is fast, or because the AI feature appeared overnight inside software the company already pays for.
Where the control moves
Conceptual, not performance data: the product story moves from seeing AI use, to testing its behavior, to applying a rule with an audit trail.
Compliant LLM's proposed answer is a control plane that understands intent, scores risk in real time, applies policy and leaves an explainable record. Its open-source toolkit tests prompts, agents, models and MCP servers against attack strategies and maps results to frameworks such as NIST AI RMF and ISO 42001. The commercial site extends the promise toward continuous monitoring of approved and unapproved tools. The desired outcome is not to ban AI. Nupoor argues for controls that let employees use it while security, risk and engineering teams can see what is happening.
There is a neat founder lesson here, though neatness should not be confused with ease. FiddleCube and Compliant LLM look like different companies when reduced to category labels. Synthetic data helps a model learn; security controls constrain what a deployed system may do. Yet both products emerged from the same uncomfortable observation: AI systems create work outside the model. Data must be assembled. Behavior must be tested. Decisions must be audited. Somebody has to turn a probabilistic machine into an accountable business process.
A team before an idea
Nupoor has thanked YC partners Harj Taggar, JJ Fliegelman and Diana Hu for encouraging bigger thinking, offering timely guidance and asking hard questions. Her warmest line about the program was also the most revealing: YC accepted her and Srinivasan when they were “just a team without an idea.” The mythology of startups prefers the lightning-bolt idea. Her version gives priority to the partnership capable of surviving the search.
Srinivasan brought experience from payments at Google Pay and customer-support AI at Uber, where he met Nupoor. She brought the operating knowledge of real-time AI workflows and automation at scale. Together they could recognize the distance between a model demonstration and a system a company can trust. Their first answer was to improve the data. Their next was to watch the boundary. Both are forms of translation: research capability into business use, and business policy into machine behavior.
What the pivot preserved
The stealable idea in Nupoor's route is not “follow the trend.” It is nearly the opposite: follow the recurring friction closely enough to notice when its most valuable expression changes. Training data was the visible bottleneck when teams were adapting models. Once those models entered daily work, visibility itself became the bottleneck. The startup moved from manufacturing better inputs to monitoring risky ones. That is a substantial product change, but it preserves the team's accumulated knowledge of how enterprise AI actually gets built and used.
It also preserves a habit visible in Nupoor's earliest writing. Her tutorials break unfamiliar machinery into steps, expose the configuration and invite the reader to try it. Compliant LLM applies a similar preference at organizational scale. A security team should not receive a mysterious red light. It should be able to replay an interaction, understand why a threshold was crossed and connect the event to a policy. Explainability, in this version, is not a decorative principle. It is the difference between an alert that can be acted upon and one that becomes part of the wallpaper.
Her 2025 argument ends on a carefully chosen destination: responsible innovation in which employees can use GenAI with confidence while leaders can quantify risk reduction and business value. The ambition contains its own tension. Every added control can create drag; every missing control can create exposure. Compliant LLM is betting that semantic, context-aware inspection can make the trade less crude than a blanket prohibition. The company is attempting to build a guardrail that understands the road.
The company remains small. Y Combinator lists a team of three in San Francisco. Smallness gives the story its proper proportion. This is not a tale of a finished institution or a conquered market. It is a portrait of a founder choosing where to stand as the ground moves. The AI boom keeps producing dazzling outputs. Nupoor is looking in the less photogenic direction, at the permissions, logs, prompts and exceptions piling up behind them.
Once, she designed an antenna to catch a signal. Now she is building software to catch the moment a conversation with AI crosses a line. Between those points sit a hidden reading spot, doodles, JavaScript, Uber support tickets, synthetic datasets, a YC sign and a monster named Cthulhu. The route is not straight. It is, however, consistent in the way that matters: open the box, understand the system, and make the invisible part legible.