Cloud providers can access your data. DRIVUNO was architected so they never can.
Next-generation European sovereign secure storage and communication infrastructure built on true zero-knowledge architecture. Engineered for governments, defense-adjacent enterprises, regulated industries and high-stakes professionals.
🇫🇷🇯🇵French & Japanese Technology🇪🇺European Infrastructure🔐Zero-Knowledge by Design🌍Global Resilience
Modeled on the canonical privacy-SaaS S-curve (Proton, NordSec, Bitwarden): slow PMF years, then acceleration once enterprise & sovereign contracts compound, then natural late-stage deceleration. Net = after Stripe fees, storage, infra, payroll and S&M.
Y10 Gross
$0M
Y10 Net
$0M
Proton AG
~$130M @ Y10
Privacy-suite benchmark
NordSec
~$300M ARR
Privacy + VPN bundle
Tresorit
~$45M ARR
ZK enterprise-only
DRIVUNO Y5
$35M base
PMF + early enterprise
DRIVUNO Y10
$450M gross
Multi-jurisdiction stack
Forward-looking model. Net margin scales from negative (Y1–Y2 investment phase) to ~49% (Y10) as fixed costs amortize over recurring ARR. ARPU hypothesis: blended $18/mo (45% Starter $9.99 / 35% Premium $19.99 / 15% Pro $29.99 / 3% Deluxe $49.99 / 2% Business $19.99/seat).
TAM (2030)
0.00T$
Global cloud + security + privacy
SAM Sovereign
0B$
Privacy & sovereign segment 2030
Gross margin
0%
Realistic at scale (Year 5)
Churn target
0%
Privacy lock-in effect
The Problem
The world stores its secrets on infrastructure that can read them.
Every year, governments issue thousands of data access requests. AI systems scan billions of files for moderation and training. Major breaches expose plaintext sensitive information. Enterprises lose strategic control over IP, R&D and confidential assets.
The global cloud market exceeds $1.2 trillion today and is projected to surpass $2.3 trillion by 2030. Yet nearly every major provider operates on the same flawed trust model: they hold the keys.
GoogleMicrosoftDropboxAppleSlackProton (partial)
Different interfaces. Same vulnerability.
Global cloud market — $B
Our Thesis
Privacy and sovereignty must be mathematically enforced — not promised.
Server compromise
Ciphertext only — nothing usable to exfiltrate.
Database leaks
Same encrypted bytes we hold; useless without user keys.
Government requests
We can only produce what we have: encrypted blobs.
Rogue insiders / M&A
Architecturally cannot read; not a policy promise.
DRIVUNO = European Sovereign Cloud Infrastructure, not "yet another secure Dropbox".
Why Now
Three converging mega-trends. A 24–36 month window.
01
AI Era
Enterprises refuse to feed strategic assets into provider-controlled environments enabling scanning and model training.
02
Digital Sovereignty
Europe is investing billions (GAIA-X successors, Cloud Sovereignty Framework, EURO-3C) to cut non-EU dependence.
03
Cyber & Resilience
Ransomware, state-sponsored attacks and supply-chain risks accelerating. NIS2, GDPR and the upcoming Cloud & AI Act mandate secure-by-design.
Technology Moat
Not another encrypted drive — a full sovereign infrastructure layer.
Zero-Knowledge Vault
Client-side Argon2id + X25519 + XChaCha20-Poly1305. Keys never leave the device.
DRIVUNO Rooms
E2EE team chat, threads, files and P2P audio/video calls — the workspace layer no storage vendor has.
Live Clone
Continuous, differential, hash-verified encrypted backup of any folder or drive.
Encrypted Photos
Blind-index timeline, encrypted thumbnails, mass mobile upload — zero metadata leakage.
Protected Sharing
Single-view, no-download, expiration, automatic watermarking, ZK fragment links.
EU + Japan candidates pre-registered (OVH, Scaleway, Hetzner, Sakura, IIJ, GMO).
2026 Product Wave · Shipped & Live
We stopped being a vault. We became the encrypted workspace.
In a single development cycle DRIVUNO shipped eight production capabilities that each map to a separate paid category — team messaging, meetings, device backup, photo storage, shared drives. All of them run on the same zero-knowledge key hierarchy, so every new module raises the value of the account without raising the trust surface. This is the shift from a storage utility to a daily-use platform — and it is the single biggest driver of the revenue plan below.
Rooms
End-to-end encrypted team workspace
Slack-class channels, threads, mentions, reactions, rich formatting, read receipts, per-room identities and roles (Viewer / Creator / Moderator / Admin). Every message, subject and attachment is sealed on-device.
Revenue impact — Turns storage into daily-use software. Replaces a Slack line item — the strongest per-seat expansion lever we have.
Calls
P2P audio & video, DTLS-SRTP
Peer-to-peer meetings with Realtime signalling only — no media ever transits our servers.
Revenue impact — Removes the last reason a privacy-first team keeps Zoom or Teams alongside us.
Live Clone
Continuous encrypted device backup
Link a folder or an entire drive; differential, hash-verified, always-on encrypted sync with cross-device visibility.
Revenue impact — Backup is the highest-retention category in consumer cloud. It also drives quota consumption straight into plan upgrades.
Photos
Zero-knowledge photo library
Mass mobile upload, encrypted thumbnails, EXIF-based blind-index timeline, lightbox and ZIP export — all without the server learning a single date or filename.
Revenue impact — The #1 reason households pay for cloud. Opens the consumer volume funnel that feeds the paid mix.
Team Drive
Multi-user vaults with sealed per-member keys
Real folder hierarchy, roles, instant invitations, key rotation on removal, encrypted previews and activity notifications.
Revenue impact — Unlocks the Business per-seat plan and multi-seat contracts instead of single-user subscriptions.
Speed
Streaming crypto + resumable transfers
secretstream XChaCha20-Poly1305 with worker-pool decryption: large files start instantly instead of minutes. Chunked, resumable mobile uploads survive flaky networks.
Revenue impact — Performance was the top pre-purchase objection. Removing it lifts trial-to-paid conversion directly.
PWA & Push
Installable mobile app with notifications
Home-screen install on iOS and Android, Web Push for messages, mentions and team activity, offline email digests.
Revenue impact — Daily active usage on mobile — the strongest predictor of retention and of the 12-month LTV assumption.
Resilience
One-click disaster recovery
Warm-standby deployment, dual-region encrypted snapshots (Backblaze Object Lock + Scaleway Glacier), sovereignty auto-failover and a public status manifest.
Revenue impact — Passes enterprise procurement and security questionnaires — the gate to five-figure annual contracts.
How the 2026 wave compounds into MRR
Lever
Storage-only
With the workspace
Mechanism
Seats per paying account
1.0
3–8
Rooms + Team Drive convert single users into teams
Plan mix (Pro & above)
22%
40%+
Photos + Live Clone consume quota fast
Monthly churn
3.5%
<1.5%
Daily chat usage and always-on backup create switching cost
Blended ARPA
$20.99
$45–70
Per-seat Business pricing on top of storage
Budget replaced
Storage only
Storage + chat + backup + meetings
One line item instead of four vendors
One vendor, four budgets
A 20-person team pays Slack + Zoom + Dropbox + Backblaze. DRIVUNO replaces all four with one encrypted, sovereign line item — at a lower total cost and a higher ARPA for us.
Viral by construction
Every room invitation, shared team folder and public share link puts DRIVUNO in front of a non-customer with a reason to sign up. Acquisition cost trends down as usage grows.
Retention by design
Chat history, always-on backup and the photo library are impossible to abandon casually. Switching cost, not a contract, is what protects the MRR base.
Market Opportunity
TAM > $1T. Sovereign privacy segment growing 35%+ CAGR.
Privacy & sovereign segment trajectory — $B
Cloud Storage
$160–200B → $800B+ by 2034
Cybersecurity
$300B+ and growing
Secure Collaboration
$70B+, fastest-growing slice
EU Sovereign Procurement
Multi-billion public + private
Competitive Landscape
Same trust model. Different logos. Except one.
Feature
Google / OneDrive
Dropbox
Proton
Tresorit / Sync
DRIVUNO
Zero-Knowledge default
✕
✕
◐
✓
✓
Client-side encryption
✕
✕
✓
✓
✓
Provider cannot decrypt
✕
✕
✓
✓
✓
E2EE team chat (channels, threads, files)
✕
✕
◐
✕
✓
Encrypted audio / video calls
✕
✕
✕
✕
✓
Continuous device / folder backup
◐
✓
✕
◐
✓
Encrypted photo library (timeline, EXIF)
◐
◐
✓
✕
✓
Shared team drive with per-member keys
◐
◐
◐
✓
✓
Protected single-view + watermark
✕
◐
◐
◐
✓
Multi-jurisdiction sovereignty
✕
✕
◐
✕
✓
Immutable backups + failover
◐
✕
✕
◐
✓
Positioning: Proton excels at individual privacy as a productivity suite. DRIVUNO is built as sovereign infrastructure with deeper enterprise resilience, professional collaboration and multi-jurisdiction capabilities.
Business Model & Projections
High-margin recurring revenue. Privacy-SaaS economics at scale.
ARR projection — $M (low / base / high)
Margin trajectory — %
5-year base case (conservative)
Year
Paying users
ARR ($M)
Gross %
EBITDA %
Milestone
Y1 (2026-27)
6–10k
1.2–2.4
60–65%
negative
PMF, EU launch, apps GA
Y2
20–35k
4–7.5
70–75%
−10% to +5%
Teams & Mailbox GA, first regulated pilots
Y3
40–70k
8–15
76–80%
10–25%
First sovereign contract, SecNumCloud in flight
Y4
75–120k
14–26
79–83%
25–35%
Multi-jurisdiction (JP), enterprise scale
Y5
130–210k
26–48
81–85%
35–45%
Category leader, Series B / IPO-track
Revenue mix at Y5
Consumer (Starter/Premium)
28%
Pro / Deluxe
32%
Business / SSO
28%
Enterprise / Sovereign
12%
Blended ARPU
$17–19/mo
45% Starter · 35% Premium · 15% Pro · 3% Deluxe · 2% Business
Churn target
<8% annual
Privacy lock-in & key custody
Net revenue retention
>120%
Storage upsell + seat expansion
Go-To-Market
Sequenced from privacy-pro SMBs to sovereign government contracts.
Phase 1 — Now
Privacy-conscious professionals & SMBs: freelancers, law firms, consultancies, deeptech startups.
Phase 2
Mid-market enterprises across regulated verticals.
Phase 3
Large Enterprise + Regulated: healthcare, finance, legal, industrial IP.
Phase 4
Governments, defense-adjacent, sovereign private instances.
Why Europe Can Win
The next decade belongs to European sovereign infrastructure.
For two decades Europe consumed US cloud services. DRIVUNO is purpose-built in France and the EU to become the strategic, resilient alternative to US-dominated ecosystems. Privacy, sovereignty and mathematical security are becoming mandatory infrastructure layers, not optional features.
Unit Economics
Privacy-SaaS economics — capital-efficient by construction.
CAC (blended)
$28
Self-serve & content-led; <$15 on consumer, $180 mid-market, $4–9k enterprise.
LTV (blended)
$540
ARPU $18/mo · gross margin 82% · churn 7% annual.
LTV / CAC
19×
Best-in-class for SaaS (benchmark: 3× good, 5× great).
Storage upsell, seat expansion, team & mailbox add-ons.
Rule of 40
78
Growth 60% + EBITDA 18% at Y3 — top quartile public SaaS.
Benchmark vs comparables: Proton (~30% growth, ~75% GM), Dropbox (~7% growth, ~82% GM), Box (~6% growth, ~76% GM). DRIVUNO targets higher GM at scale (82–85%) thanks to B2/Scaleway infra (~$6/TB) vs AWS/Azure (~$23/TB), and zero-knowledge architecture which removes server-side compute cost for moderation, scanning and AI ingestion.
Regulatory Tailwinds
Five EU regulations turn DRIVUNO from 'nice-to-have' to 'mandatory procurement'.
NIS2In force since Oct 2024 — enforcement ramping 2025–26
Network & Information Security Directive 2
Scope: ~160,000 EU entities across 18 sectors (energy, health, finance, public admin, manufacturing, digital infra).
Trigger: Mandates encryption, access control, incident response. Personal liability for executives (fines up to €10M or 2% global turnover).
Scope: All EU financial entities + their critical ICT third-party providers.
Trigger: Forces banks, insurers, asset managers to audit & exit non-resilient cloud vendors. Concentration risk on US hyperscalers is now a board-level issue.
Scope: All cloud & data-processing services operating in EU.
Trigger: Mandatory cloud switching rights, interoperability, ban on lock-in egress fees. Customers can leave hyperscalers without penalty.
DRIVUNO edge: DRIVUNO is the destination — open formats, no egress lock-in, BYO-key, exportable encrypted bundles.
Schrems IIActive since 2020 — enforcement intensifying 2025+
C-311/18 + EDPB guidelines
Scope: Any EU controller using US-based processors.
Trigger: US CLOUD Act + FISA 702 = US providers structurally non-compliant for sensitive EU data without supplementary measures. EDPB guidance: 'encryption with keys held exclusively in EU' is the only valid technical safeguard.
DRIVUNO edge: DRIVUNO matches the EDPB technical safeguard verbatim. ZK = no key access for anyone, including us.
EU AI ActPhased: GPAI rules Aug 2025 · High-risk Aug 2026 · Full Aug 2027
Regulation (EU) 2024/1689
Scope: All providers/deployers of AI systems with EU users.
Trigger: Bans on data scraping for model training without lawful basis. Provider-side AI scanning of customer data becomes liability surface.
DRIVUNO edge: ZK = mathematically cannot feed customer data into any AI. Architectural defense, not policy.
EUCS / Sovereign CloudEUCS High level finalizing 2025–26
European Cybersecurity Certification Scheme + GAIA-X successors
Scope: Public sector & critical infrastructure procurement.
Trigger: EUCS 'High' will require EU-headquartered providers immune to non-EU law. France's SecNumCloud + Germany's C5 already enforce this.
DRIVUNO edge: DRIVUNO is EU-incorporated, EU-staffed, EU-infra. Eligible for sovereign procurement out of the box.
Net effect: a 24–36 month window in which procurement committees across ~160,000 EU regulated entities are forced to migrate off US-controlled clouds for sensitive workloads. DRIVUNO is positioned as the technical default answer.
M&A Comparables & Exit Pathways
The privacy-cloud category has cleared exits. We are building toward the largest.
Company
Outcome
Value
Multiple
Acquirer / Status
Tresorit
Acquired 2021
~$80M
~12× ARR
Swiss Post (sovereign carrier)
Mimecast
Take-private 2022
$5.8B
~7.5× revenue
Permira (PE)
Proton AG
Latest valuation (private)
~$700M–1B
~10–14× ARR (est.)
Foundation-owned, IPO candidate
Mega.nz
Private
~$300M (2021 est.)
~6× ARR
Strategic NZ holding
Sync.com
Private profitable
n/d (est. $150–250M)
n/a
Bootstrapped — strategic asset
Dropbox
Public
$8.5B mkt cap
~3.5× revenue
NASDAQ: DBX (commoditized)
Box
Public
$5B mkt cap
~4.5× revenue
NYSE: BOX (enterprise pivot)
NordLayer / Nord Sec.
Warburg Pincus 2022
$3B valuation
~10× ARR
PE growth stake
Strategic acquirers
National postal carriers (Swiss Post, La Poste, Deutsche Post), telcos (Orange, DT, Telefónica), defense primes (Thales, Airbus, Leonardo), sovereign clouds (OVH, Scaleway, T-Systems).
Financial acquirers
EU sovereignty-thesis PE (Permira, EQT, Bridgepoint, PAI), growth funds with cybersecurity mandates (Insight, Vitruvian, Eurazeo Growth).
IPO pathway
Euronext Paris Tech (precedent: OVH €3.5B), Amsterdam, or dual EU+Tokyo (TSE Prime) leveraging French–Japanese sovereignty positioning.
Investor ROI framing: at Y5 base case ($26–48M ARR, 81–85% GM, 35–45% EBITDA), a 10–14× ARR multiple — in line with Proton, NordSec, NIS2/DORA-driven premium — implies a Y5 enterprise value of $300–650M. Seed entry at €30–36M post-money targets a 15–30× return at Y5, scaling toward 100×+ on the Y10 trajectory ($450M gross / $220M net).
Live Security Posture
This isn't a slide deck. Everything is live, public, and verifiable today.
Most security startups show architecture diagrams. We ship the whole Trust Center in production. Auditors, prospects and acquirers can verify every claim on this page directly — no NDA, no sales call.
Every privacy/security vendor claims zero-knowledge. Almost none publish a full live Trust Center, threat model, signed release log and public bug bounty before Series A. This level of transparency is normally only seen at companies like Cloudflare or Proton post-IPO. It's our strongest moat against "we'll add encryption later" incumbent responses.
Risks & Mitigations
What can go wrong — and how we've engineered around it.
We surface the risks investors will ask about, with the architectural answers already in production. Honest risk disclosure is itself a moat: it's how mature security companies are run.
RISK
Hyperscaler price war
Google/Microsoft drop consumer storage pricing aggressively.
MITIGATION
We don't compete on price-per-GB. We compete on jurisdiction, key custody and regulatory eligibility — features hyperscalers structurally cannot match (CLOUD Act, FISA 702).
RISK
Proton expands into our segment
Proton already has the privacy-brand and 100M+ users.
MITIGATION
Proton is a consumer productivity suite (Mail, Drive, VPN, Pass). DRIVUNO is sovereign infrastructure for organizations — different buyer (CISO/DPO, not individual), different product (teams, audit, multi-jurisdiction, immutable backups, internal E2EE mailbox).
RISK
User loses their key → loses data
ZK means we cannot recover for them.
MITIGATION
Recovery Kit (PDF + QR, printed offline), recovery via second device, recovery email + SMS, social recovery roadmap. Auto-nag at 365 days. Documented & visible in /security.
RISK
Slow enterprise sales cycle
Security procurement is 6–12 months.
MITIGATION
Bottom-up GTM: self-serve consumer + SMB funds the company while enterprise pipeline matures. Phase 1 traction (Y1) requires zero enterprise contracts.
RISK
Cryptographic primitive break
Argon2id / X25519 / XChaCha20 — what if one is broken?
MITIGATION
Crypto-agility built in: key derivation, KEM and AEAD are each replaceable independently. Post-quantum KEM (ML-KEM/Kyber) on the public roadmap for 2026. Re-wrap path already exists.
RISK
Storage provider failure or ban
B2 goes down, gets acquired, bans EU traffic.
MITIGATION
Multi-provider sovereignty engine: B2 EU primary + Scaleway Paris immutable backup. OVH, Hetzner, Sakura, IIJ, GMO pre-registered as failover. Auto-failover RPC + pg_cron every 2 min. Tested.
RISK
Regulatory reversal (EU mandates backdoors)
Chat Control / client-side scanning revives.
MITIGATION
DRIVUNO's stack is mathematically incapable of CSS at the provider layer. If forced, we'd legally challenge (Schrems precedent) and can relocate jurisdiction (JP/CH ring already provisioned). Brand benefits from the fight.
RISK
Founder / key-person risk
Lean team early on.
MITIGATION
All infrastructure is documented, reproducible, code-owned. Recovery Kit + multi-admin org model means no single human controls customer access. Hiring plan tied directly to use-of-proceeds (see Ask).
The Ask
€8M Seed+ — 18-month runway to Series A inflection.
Round structure
Raising
€8M
Round
Seed+ / Pre-Series A
Pre-money target
€22–28M
Post-money target
€30–36M
Instrument
Equity (or SAFE w/ MFN)
Runway target
24 months
Lead ticket
€3–5M
Co-investor tickets
€250k–1.5M
Series A target (M+24): €20–35M at €100–160M pre-money, on the back of €4–6M ARR, 2–3 signed sovereign / regulated reference logos, and SecNumCloud + SOC 2 Type II in flight.
Teams & Mailbox GA · 90k registered · 10k paying · €2.2M ARR · 11% conv
M+18
First sovereign / regulated logo · 220k registered · 18k paying · €3.9M ARR
M+24
SecNumCloud in flight · 450k registered · 28k paying · €6M ARR · Series A closed
Capital roadmap — how €8M today becomes a category-defining outcome
Seed+ · now
€8M
PMF, EU launch, apps GA, Teams & Mailbox
8–10k paying · €1.7M ARR
Series A · M+24
€20–35M
EU scale, JP entity, SecNumCloud, SOC 2 Type II
25–35k paying · €5–7M ARR
Series B · Y4
€60–100M
International expansion, vertical sovereign offers
75–120k paying · €15–25M ARR
Growth · Y6-7
€150–250M
Enterprise dominance, M&A consolidation
350–500k paying · €60–100M ARR
IPO · Y8-10
Euronext / TSE Prime
Multi-jurisdiction category leader
1M+ paying · €165–450M ARR
Each round funds a specific inflection: PMF → regulated logos → international footprint → enterprise dominance → public markets. Dilution and milestones are tied to revenue, not vanity metrics.
Live in production · Auditable today
Don’t take our word for it. Try the product live.
Sign up in 30 seconds. Upload a file. Inspect what we store server-side — you’ll see encrypted bytes, nothing else. Open the Trust Center while you’re inside. Our biggest asset is that the product is real.
Free 1 GB · No credit card · Recovery Kit on signup · Delete account anytime (30-day grace)
Investor FAQ
Frequently asked.
What stage is DRIVUNO at?+
Live production platform with the full zero-knowledge stack, an E2EE team workspace (Rooms) with encrypted audio/video calls, continuous device backup (Live Clone), an encrypted photo library, sovereign multi-region backups and a complete Stripe-monetized plan grid. Ready for design-partner enterprise pilots and seed-to-Series-A capital deployment.
How defensible is the technology?+
Client-side Argon2id + X25519 + XChaCha20-Poly1305 means even DRIVUNO cannot read user data. This is architectural, not policy — non-replicable by hyperscalers without rebuilding their entire trust model. The same key hierarchy now covers files, photos, team drives, chat messages, attachments and call signalling.
Why now?+
AI scanning, NIS2, GDPR enforcement, EU sovereignty mandates and ransomware-driven board pressure are converging. The market is shifting from 'Cloud-first' to 'Sovereign & Secure-by-Design' in a 24-36 month window.
What is the moat vs Proton or Tresorit?+
DRIVUNO is sovereign infrastructure, not a productivity suite. Multi-jurisdiction failover (EU/JP/Hybrid), immutable B2 Object Lock backups, an encrypted Slack-class workspace with P2P calls, Live Clone continuous backup and protected single-view sharing form a full stack none of them offers together.
Why does the 2026 feature wave matter for revenue?+
Storage alone is a price-per-terabyte race. Rooms, Live Clone, Photos and Team Drive turn DRIVUNO into a daily-use workspace: more seats per account, higher plan mix, lower churn through switching costs, and a credible per-seat Business motion competing with Slack + Dropbox + Backblaze budgets in one line item.
How are you monetizing today?+
Five live Stripe plans (Starter $9.99 → Deluxe $49.99 + Business $14.99/seat) with in-app upgrade paths and one-click checkout. Worst-case gross margins 33–45%, realistic 81–84% — typical privacy-SaaS economics at scale.
Investment opportunity
Building Europe’s Secure Sovereign Data Layer.
We are actively seeking strategic partners and investors aligned with DeepTech, cybersecurity and digital sovereignty theses.
