Series B Close and What the Money Is For
Evervault closed a $25 million Series B led by Ribbit Capital, with Index Ventures, Sequoia Capital, Kleiner Perkins, and Operator Partners also participating, SecurityWeek and FinTech Futures reports. The round brings total funding to $46 million since Shane Curran founded the company in Dublin in 2019 (per FinTech Futures), though the CNBC profile pegs the founding at 2020, and the company's own LinkedIn page lists 2019. The company started at eight employees and roughly $3 million in seed from Sequoia Capital and Kleiner Perkins, then raised a $16 million Series A in 2020 led by Index Ventures, with Facebook's former chief security officer Alex Stamos among the angel investors, as CNBC reported at the time.
Curran told CNBC the premise that won Stamos over: that privacy should be built into every company's app from the get-go, rather than left to compliance teams. "For him, he's coming from a security background at Facebook where privacy was much more of a regulatory problem," Curran said. "Obviously he's experienced first hand what the pain in the ass is with privacy and security in general." SecurityWeek quoted Curran on the Series B: "Most compliance frameworks assume sensitive data will exist in plaintext somewhere, but with automated, high-velocity data exchange, that's a liability. At Evervault, we believe sensitive data should be treated like hazardous material. Systems must be designed so it isn't touched in the first place. We're building the Internet's trust layer, embedding encryption directly into the application architecture so it stays encrypted by default, not by policy alone."
The product is an encryption proxy and tokenization layer (Relay, Functions, UI Components, and Enclaves, per the Evervault website) that lets developers collect, process, and share card data without holding plaintext keys. FinTech Futures reports the platform now integrates encryption with 3D-Secure authentication, network tokens, and card data enrichment, with use cases including card issuing, wealth management, and card management. Customers named in coverage include Ramp, Sling, and Stitch. FinTech Futures reports "hundreds of global customers" and "more than fourfold year-over-year revenue growth over the past 12 months, with transaction volumes topping $5 billion last year."
The Hiring Record and the New York Question
A close read of the public record complicates the hiring-surge framing. Evervault employed eight people in May 2020, per CNBC reporting contemporaneous with the earlier $16 million round, and Curran told the outlet that international expansion was "effectively put on hold until it's possible to fly abroad again." By 2022, WIRED reported a 30-person team and an ongoing product build, with Dublin still the base. GetLatka's most recent data puts headcount at roughly 16 employees, against an estimated $1.8 million in 2025 annual recurring revenue. That works out to about $112,500 per employee, a productivity ratio that suggests a company still proving product-market fit, not a growth-stage operation ramping into a new market.
No dated source in the public record revises the international-expansion hold, and there is no New York lease announcement or local buildout documented. The Evervault LinkedIn page does list a New York headquarters at 401 Broadway, with offices in Dublin and London, and reports 10,016 followers and 47–200 employees as a company-size band, but these are self-reported, unverified figures that conflict with the 16-employee count GetLatka tracks. Zero G Talent's live job-board data, which tracks active postings across the fintech and infrastructure sectors, shows no Evervault listings. Stripe, by contrast, added 47 roles in the seven days around the funding window, including a New York-based Growth Engineer role paying $190,400 to $285,600. ASML added 61 roles in the same window. Evervault does not appear.
The doubling from eight employees in 2020 to roughly 16 in 2026 is real, and it lines up with a company adding engineering depth for product development, not a New York office chasing the payment-tokenization market. If a hiring surge is materializing, it has not yet left a trace in the public record or in the job-market data.
Competitor Security Hiring Picks Up
The Series B has not gone unnoticed by firms operating in adjacent slices of the payments and data-security stack. Stripe's 47 fresh roles span infrastructure, machine learning, and business systems, functions that map closely to the same developer-first encryption and tokenization problems Evervault is betting on. Stripe's salary bands for security-adjacent roles run from $190,400 for that New York Growth Engineer to $274,456 for a Business Systems Architect focused on tax compliance, with a median near $235,000. Stripe did not publicly tie the hiring acceleration to Evervault's round, but the timing aligns with a broader industry repositioning around PCI DSS 4.0 readiness.
| Company | Roles added (7 days) | Notable NY-based role | Salary band |
|---|---|---|---|
| Stripe | 47 | Growth Engineer | $190,400–$285,600 |
| ASML | 61 | — | — |
| Evervault | 0 (board data) | — | — |
Marqeta, the card-issuance platform, made a quieter move: the company announced the appointment of Eugenia Gibbons as Chief Product Officer in August 2026, per the Marqeta investor relations site. Marqeta has not disclosed headcount targets, but its participation in upcoming investor conferences signals a coordinated effort to position for a market that increasingly values privacy-by-design architectures.
The broader pattern is consistent across the stack. Cloud-native security and payments firms have expanded engineering headcount, treating encryption infrastructure as a developer-experience differentiator rather than a back-office checkbox. The war for developer mindshare begins with the engineers who build it — and Evervault's rivals are hiring accordingly.
PCI DSS 4.0 and the Tokenization Tailwind
The regulatory clock is the most reliable growth engine behind payment tokenization, and PCI DSS 4.0 is the version every compliance team is racing to meet. The standard dates to 2004 under the PCI Security Standards Council, but the current refresh was announced in March 2022 and added 64 new requirements for any organization that stores, processes, or transmits cardholder data, according to Qualys. The rollout arrived in two waves: 13 requirements became mandatory on March 31, 2024, and the remaining 51 hit the deadline on March 31, 2025.
What changed in 4.0 matters more than the volume of new checkboxes. Qualys's breakdown points to a "greater emphasis on continuous monitoring" and a "shift to a more flexible framework" that lets firms align controls to actual risk rather than ticking static boxes. Specific provisions drove the shift: requirement 5.3.2.1 ties malware-scan frequency to a targeted risk analysis, 10.7.2 demands that failures of critical security control systems be detected, alerted, and addressed promptly, and 11.3.1.2 and 11.3.2 require authenticated internal scans plus quarterly external scans through an Approved Scanning Vendor. The standard no longer lets a payment company claim compliance by running an annual penetration test and walking away.
That is the environment Evervault's product is built for. The company's PCI compliance page pitches the platform as a way to "collect, process, and share cardholder data without worrying about the PCI DSS headache" by keeping sensitive data encrypted in transit and at rest, shrinking the cardholder data environment a merchant has to certify. Under 4.0, reducing that surface area is one of the few moves that meaningfully cuts audit scope. The friction point is real: PSPs and large merchants still need a concrete business case showing how tokenization cuts their compliance burden without causing downtime or transaction-volume drops during migration, per ABI Research analysis reported by Macau Business. Evervault's $25 million lands directly in that gap, funding the go-to-market muscle to turn a regulatory deadline into signed contracts.
The macro numbers back the bet. ABI Research forecasts Token Service Provider revenue to break $1 billion by 2031, with North America still leading but Europe's data-protection regime, Latin America's digital push, and Asia-Pacific's head start on tokenized funds and bonds pulling the market global. Macau Business, reporting on ABI's analysis, ties the demand surge to PCI DSS 4.0 requirements alongside the Colonial Pipeline attack, the UK NHS incidents, and the Spain and Portugal blackout as catalysts that have made enterprise buyers willing to pay for tokenization as a service rather than build it in-house. The same report flags vaultless tokenization, web-based push provisioning, wearables tokens, and passkey integration replacing 3D Secure as the design patterns accelerating over the next five to ten years.
Cloud-Provider Integrations: The AWS Signal
The clearest traction signal for Evervault since the Series B came not from a headline customer win but from a cloud enablement session. In an August 2026 LinkedIn post, the company described "great conversations with the Amazon Web Services (AWS) team yesterday during our enablement session," with Curran presenting how Evervault "built composable primitives for sensitive data" and how the platform "helps developers reduce compliance overhead while building secure products faster — especially in this AI era." An enablement session is the step a cloud provider runs internally before its sellers and solution architects can recommend a third-party product to customers, more meaningful than a generic partner badge.
That positioning matters because AWS already ships its own key management and encryption primitives, and the competitive set includes other key-management and secrets-management vendors. Evervault's pitch into that gap is its "dual-custody" model: Evervault stores the keys, the customer stores the data, and "a successful data breach would require both you and Evervault to be breached, compared to a single point of failure with traditional tokenization." For a cloud architect evaluating that trade-off, on-prem data plus external key custody is a cleaner story than a fully hosted token vault.
The AWS work also dovetails with two product launches Evervault rolled out the same month: Cardholder Verification, which checks cardholder name, address, CVV, phone, and email against issuer records, and Payment Account Reference (PAR) Lookups, a stable identifier that ties together PAN, MPAN, and DPAN representations of the same underlying card. PAR is the kind of primitive cloud marketplaces have been slow to expose because it sits one layer above the card networks, and Evervault is now packaging it for AWS sellers to recommend.
The revenue numbers behind those integrations remain modest. GetLatka's figures put 2025 revenue at $1.8 million with roughly 16 employees, and FinTech Futures reported transaction volumes topping $5 billion annually. But the AWS enablement session is the first concrete, dated evidence that a hyperscaler is treating Evervault as a reference architecture rather than a self-serve API. Watch for the next signal: a joint reference architecture, a Marketplace listing, or a named co-sell customer out of that August session.
IPO Math and the Road Ahead
Evervault's $25 million Series B closed in March, but the company and its backers have stayed silent on a public listing. The round, led by Ribbit Capital and joined by those same investors, pushed total raised capital to roughly $46 million. At that revenue and headcount, Evervault sits well below the thresholds investors typically associate with a near-term IPO. A CNBC discussion of current listing patterns cited a market observer floating $500 million in annual revenue as a benchmark VCs are invoking "as these deals get bigger and bigger." By that yardstick, Evervault has years of runway before any public-market debut becomes a credible topic.
What Evervault has said publicly points to operating priorities, not a listing calendar. SecurityWeek and FinTech Futures both reported the company plans to "expand its encryption infrastructure, invest in product development, and grow its engineering and product teams." That language is consistent with a company still investing in product and go-to-market, not preparing audited financials for an S-1. The investor lineup also reads as growth capital rather than pre-IPO positioning: Ribbit's track record leans toward category-defining fintech bets, and Index, Sequoia, and Kleiner Perkins all participated in the 2020 Series A, suggesting alignment on a longer-duration build.
The broader tokenization-and-encryption market is harder to read because Evervault's competitors are mostly private subsidiaries or much larger public companies. Adyen raised its revenue forecast on acquisition momentum and announced payment-technology work for LillyDirect, while Marqeta continues to attend investor conferences and recently named a new chief product officer. None of those moves reads as a direct response to Evervault's funding, but together they suggest the payments-infrastructure category is attracting capital and talent without yet producing a wave of IPO filings from mid-stage challengers.
For now, the more concrete forward indicator is hiring, not a listing window. If the next 12 to 18 months bring a Series C at a step-up valuation, a strategic acquisition, or a quiet S-1 filing, that will be the signal that investor sentiment has shifted from "build the category" to "monetize the category." Until then, expect Evervault's public posture to stay focused on customer logos and product velocity: Ramp, Sling, and Stitch on the customer side, transaction volumes above $5 billion annually on the traction side, and a team that will need to grow by multiples before any IPO math begins to work.
Working in frontier tech? Zero G Talent tracks the openings: see every open ASML role, browse frontier tech jobs, openings at Stripe, and the people building the field.