Most security conversations about AI start with the model. Abhi Sharma starts with the data, and with a question most companies can’t answer: where does it actually go, and why? He has spent his career on systems that watch other systems, from an observability stack to edge machine learning, and on this episode he described the company he built to answer that question in one breath.
“So Relyance in a nutshell is the most comprehensive trust and data governance platform. What that means in simple terms is we automate and unify three things: global privacy compliance, data security posture management, and AI governance operations.”
Abhi Sharma, at 0:53
Abhi is the co-founder and chief executive of Relyance AI, which his LinkedIn dates to May 2020 and which lists its headquarters in San Francisco (LinkedIn). Before Relyance he was a founding member and head of machine learning and analytics at FogHorn Systems, an edge computing company built at an incubator in Palo Alto that his profile says was acquired by Johnson Controls. Before that he was a platform engineer at AppDynamics, and before that he founded an indoor analytics project called Kontext at Carnegie Mellon University, with the edge computing pioneer Mahadev Satyanarayanan as his advisor (LinkedIn). His headline today calls him “Founder, CEO, and Chief Leaf Blower.” On this episode he tells Sasha and me what trust means once AI is in the loop, why maps of data at rest miss the point, which line in enterprise contracts has become the most negotiated, what he learned from a fine dining book, and why he thinks the telephone operator might come back.
Where we sit, so you can weigh what follows: YSecurity helps startups pass the security and compliance reviews enterprise buyers run, from the first questionnaire to SOC 2, ISO 42001 and the data processing agreement. That is the conversation Abhi describes from the other side, the buyer asking a vendor to prove where its data goes. Sasha Sinkevich and I hosted this one together. We recorded in early 2025, and the episode aired on June 3, 2025. There is no video of this episode on our YouTube channel, so this page uses the audio.
Three jobs, one platform
Each of the three jobs in Abhi’s opening line usually has its own tool and its own team. Global privacy compliance is the privacy team’s work: records of processing, subject requests, consent and assessments under laws like GDPR. Data security posture management is the security team’s: finding sensitive data, who can reach it and where it is exposed. AI governance operations is the newest of the three, and in 2025 many companies were still deciding who owned it. Relyance’s pitch was that all three depend on the same picture of how data moves, so one platform should build that picture once and serve all three.
The method mattered as much as the scope. “So, a very bottoms-up, AI-first approach for building a platform for all those three things.” Bottoms-up is the key phrase, and it comes back through the whole episode. Most governance tools start from the top, with a questionnaire sent to whoever owns a system. Abhi’s starts from the systems themselves, from code, runtime and data stores, and works upward to the record a regulator or a customer wants to see.
If you have ever been on the receiving end of the privacy team’s annual data mapping survey, the appeal is obvious. The survey asks people what their systems do. The system knows what it does. We wrote about the same gap from the buyer’s side in the AI governance maturity model, where data governance is the dimension companies most often underestimate.
Twice, so I must love pain
I asked what got him started, and pointed out that you have to be a little bit crazy to be a founder. He didn’t argue. “Certainly, and I did it twice, so I must really love pain.”
The first time was FogHorn Systems, where his LinkedIn lists him as a founding member and head of machine learning and analytics from December 2015 to April 2020. He describes it there as a real-time analytics and machine learning inference platform, with a compiler, for edge computing. When it was acquired, he did what founders do after an exit: he stopped and asked himself what was next.
“But my previous startup got acquired, like any other founder. I was in this deep soul-searching mode of what I wanted to do next.”
Abhi Sharma, at 1:40
He had the option of becoming an investor, and he says he had some opportunities to do it. His answer is one I hear from a lot of second-time founders: “But I was like, oh, I’ll do that when I’m old. I still very much love building.” What he wanted was to take what he was good at as an engineer, “which is compilers, observability, machine learning,” and apply it somewhere new.
That list is a good summary of his résumé. Observability came first, at AppDynamics, the application performance monitoring company that Cisco bought in January 2017 for $3.7 billion (Wikipedia). His LinkedIn says he built a distributed in-memory metadata caching layer there. Machine learning and compilers came at FogHorn. And the idea of computing close to where data is produced goes back to Carnegie Mellon, where his advisor was Mahadev Satyanarayanan, who published the first paper on edge computing in 2009 (Wikipedia).
Where are the Leonardos?
The emotional reason he gave is not one you hear often on a security podcast. Abhi thinks the most interesting work happens where fields meet: “a lot of interesting stuff happens at the intersection of domains.”
“I’m a huge fan of the idea of polymaths. Like, you know, the problem statement I was really interested in on a very personal level is like, where are the Leonardo da Vincis of the world? There used to be a lot of them between the 1100s and 1700s, and like, there’s not many of those people anymore.”
Abhi Sharma, at 2:26
Leonardo is the usual example of the Renaissance ideal that a person could master many fields at once, and the term “Renaissance man” is still used for exactly that kind of polymath (Wikipedia). Abhi’s version of the idea is practical. Privacy law, security engineering and machine learning are three fields with their own vocabularies, and the problem he wanted to solve sits in the space between them. It’s also where he comes back near the end of the episode, talking about architecture and why we stopped building beautiful buildings, so keep the polymath in mind. It is the thread that runs through everything he says.
Six weeks after the episode aired, he was still on the same idea. In July 2025 he wrote that AI is still remixing human knowledge, and that the time it frees up could bring a renaissance in science.
AI superintelligence is happening, but let’s be real—it’s still remixing and built on human knowledge (our current interpretation of the universe). AI is not inventing new knowledge from scratch. Not just yet. So this could be our golden opportunity for human progress. With AI handling the ‘bits’ and increasing human productivity, we finally might have time to dive back into the world we’ve ignored: ‘atoms’. Quantum physics, math, the atomic realm, and biology. Imagine a renaissance in science! It might not be a bad time to learn physics again.
Abhi Sharma (@abhisharma_b) · July 16, 2025
Before AI and after AI
The business reason came from the people he knew. “And then what happened was I know a lot of people in the AI community personally.” That gave him a bet that, in 2020, still sounded bold.
“And so it was very clear to me in 2020 that we would live in a world where we would draw a line between before AI and after AI.”
Abhi Sharma, at 2:52
He followed the hypothesis to its end. If it held, “then AI or AI agents will be embedded in all business operations. AI will, quote unquote, run the world.” And if AI runs the world, people need a way to trust it.
“Which means we need to empower humans to trust and govern it. And you can’t quite do that with top-down workflows or stupid manual applications, which is how the whole world of trust and governance runs today.”
Abhi Sharma, at 3:13
That is a founder’s thesis in three sentences, and it is worth noticing how early it was. Relyance’s LinkedIn dates the company to 2020, two years before ChatGPT made the before-and-after line obvious to everyone. The thesis also explains the product choice. If AI is going to be in every business process, then governing it with surveys and spreadsheets is hopeless, and the only approach that scales is one that reads the systems directly. Abhi wanted a problem “that had an impact at the infrastructure and governance layer for 100 years out,” and one that matched what he was good at. He didn’t think much of what was already on the market, which he described as “some version of partial visibility,” so he figured he could do something about it.
A privacy lawyer and an engineer
Then he met his co-founder. Abhi didn’t name her on the tape, and I won’t guess at her title here, but he described the pairing well.
“And then I met my co-founder, which kind of had a nice yin and yang between us. She was a privacy lawyer coming from the world of compliance, and I was sort of this engineer.”
Abhi Sharma, at 3:54
“It sounds like a match made in heaven,” I said, and I meant it. The pairing is the product. A privacy lawyer knows what the law and the contracts require. An engineer who wrote observability systems knows how to find out what the software actually does. Most companies have both kinds of people, and the trouble is that they work in different buildings and use different words for the same thing. “And we figured out we could have an interesting mixture of those two ideas to build a cocktail of something fun and interesting. And that’s Relyance, really.”
Trust is a multiplication
My next question was the one the episode is named for: what does trust mean for AI, and how does Relyance help build it? Abhi’s answer is the idea I’ve repeated most since we recorded. He started by complaining about the word itself, which he called overused but under-quantified, and then he quantified it.
“And the way I look at it is in order to quantify trust, it’s basically a multiplication across three things, which is transparency, security, and the third thing is business value.”
Abhi Sharma, at 4:42
To trust a brand, a product or a piece of software, he said, you need all three: transparency, data security (“or you can call it control”), and some kind of business value. And then the key sentence.
“Trust is a multiplication of those three things, which means that if any portion of those three things I just mentioned is zero, trust is equal to zero.”
Abhi Sharma, at 5:24
“I’m an engineer, so I like to talk about it in mathematical terms, but hopefully that still makes sense.” It does, and the math is the whole point. If trust were a sum, a product could make up for weak security with great value, or for no transparency with strong security. Plenty of vendors sell as if that were true. A multiplication doesn’t allow it. A tool that is spectacular, secure and completely opaque has a trust score of zero, and so does one that is transparent, valuable and leaks.
This is the frame I’d hand to any startup selling into an enterprise. A security review isn’t a hurdle between you and the value you deliver. It measures one of three factors, and if it comes out at zero the value doesn’t matter. You can try your own numbers in the trust calculator further down.
AI multiplies one factor
Then Abhi put AI into the equation, and the three factors stopped cooperating. They “are kind of at odds with each other,” he said, because AI pushes one factor up and pulls on the other two.
“So if you stay with me with this equation of trust, which is a multiplication of three things, we are all in agreement that with AI, you can actually blow up the business value you can provide, whatever it is that you’re doing in the world.”
Abhi Sharma, at 5:52
Faster service, a better product, whatever the business does. “But then that same thing, which is the incorporation of AI, is in tension with the other two things.” The other two are security and transparency, and the reason is simple: “because AI is inherently a non-deterministic system.” The same input doesn’t always produce the same output, so you can’t prove what it will do by reading it. To have trust anyway, “you kind of have to balance all of those three variables in the equation.”
Relyance’s place in that equation is the two factors AI strains. “And so Relyance’s role is really to help you with the transparency and the data security or control portion of it.” He called the result trust as a service, with a second-order effect: the brands Relyance serves can earn direct trust from their own consumers. “We’ll provide the infrastructure so you can trust and govern it.”
I like this framing because it puts the work where it belongs. Nobody needs to be talked out of using AI. The business value is real, and every company we work with wants it. The question is whether you can raise transparency and security fast enough that the product of the three keeps going up. Sasha has written about that balance in The Art and Zen of Adopting AI, and it is the same balance.
Column to column
Sasha picked up the two factors Abhi had named, data security and privacy, and asked the question that follows from AI having access to all of that data: how does the data flow, who has access to the AI, who has access to the agents, and does Relyance help companies see it? Abhi said that was the most distinctive thing they do.
“Absolutely. And in fact, that is one of the most unique things we do at Relyance, which is a very visual representation of the end-to-end flow of data.”
Abhi Sharma, at 7:43
His complaint about the rest of the market was specific. Whether you look at it as data governance or as data security posture, “there is very little visualization of flow of data across the system. And whatever that exists is very column to column between databases.” Column-level lineage tells you that a field in one table was copied into a field in another. It doesn’t tell you what happened in between, and with AI the in-between is where things happen: “how the data travels between microservices, ETL pipelines, third-party API calls.”
Okay, great. But why?
The example he chose was Sasha. If you only look at a database, the best you can say is that a person’s data is in it.
“And that is completely missed if you just look at a database and say, well, I have Sasha’s personal information here. Okay, great. But why? What do I do with it? How do I provide a service? So the usage context becomes very important.”
Abhi Sharma, at 8:28
Those three questions are the ones a privacy lawyer asks, and the ones a scanner can’t answer. Purpose, use and service are properties of the flow, not of the table. That is why a privacy lawyer and an engineer make sense as a pair, and why he says the company has “always been true to that mission,” which is to show “end-to-end contextual visibility of data flows across your entire landscape of business transactions.” The payoff he named is speed with safety: “because then not only can you accelerate innovation and AI adoption, but you can do it with a lot of trust and safety.”
Sasha called it a kind of data lineage, or a data supply chain. That second phrase has since become its own category. When we wrote about the AI data bill of materials, the argument was the same one Abhi makes here: you can’t secure an AI system until you know the data it consumes, where it came from and where it goes next.
Over-indexed manual workflows
Sasha asked about pain, and framed it the way most founders hear it: data security and security controls are often seen as overhead. What is the biggest pain point Abhi sees when he talks to prospects? He answered in two buckets, and the first is the one every security team recognizes.
“The number one challenge is some version of over-indexed manual workflows, whether it’s mapping the data, whether it’s setting up policies for access control or ACLs on the data, whether it’s making sure you’re under- or over-provisioned, whether you’re trying to do it for compliance reasons or regulatory reasons or customer commitments.”
Abhi Sharma, at 9:25
He called it a heavy hand on a whole suite of workflows, “which involves a lot of manual back and forth and conversations.” The second bucket is what’s left when a company has bought tools for the first. Some of the manual work gets automated, but two things still get missed, and the first is visibility.
“They are still deeply hurting because of partial visibility, because the existing tools can tell you you have 50 database instances and you have this data in there, but you kind of don’t know why and who and what’s the purpose.”
Abhi Sharma, at 10:17
Why, who and what’s the purpose. It’s the same three questions from his Sasha example, and he said the usual approach, scanning data where it sits, can’t answer them. A scan of data at rest tells you what is in a store. It can’t tell you who reads it, which service sends it where, or which promise to a customer it falls under.
We like to call them obligations
The second thing tools miss is the policy itself. Enforcement engines exist at every layer, Abhi said, “whether you reason about it from a network and socket layer or whether you reason about it from an application layer,” and they all share one limit.
“The problem is they’re only as good as the amount of policies you write.”
Abhi Sharma, at 10:50
The AI era, he said, “has really kind of, like, thrown water over all of that stuff.” You can enforce a lot if the rules are written down. The trouble is what a real company’s rules actually are.
“And I think when security folks, or even organizations, use the term policy, we like to call obligations, because it’s the regulations, it’s the compliance frameworks, it’s the contractual commitments you make to your customers, and your internal policies. And there is no way a human being is going to write all of those down, let alone the version control of updating over time.”
Abhi Sharma, at 11:07
That word, obligations, is the most useful thing I took from the episode for our own work. A startup’s security policy is a document. Its obligations are everything it has promised to anyone: the law in every place it operates, the frameworks it was audited against, the clauses in every customer’s contract, and its own internal rules. They pile up with every deal, they change every time a customer negotiates, and nobody owns the whole list. His recap was blunt: “manual workflows or partial visibility, and manual input of policy, which is, like, impossible to keep up.”
Sasha added the piece that makes it worse.
“Into that mix, we can throw in a lot of vanilla policies that are just floating around, and often companies don’t even read into the details before they ask your counterpart to sign it.”
Sasha Sinkevich, at 11:46
We see this constantly. A startup downloads a policy template, a customer sends back a security exhibit that references it, and nobody checks whether what the company promised matches what its systems do. We wrote about that exact trap in the security exhibit your startup signed last quarter. Abhi’s word for those promises is obligations, and an obligation nobody has read is still one you owe.
Value before eleven
I asked who Relyance sells to. His answer was refreshingly direct about price.
“So the ICP for Relyance at the moment is really what I would call the mid-market or late enterprise. We’re not a cheap product.”
Abhi Sharma, at 12:01
By mid-market he meant large mid-market companies or early traditional enterprises, “but with a touch of, let’s say, modern operations.” Modern meant one thing: “as cloud-first, as cloud-native as possible.” The reason is speed. Relyance’s claim was that if Sasha started an implementation at 10 a.m. Pacific, there would be real value on the screen before the call ended at 11.
That works when most of the important infrastructure lives with one of the three hyperscalers, because Relyance can pre-build the connectors and the analysis. It still serves companies with on-premises systems, he said, “but it’s just kind of harder and takes more time.”
“Like, if Sasha has five data centers in Sacramento and I need to deploy an outpost there, it just takes a lot longer than being cloud native.”
Abhi Sharma, at 13:13
“Very market segment and market vertical agnostic, though.” For a startup listening, the useful part is the logic, not the segment. Time to value is part of the business value factor in Abhi’s equation, and a tool that needs a quarter of setup before it shows anything is asking the buyer to trust it on credit.
The data plane stays home
Sasha’s follow-up was data residency, and Abhi said it shows up “especially with fintech and healthcare.” It takes two forms with Relyance’s customers. The first is geography.
“Number one, if they have operations in EMEA, they don’t want the data to leave EMEA, if you will, and come to the US.”
Abhi Sharma, at 13:52
The second is architecture. Customers are “very keen on making sure that the data plane is in their control,” which in Relyance’s case means the classification and the data flows can be computed by the platform, “but they want the data plane to live in their environment, while the control plane could be the Relyance SaaS app for their tenant.”
Then he made a prediction, and I think it has aged well. Residency would matter more, not less, because of what AI does to the value of data.
“And I think my personal projection is it’s going to get even more [focused], or even more necessary, for customers, because they’re going to realize that our proprietary information, whatever business you do, is really the gold asset we have as AI gets commoditized in terms of foundational models.”
Abhi Sharma, at 14:22
If the models are a commodity, the data is the moat, and companies guard moats. He expected that instinct to reach “even for modern mid-market or SMB companies.” Sasha connected it to how requirements travel through a supply chain.
“So it’s sort of a top-down policy approach, where if the larger entity accepts the policy of data controls, the same controls will be pushed down the line.”
Sasha Sinkevich, at 15:05
That is the startup’s half of the story. The enterprise adopts a residency rule, and every vendor in its supply chain inherits it in the next contract, whether or not the vendor’s architecture was built for it. If you sell to banks or hospitals, you’ll get the question before you get the purchase order.
The clause everyone strikes
Sasha’s point reminded Abhi of a contract clause, and his story about it is one of the clearest signs of how AI changed enterprise buying.
“The funny thing for me, just because you highlighted a really good point, Sasha, is like, in enterprise agreements, in the MSAs and DPAs, so the contracts when two parties do business, for the longest time there used to be a little line in those agreements: we will use your de-identified data to improve our software. And it is the most hotly negotiated item now, especially with our enterprises. It’s like, nah, you’re not doing any of that with my data, especially with this AI era.”
Abhi Sharma, at 15:18
The MSA is the master services agreement and the DPA is the data processing agreement, and the clause he quoted used to sit in both without anyone noticing. Now, he said, larger enterprises “want that out of legal contracts.” Regulators noticed the same shift from the other direction. In February 2024 the Federal Trade Commission warned that a company that starts using customers’ data for AI training, and tells them only through “a surreptitious, retroactive amendment to its terms of service,” may be acting unfairly or deceptively (FTC).
Sasha’s experience on our side was the mirror image.
“To that point, I often see DPAs have so much language, very protective language, just to make sure that we cover as much as possible, and that in itself tends to be a little bit overprotective at times and tends to increase the friction when you sign those deals.”
Sasha Sinkevich, at 15:59
Abhi agreed, and tied it straight back to visibility. When you don’t have the end-to-end data flow picture, what are your security and legal teams going to do? “CYA, and so make it as protective as possible.” That protects the company, and it also blocks deals that would have been good for both sides.
“Like, if you could cure cancer because of that good sharing of data, then why not? We all want that.”
Abhi Sharma, at 16:43
This is the multiplication again. A contract written in the dark sets transparency near zero, so legal sets security as high as it will go to compensate, and the business value of the partnership pays for it. The fix isn’t weaker language. It is enough visibility that both sides can write language that matches what the data actually does. When a startup answers the first enterprise questionnaire, the question about training on customer data is usually the one that decides the tone of the review, which is why it is the first question in our guide to the AI questions buyers ask.
Right around the corner
Then Sasha offered a way out.
“Luckily, homomorphic encryption is right around the corner, and we all will be saved very soon.”
Sasha Sinkevich, at 16:54
“I’m not holding my breath,” I said. For anyone who hasn’t followed the joke for the last fifteen years: homomorphic encryption lets a computer run calculations on encrypted data without decrypting it first, and the decrypted result matches what the same calculation would have produced on the original data (Wikipedia). Craig Gentry described the first plausible construction of a fully homomorphic scheme in 2009. It is a real field with real products, and it is also the security world’s version of fusion power. In the meantime, the way most companies share data is still the way Abhi described: under a contract, with a map of where it goes.
Never giving up
I asked Abhi whether he had ever felt like giving up. He has been doing zero to one for a long time, more than four years at FogHorn and more than four at Relyance when we recorded.
“Giving up was never an option, just kind of based on how I grew up and my background. I’ve definitely felt not good enough, never enough, but never giving up.”
Abhi Sharma, at 17:26
He described himself as “always the black sheep of my family,” and the line about never feeling enough is one I’ve heard from many founders, usually off the record. “I mean, I guess there’s no such thing as failure unless you stop trying,” I said. He agreed. He comes back to that background at the end of the episode, and it explains the advice he gives his younger self.
Ten people and their own tables
His proudest moment came in Relyance’s second month, and it was about people, “because I think eventually, when you go through the entrepreneur journey, it all ends up boiling down to that.”
“When I started Relyance, in my second month of operation, so right after we got funded and we’re like, okay, we’re ready to actually start working on this thing, I had like 10 people join me instantly.”
Abhi Sharma, at 18:01
They were engineers and others who had worked with him for six or seven years, and the picture he gave is a good one: “and everybody assembled their own tables and they started working on their computers.” He said they come from MIT and Google and Facebook and Meta, and “they can kind of get a million-dollar job wherever they wanted, but they chose to work here.” What he took from it was a lesson about founders, not about recruiting.
“And I think that at some point, you have to do something right as a founder for people to just continue to work with you again, whether you’re successful or not.”
Abhi Sharma, at 18:28
The test he describes is a hard one. Anyone can hire people after an exit, when the last company’s outcome is the pitch. The harder thing is people who would have followed you whether the last one worked or not. Those are the people who show up before the product exists, and for Relyance the product didn’t exist for a long time.
Unreasonable hospitality
The second proud moment was about culture. Every founder starts with a dream of what the culture will be, and a second-time founder also has a list: “you kind of realize, oh, I screwed up these 10 things, I’m not going to screw them up again.” The one that stuck at Relyance was a phrase, unreasonable hospitality, which Abhi said has “really seeped into the DNA of our employees and our operations.” What makes him proud is hearing his sales, customer success and support teams use it on calls he isn’t on, including people only two months into the job. I asked if he’d coined it.
“No, I did not. It’s borrowed from the world of fine dining.”
Abhi Sharma, at 19:53
The book is Will Guidara’s Unreasonable Hospitality: The Remarkable Power of Giving People More Than They Expect, published in 2022. Guidara became the general manager of Eleven Madison Park in New York in 2006, and he and the chef Daniel Humm bought the restaurant in 2011 (Wikipedia). On the tape Abhi remembers it as the world’s best restaurant for many years in a row. The record is a single year at the very top, which is still remarkable: Eleven Madison Park was ranked first among The World’s 50 Best Restaurants in 2017, and it has held three Michelin stars since 2012 (Wikipedia).
“And it’s really a great culture book at the end of the day, full of stories about how to go above and beyond to deliver magical experiences to your customers.”
Abhi Sharma, at 20:22
He thinks “a lot of the ideas there are very applicable to technology and SaaS businesses,” and I agree, including in security. The experience of being reviewed is part of what a vendor sells. A startup that answers a buyer’s security questions in a day, with the evidence attached and a person on the other end who is glad to explain, is practicing a version of unreasonable hospitality, and buyers remember it.
Twenty months without a sale
Sasha asked whether the book shaped who Abhi hired, and whether some of those first ten were focused on customer success. Abhi said everyone was focused on experience, and that at the start a tech startup needs engineers first. He didn’t have the hospitality phrase yet, so he used a different one.
“I didn’t quite have the term [unreasonable] hospitality, but product-focused engineers is what we said, which is they really cared a whole lot about customer outcomes and then went to design the product, instead of just, like, thinking above the API layer versus just staying below the API layer.”
Abhi Sharma, at 21:21
That mattered because of how he chose to build. He called it “this very platform-oriented way of building,” and it meant a long wait.
“which meant that we had to build the product for 18, 20 months without having to sell it to anybody. And it takes a little bit of a leap of faith to kind of put in that much time and energy without seeing the feedback from the outside world just yet.”
Abhi Sharma, at 21:46
“Wow, 18 to 20 months,” I said. Most advice for founders runs the other way: sell early, learn from the first customers, build what they pay for. Abhi’s bet was that a platform that reads code, runtime and data stores couldn’t be sold in pieces, and that the first deployment had to work across all of it. The next story is what happened when it did.
The flow nobody knew about
I guessed the first sales call must have been spectacular after all that work, and Abhi said it was. Then he told the story of the first deployment, which goes straight back to Sasha’s question about end-to-end lineage and context. Everyone from the customer was on the call, the instance was empty, and the founder was hoping the long build would hold up.
“I know that one of the head of ITs of that customer was on the call, and they saw a data flow from Zendesk to a system that they did not know. And they were like, boy, that should not be happening.”
Abhi Sharma, at 22:45
The detail that makes the story is who it happened to. “And this was the person who was very proud that they knew about where the data was flowing.” The head of IT left the call to get it fixed right away. It was a little scary for the customer, Abhi said, and it was magic for Relyance, “because, like, okay, we provided you that visibility which you didn’t think you had.”
I’d tell this story to any security leader who trusts their data flow diagram. Nobody in it was careless. A support tool had an integration, the integration sent data somewhere, and the diagram was drawn before that happened. Support systems are a good place to look first, because tickets carry whatever customers type into them, and integrations tend to get added by the team that runs the queue, not by the team that owns the diagram.
Relyance’s public record picks up soon after. In June 2022 the company said it had completed a SOC 2 Type II audit and named security practitioners as angel investors and advisors (X). The next spring it was a top 10 finalist in the RSA Conference’s Innovation Sandbox contest.
See you at @RSAConference 2023 🎉 ! Meet the Relyance AI team at booth #5220. We were also selected as a top 10 finalist in the 2023 Innovation Sandbox Contest!
Relyance AI (@relyanceai) · April 21, 2023
Floss every day
Sasha asked what really drives interest in tools like this. Is it businesses trying to do the right thing, or regulation that started in Europe and has been seeping into the US? Abhi said the good intentions are real and front and center with a lot of customers, but they don’t move budgets on their own.
“But yeah, in practical reality, it doesn’t always lead to the actions, because, like, doing the right thing sometimes sounds like, okay, brush your teeth every day, floss every day, don’t drink too much alcohol, you know, don’t stay up at night. And like, we know that preaching abstinence doesn’t always work.”
Abhi Sharma, at 24:04
What actually accelerates adoption, he said, comes in three forms. The first is regulatory pressure. The second is the customer asking, and his example is one I’ve watched happen at our clients.
“It’s like, I have seen many times our customers take screenshots from Relyance and give it to their sales team, because they can accelerate a deal they are part of.”
Abhi Sharma, at 24:36
Their customers want visibility, and they want to know their data is isolated from every other tenant’s. “Like, how can you prove that to me? Well, I got to show you a data flow diagram.” A diagram is the cheapest piece of evidence in enterprise sales and one of the most persuasive, as long as it is true.
The third accelerant was the newest in 2025: blessing the adoption of AI quickly, which Abhi said everybody wants. He had seen customers stuck at the starting line.
“And I have seen a lot of our customers many times be blocked in being able to launch some of the AI initiatives because they’re not sure if data from EU residents was used and they didn’t ever ask for consent.”
Abhi Sharma, at 25:04
That worry has a regulator behind it. In December 2024, the European Data Protection Board adopted an opinion on personal data in AI models, covering when a model counts as anonymous, when legitimate interest can be a legal basis, and what happens when a model is built on unlawfully processed data. If it was, the board said, “this could have an impact on the lawfulness of its deployment,” unless the model has been properly anonymized (EDPB). If you can’t say which data went into a model, you can’t answer that question, and the launch waits.
Abhi thought AI would be the biggest driver of the three in the end, even though it was early: “well, we got to move fast, because CEOs are going to be like, AI everywhere.” And moving fast with AI needs the other two factors in his equation to keep up.
A one-week proof of value
I asked the question every security leader listening would ask. You’ve always got that ticket, the one that says the data flow diagram needs updating. If someone wants to try Relyance, what does it look like? The answer was a demo request, a reply within ten minutes, a short scoping exercise, and then a small trial.
“But otherwise, it’s a small proof of value, which, the longest we have done is two weeks, the shortest we have done is one day.”
Abhi Sharma, at 26:05
The scoping, he said, is there because of how the lineage gets built: “we start all the way from source code to data in motion to data at rest. And then we stitch the lineage without an agent in the picture.” Agent here means the old kind, a piece of software you install on every server, and the point is that Relyance reads what’s already there. The scope has to describe one connected system, though. He used me as the example: if I pointed it at the code for one set of microservices, the logs for a different set and an unrelated Snowflake instance, “it will all work, but it won’t show you the full lineage journey.”
So to get going, I said, it’s a phone call and access to some GitHub repos, some logs and maybe some third-party APIs. “That’s the attempt, that’s the design,” Abhi said, and then he connected it to his past. He had faced the same problem at his previous startup, which never had a good GDPR solution and was acquired before it needed one. And he corrected my introduction.
“But you mentioned Cisco, I was really actually at AppDynamics, which was acquired by Cisco. And at AppDynamics, I was one of those engineers who wrote the early kind of the observability stack there.”
Abhi Sharma, at 27:28
The correction is worth keeping straight. His LinkedIn lists AppDynamics from January to December 2015, and Cisco bought AppDynamics in January 2017, after he had left for FogHorn (Wikipedia). The observability background is the key to the product. Logs, metrics and traces already exist in most companies, and Relyance tries to “piggyback on some of the investments our customers have made in their systems,” instead of asking for a new deployment before anyone sees value.
The telephone operator comes back
Sasha and I go to a lot of AI events in San Francisco, and I asked Abhi the question that comes up at every one of them: will agents start to replace humans?
“Yeah, I think my personal opinion is, I don’t think we’re anywhere close to agents necessarily replacing humans, even with, like, probably another decade out of progress.”
Abhi Sharma, at 28:17
He described himself as being in “the tech-optimistic camp.” Some roles may go, he said, but “humans are creative enough to always find higher-order tasks.” His summary was “more augmentation with AI rather than, quote unquote, replacement,” and then he reached for a job that already disappeared once.
“And who knows, maybe, if you remember, back in the day we had telephone operators whose job was to just connect one line to another line, and that job went away. Maybe that job comes back again.”
Abhi Sharma, at 28:53
Switchboard operators connected calls by plugging cords into jacks, and automated exchanges replaced them, first for local calls and then for long distance (Wikipedia). Abhi’s version connects context instead of lines. “But it’s the telephone operator, but a far more sophisticated one, that’s just nudging and prodding the agents on certain direction.” The human stays in the loop for the higher-order business outcomes.
His reason for the long timeline was about how models think, or don’t.
“Like, yes, it reasons really well, but it reasons out of what it has learned from the internet instead of first-principles thinking.”
Abhi Sharma, at 29:35
“So unless there’s a new transformer-style architecture that evolves on second-order thinking, I think we will be just fine.” I’m with him on the optimism. Agents are software. We choose what they’re for, we write their prompts, we decide what they can reach and we test what they do. “We’ll build it so that it serves us as humanity,” I said, and that is the job. The telephone operator in Abhi’s picture is the person who understands the whole system well enough to route the work, and that’s a role security teams already know.
Infrastructure for trust
I asked what success looks like, for Abhi and for Relyance. He warned us first that “not all of my employees always love me for saying this,” because he plans on a scale of a century. The business he wants to be in is helping society get far more productive work out of technology, safely, by playing a role “at the infrastructure and governance layer.”
“So if you take that long-term horizon, the way we think about it is Relyance becomes one of those infrastructure [layers] where, you know, just like Stripe is the infrastructure for payments, we become the infrastructure for trust and governance, because it’s going to be very much needed.”
Abhi Sharma, at 31:05
The second part was the timescale: “we are definitely looking to build a generational business in this category, which lasts multiple decades and multiple centuries, even after I’m dead.” The third part was money and pride, in that order and then reversed. He wants great revenue, and “I want to build generational wealth for all of our team members at Relyance.” But an IPO wouldn’t be enough on its own.
“But I will personally be still dissatisfied if our customers don’t talk about us as, like, man, that team really knew how to build great experiences, or that design was great, or that product experience was beautiful.”
Abhi Sharma, at 32:07
Then the polymath came back. Abhi studies architecture when he can, and he asked the question that bothers anyone who does: “where are all the beautiful buildings we built back in the day? Like, what’s wrong with us?” His answer for his own company is a standard more than a strategy. “So I care about building beautiful things for the sake of it.”
It is unusual to hear a security founder talk about beauty. I think it belongs in the equation. Transparency is partly a design problem: a data map nobody can read doesn’t make anyone trust anything, and a beautiful one gets screenshotted and sent to a buyer.
Don’t wait for permission
I closed the way we often do. If Abhi could go back in time and meet his younger self, would he, and what would he say? He’d go back to his early teens or twenties, and the advice was short: “just to drive harder and take more risks.” “Take more risks,” I repeated, and he explained why.
“Yeah, I grew up very poor, growing up in India. And I think when you’re kind of in a slightly boxed-in economic situation, there’s a lot of permissioning that happens around your life, which is like, you always have to get approval for something or permission for something, or your constraints decide what you can or cannot do.”
Abhi Sharma, at 33:14
He would tell his younger self “to just do it and not wait for permission.” “I love that. Don’t wait for permission,” I said, and it’s the line from this episode I think about most. It connects to the beginning, too. A founder who builds for 18 to 20 months before selling anything, and who leaves an exit to start over, has clearly stopped asking.
Months later he put the same idea in two words.
@karpathy seems to be becoming the new @naval of Silicon Valley, but this is 100% a keeper. Agency > Intelligence. Always. All worthwhile and memorable things in life almost din’t happen, if not for insane agency.
Abhi Sharma (@abhisharma_b) · October 27, 2025
What happened after the tape
The three jobs from Abhi’s first answer are still the three jobs, in reverse order. On the tape they were global privacy compliance, data security posture management and AI governance operations. His LinkedIn now lists Relyance’s work as “AI security evals and guardrails tailored to your business,” then AI governance and data posture management, then end-to-end privacy automation (LinkedIn). The company page says the same thing in its tagline, and lists 11 to 50 employees in San Francisco (LinkedIn). The newest job, AI, moved to the front.
The first new product came in March 2026. For RSAC 2026, Relyance introduced Lyo, which it called an AI-native data defense engineer that “continuously monitors thousands of data journeys across code, cloud, SaaS, AI systems, and identities.”
Introducing Lyo™: the world’s first AI-native data defense engineer. Traditional tools scan, humans fix, and risks multiply.
Relyance AI · March 20, 2026
By Black Hat USA in August, the pitch had become identity and AI together. Abhi’s post from the first day of the conference described the booth demo as “a live map of every path AI and identities take to your sensitive data,” with enforcement that cuts the paths that shouldn’t exist.
If your agents, copilots, and AI-generated code grew 10× this year and your product security team didn't, we should talk.
Abhi Sharma · August 4, 2026
Then, in October, came Relyance Guard. Abhi’s posts describe evaluations tailored to a company’s own business, policies and AI use cases, run before every AI feature release, with the same rules enforced as guardrails at runtime. His one-line version is “What you test is what you enforce.”
Your AI eval suite can't be 40 prompts in a spreadsheet nobody maintains, or some generic frontier eval that is just benchmaxxing without your business context.
Abhi Sharma · October 10, 2026
The post I’d read twice is a short one from a few days later. Abhi argued that starting AI governance with workflows, risk assessments and compliance is a mistake, and that you need to understand the agent’s blueprint and the model doing the thinking first. His design rule is to “keep the thinking layer separate from the action layer,” so the agent stays useful while unintended or unauthorized actions are avoided.
Workflows and assessments matter, but they should be side effects or derived artifacts of the agent's deep, inherent understanding of your business and institutional knowledge.
Abhi Sharma · October 15, 2026
The website moved with it. Relyance’s home page now reads “AI evals and guardrails tailored for your business” (relyance.ai). The governance page describes an inventory of AI use cases, models, agents, MCP servers and vendors built from code and traffic, and it puts the bottoms-up thesis from this episode in one sentence: “Every outside AI vendor is found in traffic, not in a questionnaire” (Relyance AI). The privacy page still does the work from the first job, building a record of processing activities from “how data really moves” (Relyance AI).
Read together, the arc is consistent. In 2020 Abhi bet that AI would draw a line between before and after. In early 2025 he told us trust was a multiplication, and that AI raises business value and strains transparency and security. By the end of 2026 his company was testing AI features before release and enforcing the same rules at runtime, which is that equation turned into a product. For a startup the takeaway is the same as it was on the tape: you can’t sell the value without the other two factors, and the fastest way to raise them is to know where your data actually goes.
Did you catch it? A six-question quiz
Interactive · six questions
Did you catch it?
Six questions on what Abhi, Sasha and I actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.
-
How does Abhi say trust works across transparency, security and business value?
- It's their sum, so strength in one makes up for another
- It's their product, so if any one is zero, trust is zero
- It's whichever of the three is highest
b. "Trust is a multiplication of those three things, which means that if any portion of those three things I just mentioned is zero, trust is equal to zero." Transcript, 5:24.
-
How does Abhi describe most of the data flow visualization in the market?
- Very column to column between databases
- End to end across every service
- Built from customer interviews
a. "And whatever that exists is very column to column between databases." Transcript, 8:11.
-
What does Relyance call the policies a company has to enforce?
- Controls
- Guardrails
- Obligations
c. "And I think when security folks, or even organizations, use the term policy, we like to call obligations, because it's the regulations, it's the compliance frameworks, it's the contractual commitments you make to your customers, and your internal policies." Transcript, 11:07.
-
Which line in enterprise agreements does Abhi say is now the most hotly negotiated?
- The vendor will use de-identified customer data to improve its software
- The limitation of liability
- The uptime commitment
a. "for the longest time there used to be a little line in those agreements: we will use your de-identified data to improve our software. And it is the most hotly negotiated item now, especially with our enterprises." Transcript, 15:28.
-
Where does the phrase unreasonable hospitality come from?
- A management consulting framework
- The world of fine dining
- Relyance's first customer
b. "No, I did not. It's borrowed from the world of fine dining." Transcript, 19:53.
-
Which job does Abhi think might come back in a more sophisticated form?
- The travel agent
- The typist
- The telephone operator
c. "But it's the telephone operator, but a far more sophisticated one, that's just nudging and prodding the agents on certain direction." Transcript, 29:16.
Can you show a buyer where the data goes?
Abhi’s customers take screenshots of their data flows to their own sales teams because their buyers ask to see them. This scorecard asks eight questions about the product you sell, using the transparency and security factors from his equation. It takes about two minutes.
Scorecard · eight questions
Can you show a buyer where the data goes?
Answer for the product your next enterprise buyer is evaluating, AI features included. If two answers fit, pick the lower one.
-
Can you show a buyer where their data goes, from your code through your services to every third-party API?
- No, or only the diagram from last year's audit
- Database to database, but not through services and third parties
- End to end, current, and generated from the systems themselves
"And whatever that exists is very column to column between databases." See Column to column.
-
For each store of customer data, do you know why it's there, who uses it and for what?
- We know what's stored, not why
- For the main systems
- Every store has a purpose, an owner and the service it supports
"Okay, great. But why? What do I do with it? How do I provide a service?" See Okay, great. But why?.
-
Does your contract say whether customer data trains or improves your models, and does it match what your systems do?
- We use the standard clause and haven't checked
- The contract is clear, but nobody has checked the systems against it
- The clause is explicit, and we can show the data flows that back it up
"we will use your de-identified data to improve our software" is the line enterprises strike. See The clause everyone strikes.
-
Are your obligations in one place: the laws you're under, your frameworks, customer commitments and internal policies?
- They live in contracts and people's heads
- Policies are written down, customer commitments aren't tracked
- One list, mapped to the systems each obligation covers, updated with every deal
"And there is no way a human being is going to write all of those down, let alone the version control of updating over time." See We like to call them obligations.
-
Can you keep a customer's data in its region, and run the data plane in their environment if they ask?
- Not today
- In region yes, in their environment no
- Both, documented, with a standard answer ready for the questionnaire
"Number one, if they have operations in EMEA, they don't want the data to leave EMEA, if you will, and come to the US." See The data plane stays home.
-
Can you prove tenant isolation with evidence, not a sentence?
- We say it in the questionnaire
- We have an architecture document
- A data flow diagram and test results we can share
"Like, how can you prove that to me? Well, I got to show you a data flow diagram." See Floss every day.
-
Before an AI feature ships, does someone check the legal basis for the personal data it uses?
- No
- Sometimes, when legal is in the loop
- Every AI feature gets a data review with a named owner before launch
Abhi's customers were blocked when they couldn't say whether EU residents' data was used without consent. See Floss every day.
-
How old is your data flow diagram?
- Updating it is a ticket that's been open for months
- Updated for the last audit
- Regenerated whenever the systems change
"oh, we have to draw an updated data flow diagram." See A one-week proof of value.
A buyer who asks where their data goes won't get an answer you can prove yet, and in Abhi's equation that sets one factor near zero. Start with one product: draw its data flows from the code, write down why each store exists, and decide your answer on training before the next questionnaire arrives.
You know your main systems and you have written policies. Close the gaps buyers ask about next: the flows through services and third parties, the list of obligations from your contracts, a residency answer, and evidence of tenant isolation you can share.
You can show a buyer where their data goes and why. Keep it current: regenerate the map when systems change, update the obligations list with every deal, and run a data review before each AI feature ships.
What is your trust score?
Abhi’s equation is easy to say and easy to underestimate. Score the three factors for the product you sell, and compare what you’d get if trust were a sum with what you get when it’s a multiplication.
Calculator
What is your trust score?
Three honest estimates, in percent: how much of the data flow behind your product you could show a buyer today, how much of it is covered by the security you have promised, and how much of the value you sell the product delivers today.
Added up, these scores average 77%. Multiplied, the way Abhi defines trust, they make 43%. Your weakest factor is at 60%, and 10 more points there would add 7 points of trust, at least as much as 10 points anywhere else.
A zero anywhere makes the whole product zero. That is Abhi's point, and the reason a security review can stop a deal no matter how good the demo was.
From cloudlets to guardrails
Everything on this page sits on one timeline, from a Carnegie Mellon paper on edge computing to Relyance Guard. Filter it by thread.
Timeline · 2009 to 2026
From cloudlets to guardrails
Filter by thread. Dates are from the public record except where marked as part of this show.
- Edge computing
Mahadev Satyanarayanan of Carnegie Mellon publishes the first paper on edge computing, on cloudlets for mobile computing (Wikipedia).
- Fully homomorphic encryption
Craig Gentry describes the first plausible construction of a fully homomorphic encryption scheme (Wikipedia).
- Kontext
Abhi founds an indoor analytics platform at Carnegie Mellon, advised by Mahadev Satyanarayanan (LinkedIn).
- AppDynamics
A platform engineer on distributed systems, building an in-memory metadata caching layer (LinkedIn).
- FogHorn Systems
A founding member and head of machine learning and analytics, building an edge analytics and inference platform (LinkedIn).
- Cisco buys AppDynamics
For $3.7 billion (Wikipedia).
- The world's best restaurant
Eleven Madison Park is ranked first among The World's 50 Best Restaurants (Wikipedia).
- Relyance AI
Abhi co-founds the company with a privacy lawyer, betting that AI will draw a line between before and after (LinkedIn).
- SOC 2 Type II
Relyance announces a completed SOC 2 Type II audit and new angel investors and advisors (X).
- Unreasonable Hospitality
Will Guidara's book is published (Wikipedia).
- Innovation Sandbox
Relyance is a top 10 finalist in the RSA Conference contest (X).
- Quiet terms changes
The FTC warns that quietly changing terms to use customer data for AI training may be unfair or deceptive (FTC).
- AI models and the GDPR
The European Data Protection Board adopts its opinion on personal data in AI models (EDPB).
- We record episode 70
"Trust is a multiplication of those three things."
- Episode 64
Daniel Marashlian of Drata on building a compliance automation company from the first engineer up (episode 64).
- Episode 70 airs
This conversation, on Podbean, Apple Podcasts and Spotify (Podbean).
- Episode 73
Michael Moore of Glean on how free AI tools become expensive mistakes (episode 73).
- A renaissance in science
Abhi on AI remixing human knowledge, and the time it could free for physics, math and biology (X).
- Episode 75
Jonathan Mortensen on how to use AI without giving up your data (episode 75).
- Lyo
Relyance introduces an AI-native data defense engineer for RSAC 2026 (LinkedIn).
- Episode 95
Pranava Adduri and George Gerchow of Bedrock Data on enabling AI instead of blocking it (episode 95).
- Black Hat USA
A live map of every path AI and identities take to sensitive data, at booth 4902 (LinkedIn).
- Relyance Guard
Evals tailored to the business before release, and the same rules enforced at runtime (LinkedIn).
- Thinking and action
Abhi: understand the agent's blueprint first, and keep the thinking layer separate from the action layer (LinkedIn).
- AI evals and guardrails
Relyance's site now leads with evals and guardrails, then AI governance, then privacy automation (relyance.ai).
What to do this week
Five things, in the order Abhi’s equation suggests.
- Score your three factors. For the product your next enterprise buyer is evaluating, estimate transparency, security and business value honestly, and work on the weakest one first. The calculator above shows why the weakest factor is where the next hour should go.
- Draw the data flow from the code, not from memory. Include the services, pipelines and third-party APIs in between, and next to every store of customer data write down why it’s there. Start with the support tools and their integrations.
- Write down your obligations. List the laws you’re under, the frameworks you’ve been audited against, what every customer contract commits you to and your internal policies, and map each one to the systems it covers. Our vCISO work usually starts with this list.
- Decide your training answer before the buyer asks. Say plainly whether customer data trains or improves your models, make the contract say the same thing, and keep the data flow that proves it. Our Sales Support team helps startups write these answers, and our AI EU Compliance Program covers the European side.
- Have a residency answer ready. Know where each customer’s data lives, whether you can keep it in region and what you’d need to run the data plane in their environment. If you want a second pair of eyes on any of this, book 15 minutes with us.