TL;DR: Two Canadian brothers built an app that turns a smartphone into a campus security device. They spent 11 years building it, didn’t take on outside investment and ultimately sold to a competitor for $40M CAD in 2022.
Biggest lessons:
It’s not about the sale price; it’s about the structure of the deal.
Know your audience – where you market your business should be where your target demographic spends their time.
01: the $20 million no
Competitors had circled for years without any success, which did not go unnoticed. The first real conversation started in March 2020, with Rave Mobile Safety — a direct competitor backed by the growth investment firm TCV. Rave noted that AppArmor had repeatedly beaten them in the RFP process.
By that point the brothers were exhausted, having tackled almost a decade of building and growth by themselves. Under these circumstances, it’s easy to accept whatever offer is presented. The brothers, however, weren’t so easy to break. Rave offered $20 million Canadian to acquire 100% of AppArmor, which was rejected.
It wasn’t the sale price that annoyed them. It was the structure of the deal. The offer had an earnout component, meaning the brothers would have to keep working (possibly even harder than before) to hit sales targets. This didn’t interest them.
“It had a lot of strings attached that we just weren’t comfortable with.”
— David Sinkinson
Twenty months later, the same buyer came back with $40 million, all cash, no strings. Here’s how they got there.
02: how it started
Chris Sinkinson grew up in Kingston, Ontario, a small city about halfway between Toronto and Montreal. He was the oldest of three boys; his brother David, 10 years younger than Chris, eventually helped build the business.
Chris studied computer science at Queen’s University in Kingston. In the late 1990s, IBM came to campus to recruit students with a crazy offer: if students accepted a job offer, they would cover the cost to move to the big city (Toronto), pay for living expenses with no expectations of completing a degree. Chris was intrigued but decided against it in favor of finishing his degree to secure a higher salary.
Little did he know this was at the peak of the dot-com bubble.
He graduated in 2002, almost two years after the crash — Nortel, then one of Canada’s biggest tech employers, laid off thousands of workers. As a new graduate, he was suddenly competing with workers who had 10+ years of experience for jobs in his field. Forced by the hand of fate, Chris wandered into the world of entrepreneurship instead.
What seemed fun at first got hard very quickly. A document management system, e-commerce tools: Chris wrote a lot of code and made very little money. The conclusion was that he was good at coding but not good at marketing his ideas to others.
In 2010, he went back to school for an MBA at his alma mater, Queen’s University, to learn more about the subject.
The timing of Chris’ MBA meant he was on campus at the same time as his brother, David, who was finishing his undergraduate degree. Their lunches together consisted of Chris regurgitating lessons he had learned in class, while David, who now ran the school newspaper, put those ideas into action (or publication, more accurately).
Their first project together was a mobile app for newspapers.
Chris later reflected on this first real business idea: “It wasn’t a great market. It was definitely one of those markets that was headed in the wrong direction.”
In other words, it flopped.
the campus security audit
Around the same time, David was part of a campus safety committee that was in the process of auditing the blue-light emergency phones scattered around campus — the ones with a button that calls campus police. Two things stood out to David: first, roughly 30% of the phones were broken and second, they only helped if you stayed put until campus police arrived.
David’s idea was an almost perfect illustration of opportunity meeting luck. Not only were smartphones now becoming widely adopted (David sat on the campus safety committee just three years after the first iPhone was released), he also saw the smartphone as a way to have a safety device moving with students at all times.
“I’m pretty sure I said, ‘There’s an app for that,’ as part of my pitch. You have to remember this was back in 2011. The App Store was new… I actually had a BlackBerry.”
— David Sinkinson
Chris built it. The first version did exactly one thing: press a button in the app, and your phone’s location was sent to the campus security office, showing real-time location on a map.
After completing his undergrad, David, like Chris, also pursued an MBA and landed a job at a Canadian telecom company. He lasted eight months before deciding to join Chris.
Shortly after, the brothers packed their belongings and moved to Toronto, renting desks at a small incubator while building several small businesses. After a few weeks it became clear that one business (that would later become AppArmor) showed the most promise. The decision was made to sell the other small business ideas and go full steam ahead.
the capital
No seed round, no Series A or B. No funding was ever raised for AppArmor, and there were no investors, just the 50/50 equity split between David and Chris. Other small software projects on the side paid the bills and provided enough funds to launch AppArmor.
“We never wanted to raise venture capital since we heard a lot of horror stories from other entrepreneurs. It’s hard raising funding; and once you do you have to spend a lot of time managing your investors who are just focused on short-term objectives so they can reap returns quickly.”
— Chris Sinkinson
03: the $80/month customer
It took David and Chris three years to build a sufficient revenue stream to dive in full time. Shortly before doing so, the brothers locked down an important first client: their alma mater, Queen’s University. The project that was dreamed up on its campus was also the first paying customer.
Queen’s branded the app Sequre — Q for Queen’s, of course — and offered it to students for free. The brothers charged $1,000 CAD up front and a recurring subscription-based charge of $80 CAD per month.
“I can’t believe how little we charged… We were just so excited to have a client, and we saw tons of potential.”
— Chris Sinkinson
Once the brothers understood how much they had underpriced it, they asked Queen’s to keep the number private. They agreed, considering they had just scored a sweet deal.
As a way to show appreciation, Queen’s entered a national award for campus safety and won. Although the award was presented to Queen’s, the ceremony was attended by university representatives from every corner of Canada. As part of the ceremony, a video demonstration of the app was shown, leaving attendees curious as to who built it. This might have been the best marketing the brothers could ever have asked for.
The second advantage of working with Queen’s was access. Not only was the university campus close by, but the Queen’s faculty was delighted by the brothers and allowed them to sit in the security office to monitor how the software was being used on a regular basis.
“I got to sit in the dispatch room at the institution, talk with the dispatchers, understand their issues, and how they wanted it built. It was invaluable. We should have paid them. Don’t tell my brother Dave that I said that.”
— Chris Sinkinson
Many higher education institutions quickly adopted it after the initial success at Queen’s.
04: navigating modern marketing
For the first few years the brothers marketed the way they assumed a modern software company was supposed to: blog posts and social media. It provided no traction, and it took them an embarrassingly long time to work out why.
The simple explanation was that buyers were campus emergency managers. These are not people who spend their afternoons reading startup blogs or scrolling Twitter for good memes. They attend conferences, check their Outlook, and they publish RFPs.
Upon learning this, they switched their strategy. Instead of posting on social media, they sent old-school emails. Instead of blog posts, they attended trade shows and purchased a booth. They also submitted formal bids for RFPs, the document a school or government body publishes when it wants to buy something and invites suppliers to bid. Although the techniques were old school, time and persistence proved valid.
Four years after the initial launch at Queen’s in 2011, their strategy was starting to pay off. By the end of 2015, the business crossed $1 million CAD ARR, which roughly doubled every two years until the company was sold in 2022.
The second big leap forward was in January 2019. The brothers got an answer on an RFP for the Colorado Community College System and had scored not just one school but thirteen in one deal. This milestone also marked the first cross-border deal and opened the floodgates for other American universities.
05: the tools
the product
The primary product was the mobile safety app sold B2B. A user could press a button, and a live location appears on a map for campus security. Later versions further added mass text-message alerts, anonymous tip reporting, offline emergency plans, and eventually COVID-19 vaccine verification.
founder skillsets
David headed sales and marketing, something Chris had difficulty with, while Chris controlled the technical side of the business: software and product design, app development, and deployment for Queen’s and eventually every university thereafter.
monetization
Monetization was achieved through three primary channels and remained relatively unchanged since first launching at Queen’s. Eventually, just two channels were responsible for cashflow.
Recurring subscriptions. This is arguably the best cashflow decision the brothers made. Institutions paid a monthly or annual fee based on their size. The average revenue stream was approximately $15,000 CAD per year.
The original monetization model included a one-time setup fee, which was later dropped. Several deals stalled because the universities could not fit the hefty fee into their annual budgets. The brothers decided to up the subscription pricing and remove the setup fee.
The third and newest monetization framework was add-ons. As features were built out and the capabilities of the app increased, extras could be tagged onto the basic subscription service if chosen. Just a few of these add-ons brought the annual subscription amount closer to $50,000 CAD per year.
unique branding
As the app’s popularity allowed migration to the United States, the app was rebranded for each school. NYU students downloaded “Safe NYU”. Florida students downloaded “GatorSafe”. Any competent developer could build one campus safety app; almost nobody wanted to operate several hundred app store listings, each with its own institution, review cycle and configuration. This unique ‘rebranding’ strategy for every institution wasn’t just thinking of the customer, it was creating barriers. The operational hassle meant that AppArmor was less likely to have successful competitors.
“We weren’t one app, we were a bajillion apps.”
— David Sinkinson
06: the timeline
The business took 11 years from its inception to final sale to Rave Mobile Safety.
07: the decision to sell
So back to work they went for another twenty months. Revenue kept climbing, especially with a new add-on that provided a vaccine verification system at the height of the COVID-19 pandemic as students returned to campus. That stretch produced the best quarter in the company’s history: approximately $1.5 million Canadian of new recurring revenue.
On November 18, 2021, Rave came back with a second offer: $40 million Canadian, all cash, no conditions. This was an offer the brothers couldn’t pass on.
“In entrepreneurship, you don’t always get an opportunity to ‘lock in’ a win. This seemed like a great opportunity to do just that.”
— David Sinkinson
Because the brothers were sole owners with no equity distribution to investors, the $40 million payout was structured with ‘phantom equity’, so key employees received cash payouts based on the $40 million valuation.
08: the sale process
“I thought you just bought a business like you bought a car. They come on the lot, they kick the tires, they make engine noises in the driver’s seat, and then they take it off the lot. Instead, it’s like the FBI searching your house. They’re just ripping everything out.”
— David Sinkinson, on due diligence
09: what went wrong
01: They marketed where they were comfortable, not where buyers were
Years of blog posts and social media aimed at an audience that was never going to purchase a subscription.
02: Underpricing their first customer
$80 CAD per month ($960 CAD per year) for software that eventually fetched upwards of $50,000 CAD per year per school. Although revenue-wise this wasn’t ideal, it’s the decision that ultimately bootstrapped the business.
03: They copied another company’s culture and lost both employees
Early on, the business attempted to adopt Netflix’s culture, because it had good reviews and other startups were piling on. It alienated their employees, which at the time stood at a grand total of two. Both left shortly afterward. In 2015, five core principles were established that became a core of the business: deliver quickly, deliver quality, thrive on freedom, leave your ego at the door, act in our best interest.
04: Nothing prepared them for due diligence
Eleven years of running the company, and the buyer’s inspection was the most involved part of it. Both describe it as the worst part of selling, and neither one saw it coming.
05: The team found out at the very end
A necessary consequence of the confidentiality agreement. Although employees found out on the day of the sale, they received salary increases, bonuses, and eventually, some even received RSUs when Rave was sold.
10: what went right
01: They rejected the structure, not the number
The single most valuable decision. Turning down $20 million because of how it was paid, rather than how much it was, is what produced $40 million with no strings twenty months later.
02: A thriving business
Saying no to the first offer was acceptable because the business was growing, profitable at a 60% margin, and under no pressure. Do not assume that passing on a lucrative exit and expecting a larger offer to come is reasonable. The reason it worked for AppArmor was because of brute market share, lack of competition, and strong growth in ARR.
03: They kept building during the gap year
The months between offers were not spent waiting for the phone to ring. They shipped a new product timed to campuses reopening and posted their best quarter ever. The second offer was a response to a demonstrably better company.
04: Leveraging future plans
Knowing Rave intended to sell shortly after their exit, the brothers negotiated a slice of that future sale before signing. Ten months later it paid out in spades.
05: Ignoring the noise
For a decade, Chris and David faced scrutiny and doubt from people claiming it was not a real business. This noise was shattered when the cash from the sale hit their bank accounts in early 2022.
11: founded lessons
In their words:
“Don’t pursue validation from your peers. Instead, pursue validation in the market. A couple of years into the business, that realization was a big change that helped me stay on track.”
— David Sinkinson
“If you’re running a profitable, systematized, and growing business, buyers will come to you. You don’t need to shop your company.”
— Chris Sinkinson
“We learned that you need to have face time with clients. It helps legitimize your product. Going to conferences and trade shows are a must.”
— David Sinkinson
“Bigger markets are harder to penetrate if you are a small business with low credibility.”
— David Sinkinson
“Always remember, your culture is a fundamental strategic advantage in the marketplace because it is difficult for rivals to replicate.”
— Chris Sinkinson
12: found(ed) out
Co-founder David Sinkinson was kind enough to answer a few questions for Founded.
How the $40 million was divided between the two brothers → A 50/50 split ($20 million CAD each).
The size of the phantom equity slice in Rave, and what Rave’s own sale actually paid them → It was small, less than a few hundred thousand each (less than 1% of the sale price). We locked in the win!
Tax treatment on the payouts → primarily capital gains, we won taxpayer of the year that year.
Whether any other buyer was ever interested in purchasing AppArmor, or if Rave was the sole bidder → names remain undisclosed but several were in the running, finally narrowing down to just two.
Exact customer numbers between 2012 and 2022 → between 350-400 close to the sale date, with millions of users all security notification systems and apps.
What do interviewers and other write-ups usually get wrong about you or the journey? “They tend to understate the revenue of the side hustles we had going at the beginning. Chris was a serial entrepreneur for years, so he had a few businesses doing a total of about 200K in revenue. This was hugely important - I had some kind of base salary at the start which allowed me to leave Bell and to get things off of the ground.”
What did the day-to-day actually look like in the months before selling became your new reality? “It was challenging because we had to hide everything from the staff. So it was a lot of trying to move the business forward (in the business) and working on the sale simultaneously. This involved a ton of data pulling, scrubbing, etc. We didn’t have AI - we did it ourselves (and with professional support from counsel or accountants).”
On Queen’s as your first client — was it a long process that had you feeling nervous? I can imagine landing that size of a first client is a big deal. “You know, I didn’t really think the safety app product was going to go anywhere! Can you imagine that?! So when we landed Queen’s, I thought it was a fun little thing to help people and a bit of pizza money. It also took them forever to launch, but after we did I started to realize “hey, maybe this could actually work” - particularly after it won the award.”
FOUNDED FACT
There were already two AppArmors.
When the brothers named the company in 2011, a well-known piece of software called AppArmor had been shipping inside the Linux operating system for about a year. It is a security tool that restricts what individual programs on a computer are allowed to do. It started in 1998 under the name Subdomain, was bought by Novell in May 2005 and renamed AppArmor and then scooped up by Canonical (the company behind Ubuntu) in 2009 and was accepted into the core Linux kernel in 2010 — one year before a campus safety company in Kingston, Ontario started using the same name.
For eleven years, a search for “AppArmor” returned both a piece of Linux security infrastructure used on servers worldwide and a campus security app for university students. Chris, a computer science graduate, would almost certainly have known. Neither party appears to have ever minded, and the name never came up as an issue in the sale.
Additional note from David: “They sent us a nasty letter one time. We reached a mutual coexistence agreement where we put a note on our site telling folks about the other AppArmor. We had the Canadian trademark, they had the US one, so I think we called it even.”
LEARN MORE
Built to Sell Radio, Episode 448 — David on the negotiating mistake that nearly cost them $20 million.
Practical Founders, Episode 107 — Both brothers on bootstrapping to $40 million with no investors.https://www.youtube.com/@PracticalFounders
SOURCES
1. Sramana Mitra — “Canadian Brothers Bootstrapping to $40M Exit”, Parts 1–7, July–August 2024
2. They Got Acquired — “These brothers turned down a $20 million offer…”, March 17, 2025
3. CO— by U.S. Chamber of Commerce — “How 2 Brothers Debunked Startup Myths”, November 21, 2024
4. Practical Founders Podcast #107, August 23, 2024
5. Built to Sell Radio, Episode 448
6. Rave Mobile Safety acquisition press release, February 8, 2022
7. Motorola Solutions acquisition of Rave Mobile Safety, December 2022
8. Startup Different — the founders’ book and podcast
9. AppArmor (Linux security module) project history.
Built entirely from public interviews, podcasts and press releases. All figures are as the founders or acquirers stated them and have not been independently audited. Amounts are Canadian dollars unless noted.