The systems people trust deserve security you can explain.
We work with healthtech, fintech, and B2B SaaS startups facing HIPAA, PCI DSS, or SOC 2 requirements and protecting sensitive data. We test real systems, explain exploitable risk, and help teams move from finding to verified fix.
Security should help you protect trust.
Startups entrusted with health, payment, customer, or other sensitive information face a practical question: which weaknesses could expose what people rely on them to protect?
Those teams need more than a list of vulnerabilities or an audit checklist. They need to know what is exploitable, who should fix it first, whether the fix worked, and what they can accurately show a customer or auditor.
Dravian brings technical testing, human investigation, remediation support, and scoped evidence into one engagement. That is how we help teams reduce uncertainty without claiming that one assessment makes an organization compliant or universally secure.
Serious work. Clear access. Useful outcomes.
Independent judgment
Findings are validated by people and tied to evidence, not just scanner output.
Clarity at every step
A defined scope, practical priorities, direct communication, and a retest that confirms the result.
Respect for sensitive systems
We work within agreed boundaries, minimize sensitive evidence, and can sign a BAA when healthcare data requires it.
Santiago is a product engineer focused on building trustworthy software for teams moving quickly.
He spent his career shipping software for regulated industries. Healthcare, fintech, and B2B SaaS under SOC 2. He served as Head of Product at a Y Combinator healthcare company and has built technology for both big-tech and startups.
He moved into offensive security after repeatedly discovering real vulnerabilities in systems people assumed were safe. Dravian brings that experience to startups that need independent testing, practical fixes, and credible security evidence for customers.
Carvajal
Juan is a software developer and sound engineer whose recent work has focused on cybersecurity engineering. He brings deep operational knowledge of SOC 2 and HIPAA compliance, penetration testing, and cloud security.
He has built healthcare applications for U.S. companies and works fluently across systems, security, and infrastructure. That range is what lets him move between application code, deployment topology, and compliance controls without losing altitude.
Outside the work he is a lifelong car enthusiast.
Build with speed. Test with independent judgment.
Tell us what information you handle, which systems matter, and what evidence you need. We will scope an engagement around your environment and timeline.