What business structure should I choose for my startup?

Most venture-backed startups incorporate as a Delaware C-Corp for QSBS tax benefits and investor familiarity. Bootstrapped businesses often start as LLCs with optional S-Corp tax election.

What is the best bank for a startup?

Mercury is the default recommendation for most seed-stage startups — no fees, FDIC coverage up to $5M, and strong integrations. Brex is best when you need cards and banking combined. Bluevine works well for service businesses needing credit lines.

How can AI help startup founders?

AI serves as operational infrastructure for small teams: content pipeline automation, outreach personalization, meeting preparation, document synthesis, and financial tracking. It lets a two-person team compete with a twenty-person team.

What security should a new startup have?

Minimum security setup: password manager (1Password or Bitwarden), MFA on every service, YubiKey for email and banking, email aliases for service segmentation, and domain registrar lock.

Chapter 13

Security

You will be attacked. This is not a risk to plan for in the abstract. It is a near certainty for any public-facing business. The question is how much it costs you when it happens.

What happened when I launched

When I first launched, someone hit me with a spam attack. The volume was designed to overwhelm my inbox so I would miss the important notifications. While my attention was saturated, they got access to my email account. From there, they initiated a withdrawal from my PayPal account. $8,000 was gone before I understood what had happened.

Getting the money back took two weeks of calls, disputes, and documentation. Two weeks of founder time not spent building or selling. It was entirely preventable.

Critical — do these before you launch

Enable MFA on every account: email, banking, payment processors, domain registrar, cloud provider. Use an authenticator app, not SMS. SMS can be SIM-swapped. Use a hardware key (YubiKey) for your email and banking accounts. This takes one day.

Email aliases: segmentation as a security layer

Use email aliases for every service category — not your primary address. Create dedicated aliases like banking@yourdomain.com, legal@yourdomain.com, vendors@yourdomain.com, and saas@yourdomain.com. All aliases forward to your inbox, but the segmentation gives you three advantages.

Breach containment. If a vendor gets compromised and your alias leaks, you know exactly which category was affected. You rotate one alias instead of changing your primary email across dozens of services.

Phishing detection. If you receive a "banking alert" at your vendor alias, you know instantly it is fraudulent. The alias acts as a built-in verification layer.

Access control. When you bring on team members, you can delegate alias access by category without exposing your primary account. An operations hire gets the vendor alias. Your CFO gets the banking alias. Clean separation from day one.

Invest in a YubiKey

Software-based MFA is good. Hardware-based MFA is significantly better. A YubiKey is a physical security key that provides phishing-resistant authentication — even if an attacker has your password and intercepts your authenticator code, they cannot log in without the physical key in their hand.

At minimum, use a YubiKey for your email account, your bank, and your cloud provider. These are the three accounts where a breach has the highest blast radius. Buy two keys — one primary and one backup stored in a separate physical location. A YubiKey costs roughly $50. The cost of a compromised bank account or email is orders of magnitude higher.

SMS is not enough

Do not rely solely on SMS-based two-factor authentication. SIM swapping attacks are real, targeted, and increasingly common against founders with public profiles. Use an authenticator app as a baseline and a YubiKey for critical accounts.

AI prompts

Security audit checklist

I just launched a [type of business]. I use: [email, cloud provider, payment processor, banking, CRM]. Create a security hardening checklist by priority: what the risk is, how to remediate it, and how long it takes. Focus on what a non-technical founder can do without a security team.

Email alias strategy

I am setting up a business email for [company name] on [Google Workspace / Microsoft 365]. Create an email alias strategy: which aliases I need by category, naming conventions, which services should use which alias, and how to set up forwarding rules so nothing falls through the cracks.

Incident response

I believe my [email / banking / payment processor] has been compromised. I noticed [what you observed]. Walk me through exactly what to do in the next 60 minutes: contain the breach, document the incident, begin recovery. Be specific about who to call and what information to have ready.