Loading page…
Two brothers turned broken campus blue-light phones into an assembly line of white-labelled safety apps — UCLA got Bruin Safe, NYU got Safe NYU — and sold the company at roughly $7M ARR and 60% margin for $40M.
~60% profit margin · 20 employees · $40M acquisition closed 1 February 2022, a year after turning down $20M from the same buyer · first $1M in year four or five, $2M the next year, 400% YoY growth
Asked on a Zoom call what they would sell for, his brother blurted out "20" — and the $20M offer that came back had an earnout attached. They walked, spent a year taking revenue from about $6M to $7M, and the same buyer returned and doubled it. "One trick with sales is you never put a number out there."
Fewer bars = easier, cheaper, or faster for an AI-assisted solo builder. Editorial judgments based on the case details.
In 2011 David Sinkinson was working at his alma mater when an audit of the campus blue-light emergency poles came back ugly: a lot of them were broken. His pitch was that the phone already in every student's pocket could do the job better — press a button and your location streams in real time to campus police, who come and find you. He built it with his brother Chris, ten years older and, by David's account, the far better coder. What made AppArmor a company rather than an app was the decision not to ship one app. They built an assembly line for custom-branded safety apps: UCLA got Bruin Safe, NYU got Safe NYU, Princeton got Safe Princeton. The institution paid; students downloaded their own school's name from the store. The platform grew to about 50 features, and the one that mattered commercially was mass notification — the bomb threat, the shooting, the weather event, the pandemic. That feature carried them up-market against emergency-notification incumbents whose software dated to 2005 and 2006, one of it built on ColdFusion, and who needed three disconnected systems to send an email, a text and a phone call. AppArmor did all of it from the dashboard the customer was already in. They crossed their first million in revenue around year four or five, hit $2M the following year on 400% year-over-year growth, and landed on Canada's list of 500 fastest-growing companies at 30th for software. At roughly $7M ARR, about 60% profit margin and 20 employees, they sold on 1 February 2022 for $40M to the private-equity owner of a competitor — having turned down $20M from the same buyer a year earlier. That competitor, Rave Mobile Safety, was then sold on to Motorola Solutions for $560M.
The first customer came out of a room David was already sitting in. He worked at his alma mater, ran the audit that found the blue-light emergency poles broken, and pitched the idea to a campus safety working group — a committee with members drawn from across the university.
The quick-reference card — acquisition channels, replication playbook, risks & traps, and our verdict — is members-only.
Join the Unicorn Club — $5/moCancel anytime, in one clickPaste into Claude Code / Codex and get a working version of this product end-to-end.
Two production-grade prompts per idea — a full build spec and an SEO growth plan — plus 10 tailored build specs a week. Members only.
Join the Unicorn Club — $5/moCancel anytime, in one clickEvery claim traces back to a listed source — open any of them and check the number yourself. The exact words are quoted below, with a timestamp that jumps to the second each figure is said.
“…are profitable and by this point we had been doing about 7 million ARR and you know 60% profit margin so like very healthy profitability so they saw we were doing…”
25:26 · hear it in the video“…we were off waited patience one year you made another $20 million and so yourself but the question is how do they not feel like they're going to offer 40…”
27:23 · hear it in the videoData credibility: Founder interview on an M&A podcast. Every figure here — the first $1M in year four or five, $2M the following year, 400% year-over-year growth, about $6M when the first offer arrived, $7M ARR at sale, 50–60% profitability at peak and about 60% at exit, 20 employees, the $20M offer turned down, the $40M price closing 1 February 2022, and the later $560M Motorola Solutions purchase of Rave Mobile Safety — is stated by David Sinkinson himself and is unaudited. AppArmor was private, so none of it is verifiable from filings here, and the interview does not specify a currency. No customer count, churn rate or individual contract price was given. The 6–6.5x earnings multiple mentioned in the episode is the hosts' arithmetic on his numbers, done live on air.
The first dollar came from an institution rather than a student, and that choice was the whole business model. David is blunt that selling personal safety direct to consumers fails — several companies tried it in the same era and largely did — because nobody buys a home security system until after the break-in.
Two things compounded. The first was a content management system for the native apps.
The stretch lasted four or five years — that is how long the first million dollars took — and David remembers exactly how it ended.
AppArmor is one core platform that emits many branded apps. A university buys it and its students download a native iOS or Android app under the school's own name — Bruin Safe, Safe NYU, Safe Princeton. Each deployment is its own instance, which is why the company could say how many subscribers a given campus had on Android versus iPhone and target a push accordingly. The original function was the panic button: press it and your location streams in real time to campus security or campus police. Around it grew about 50 features, driven by buyers rather than a roadmap — campus-wide emergency alerts, real-time location sharing, suspicious-activity reporting. The Florida variant, built after the Parkland shooting for a statewide tender, let anyone report suspicious activity straight through to law enforcement. Behind the apps sits the piece the institution actually spends its day inside: a web console where staff manage their own app content and send mass notifications. That console later grew into a full emergency notification system covering push, SMS, email, voice and computer screens, so an emergency manager could run a campus-wide alert through one workflow instead of logging into three vendors. The console, not the button, is what made AppArmor hard to rip out.
Annual subscription contracts sold to institutions, priced on the size of the buyer and the number of potential app users — the standard the emergency notification market already used. A two-year community college and a large research university pay very different amounts for the same platform, so revenue scales with the customer's budget rather than with AppArmor's cost to serve. That gap is where a 60% profit margin comes from. The second revenue line was expansion inside the existing base. Once a campus had the app, mass notification was an upsell into an account that had already bought, already trusted the vendor, and was already paying somebody else for the same job badly. That is the cheapest revenue in software, and it is what lifted average contract values enough to matter at 20 employees. Public-sector buying shaped everything else. Contracts run multiple years, renewals are procurement events rather than quiet churn decisions, and new business often arrives through RFPs. The statewide Florida tender after Parkland was, in David's telling, a dogfight — rival bidders phoned AppArmor pretending to be the selection committee to tell them they had lost. They won it anyway, and the visibility that followed, including a sitting US president tweeting about the Florida program and featuring the app, did more for credibility than any marketing budget they could have bought.
The apps were built on Appcelerator Titanium, a cross-platform framework that no longer exists — David volunteers it himself as a tech debt story. It solved the real 2011 problem of shipping to iPhone, Android and BlackBerry from one codebase, and then became a liability in the same way Facebook's abandoned hybrid experiment did. Anyone copying this should assume the cross-platform tool they pick will be somebody's cautionary tale in eight years, and budget the migration instead of hoping. The economics were unusually good for a vendor selling to public institutions: 50–60% profitability at peak, about 60% at the time of sale on roughly $7M of ARR with 20 people. Two decisions produced that. The customer-facing CMS removed the custom-development treadmill that eats services hours per account. And the team was hired mostly straight out of school and grown internally — David's analogy is a farm team — which keeps payroll well below what a mature enterprise vendor carries. Our read: the cost line people underestimate is delivery. Voice calls and SMS at campus scale are metered per message, and an emergency notification product is judged entirely on the one day a year it has to work, which forces redundancy you pay for every month it does not.
Copy the assembly line. The reason AppArmor stayed software rather than sliding into services is that one codebase produced many branded instances and the customer configured its own. If you are building anything a buyer wants to feel is theirs, ship the customer-facing configuration surface before you take the second customer, not after the tenth email asking you to move a button. Copy the pricing anchor. They did not invent a pricing model; they borrowed the one their buyers already approved every year for an adjacent product. In institutional markets there is nearly always a neighbouring line item, and pricing against it removes the hardest objection in the room before it is raised. Copy the up-market move, which is the real lesson buried in this story. They entered as the cheap add-on nobody felt threatened by, then used that foothold to sell the expensive thing their customers were already buying badly elsewhere, from a dashboard those customers were in daily. Our read on what to change: pick a different vertical. Campus safety now sits inside Motorola, and US higher-ed procurement is long, political and relationship-heavy. The structure — branded instance per customer, self-serve console, incumbent's product bundled in — is wide open in hospital systems, large industrial sites, school districts outside the US, stadiums and municipal government. AI-assisted development makes the assembly line dramatically cheaper to build than it was in 2011; the nine years AppArmor spent were in committee rooms, not in the code.
Consolidation is the obvious risk and it already played out here: the buyer was the private-equity owner of a competitor, and that competitor was then sold to Motorola Solutions for $560M. In a niche with a handful of vendors, the acquirers end up owning the shelf, and a newcomer is selling against a bundled incumbent that already has the procurement relationship. App fatigue is second, and the hosts raise it directly. Every campus vendor wants its own install, and the learning-management and student-life platforms would rather absorb safety into an app students already open. A single-purpose app used once a year is structurally fragile against that. Liability and reliability are third. People use this during a shooting. The failure mode is not churn, it is an alert that did not arrive, and the diligence, insurance and uptime expectations are priced accordingly. Then there is dependence on public money and public process. RFPs can get dirty — AppArmor had rival bidders phone them pretending to be the decision committee to tell them they were out — and one state contract can swing a year. Finally, tech debt: their cross-platform framework was discontinued, which is a slow-motion rebuild nobody puts in the budget.
The four founder playbooks — first customers, first dollar, the flywheel, the silent stretch — are in the Unicorn Club, on this idea and on all 1,435 others. The story, the numbers, the sources and every later section stay open to everyone.
Join the Unicorn Club — $5/moCancel anytime, in one click