Your heartbeat is your password

These days, Toronto tech entrepreneur Karl Martin often feels like he's careening down a highway, looking for the one exit that will take his four-year-old firm, Nymi, to its optimal destination. That destination is a home-run application for Martin's heavily hyped biometric security device—a wristband, likewise called Nymi. The application must "scale globally," to use a favourite phrase of the coaches, angels and venture capitalists who talent-spotted and then backstopped the 36-year-old engineering PhD.

The Nymi wristband—the name comes from the Greek root for "name"—is fitted with a sensor that can, when activated by the touch of a finger, discern a unique cardiac pattern in the wearer's body. It's an imprint based on minute physiological differences, but the pattern is not altered by changes in pulse. When digitized and transmitted wirelessly, the pattern can be used as a virtually foolproof substitute for a password—or, more likely for the average wired citizen, a plethora of passwords.

Like every other start-up in the "wearables" sector, Nymi (formerly Bionym) is acutely aware of this spring's Apple Watch launch, which is expected to transform wrists into a new battleground for the consumer electronics industry. So far, the potential uses for Nymi's technology include online banking, car-door locks, perimeter security and health-care devices. All manner of applications are regularly being pitched to the firm.

But Nymi and its backers are waiting for a better, bigger junction, and hoping Apple doesn't get to it first. "The discipline is crazy," admits Martin. "Until you have that repeatable business model, you don't have that certainty."

"Going from an infinite number of possibilities to one or two is a non-trivial exercise," says Ajay Agrawal, a professor of entrepreneurship at the University of Toronto's Rotman School of Management and founder of the Creative Destruction Lab (CDL). "You can run out of gas just exploring all the different options."

A Dragons' Den-esque accelerator that connects mentors and start-ups, CDL took on Martin and his small team in early 2013, and persuaded him to execute a critical pivot.

While completing his PhD, which focused on cryptography, Martin had found himself working on a contract for the Information and Privacy Commissioner of Ontario and the province's gaming agency. The two bodies wanted a facial-recognition system that could be installed at casino entrances to spot self-identified problem gamblers. After the system was deployed, he says, "I got the bug. I wanted to actually build things, not just write papers."

Martin and his partner, electrical engineer Foteini Agrafioti, turned their attention to the problem of password authentication: Security-conscious users soon grow weary of storing long lists of passwords for all their various devices, banking and e-commerce sites, and work systems.

The work draws on Agrafioti's doctoral research on the use of heart rhythm as a biometric. "We felt we had a technology to solve the authentication problem," says Martin, whose casual demeanour contrasts with the messianic sense of destiny sometimes emitted by others of his ilk.

The early game plan for Nymi, honed through another U of T incubator program called The Next Founders, was to license the technology, perhaps to a smartphone manufacturer. Martin recounts that he and Agrafioti (who left Nymi in 2014 and is now an executive at software developer Architech) met with many potential licensees. "You realize that it's not validation just because someone at a big company wants to talk to you," Martin says. "We couldn't get it over the finish line."

After Nymi signed up for the CDL program, in the spring of 2013, one of the lab's mentor-entrepreneurs expressed doubts about the firm's licensing-based business model. That led to an epiphany: They needed a product. Armed with a small provincial grant, Martin, Agrafioti and two engineers holed up in a dingy office in U of T's Banting and Best Centre and designed the Nymi band in four weeks. "After a few days," Martin says, "we couldn't sleep. We had to do this."

They presented the prototype at the next CDL pitch session. "It blew them away," Martin says. With public irritation over password proliferation cresting, the financial floodgates swung open: Agrawal and two other angels, Nigel Stokes and Dennis Bennie, contributed seed capital, as did Daniel Debow, a serial tech entrepreneur. Mobile-focused venture capitalists Relay Ventures came in early with $400,000, led the second round of fundraising for $3 million and then promoted a more ambitious round in early 2014 that raised $14 million. Relay partner Alex Baker describes Martin's vision as "big and disruptive.... There's going to be as much of a fight for the wrist as the credit-card fight for the top of the wallet."

Although he's versed in the art of the entrepreneurial narrative of discovery and overcoming, Martin has to take a few runs at explaining Nymi's current thinking about the most promising "use cases."

In the short term, he explains, it's about selling the wristbands, which, for a time, went for $79 or $99 to biometric self-starters. But the company is shifting its focus—looking for that exit—from selling a consumer wearable to providing "enterprise" solutions (corporate fees) or embedding the technology in another ecosystem, such as a smartwatch (licensing royalties). Martin adds, "our core competency is not necessarily around owning something beautiful."

The company's president and head of business development, Andrew D'Souza, left the firm earlier this year after Nymi's latest tactical pivot. "We mutually decided that there wasn't a fit any more," says Martin.

In recent months, Nymi's code writers have been working with the Royal Bank of Canada on a pilot to allow contactless payment on MasterCard's tap-card terminals. Apple, of course, is working on a similar system. "We don't want to be like Apple Pay," Martin says. "We just want this to be a ubiquitous technology."

While there are all sorts of theoretical possibilities for Nymi's IP, the reality is that some industries—Martin cites firms that install security pass card systems—are locked into prohibitively long reinvestment cycles. "We have to position ourselves to be broadly compatible within existing systems," Martin says. But he knows he's got to home in on a handful of key applications instead of chasing opportunities that pop up. "Every day, we're asking ourselves, are we narrowing the focus?"

It may be, however, that the existing system Nymi seeks is actually a newish consumer market—the smartwatch sector. The wearables business, say many market studies, is expected to grow at a, well, heart-stopping pace once the manufacturers (that is, Apple) hit on an application that is both more compelling than counting footsteps and less generic than wrist-borne e-mail.

All of which means that when anyone's talking to or about Nymi, the conversation invariably comes back to Apple. Agrawal, one of Martin's top advisers, observes that Apple is both a potential threat and a potential exit. "I don't think it's an either-or question." The trick, he adds, "is for Nymi to choose an application where there are no key partners who will sit on their hands, waiting for Apple." And so the search for Nymi's off-ramp continues apace.