Building a Bootstrapped RegTech SaaS: Inside the Efilli Story with Şefik Yunus Özcan

Most startup stories you hear are tidy. Founders meet at a hackathon, raise a seed round, hit product-market fit, and scale to the moon. Real stories rarely look like that.

In a recent episode of the founder series on my Emre Elbeyoglu's YouTube channel, I sat down with Şefik Yunus Özcan, co-founder and CEO of efilli — a Turkish RegTech company that quietly grew into the consent-management layer for most of the country's internet traffic. No flashy unicorn announcements. No nine-figure raises. Just a marketing automation tool that failed, a regulation that arrived at the right time, and a team that kept things simple.

Here's what stood out.

The Pivot No One Plans For

efilli didn't start as a consent management platform. It started in 2019 as a marketing automation tool for small e-commerce stores that couldn't afford Insider-class enterprise software.

It didn't work.

"We were trying to build the product. The product just wouldn't finish. It's a complex job. The team started to fall apart. At that point, it became clear the work wasn't going to go anywhere."

Then Şefik noticed something on the horizon — regulation around cookie consent was coming. He pitched his co-founder Ercan: let's try this instead.

"We changed the website, the social media. The first day, a lead came in. That very first day a lead came in — there's no way to gauge supply and demand normally when you're starting. We thought: something's going to happen here."

That was the entire validation. One inbound lead on day one. They started building the MVP and made the first sale before the product was even ready.

What efilli Actually Does

In plain language: when you land on a website and see that "Accept / Reject / Settings" cookie banner, efilli is often what's running underneath it.

But the bigger framing matters more than the feature:

"We're a technology company that builds software for regulations. Regulation gives people a stomach ache. We give them the medicine."

The pitch works on three audiences simultaneously — legal, IT, and marketing — because Şefik built it to:

• Legal: Solves your KVKK/GDPR compliance problem
• IT: One line of JavaScript. Zero engineering effort.
• Marketing: You manage it. No tickets, no dependencies.

That tri-audience clarity is the whole sales motion.

Demand Generation Before the Demand Existed

Between 2019 and 2022, efilli was barely making money. A few thousand dollars in revenue. Şefik was still working at another startup. So what were they doing all that time?

"Between 2020 and 2022, what we did was pure demand generation. Sales were very low, but we were creating demand — producing content, shooting videos, attending every event, speaking everywhere."

Then the regulation landed. The first enforcement fine hit the news. And the inbox started flooding.

"When the regulation came out and the first penalty decision arrived — that's when the business exploded. The mailbox was just tık tık tık. Because people already knew: there's someone who does this. I've met them. I've heard of them. I've read about them."

The lesson: in a category that doesn't exist yet, you don't sell. You become the answer people remember when the problem finally arrives.

The Growth Numbers

Şefik went full-time in June 2022. Here's what happened:

Today the picture looks like this:

• 2,900+ websites running efilli
• 510 paying customers (active invoiced accounts)
• 54–55 million unique users/month whose consent preferences flow through their infrastructure
• 11-person team
• Profitable, bootstrapped

Banks, telcos, large e-commerce platforms, holdings. The kind of customer list that would normally take a Series B to fund the sales motion.

The "Two Angels and No VC" Story

efilli isn't 100% bootstrapped — they took on two angel investors very early, primarily to set a valuation. But they tried to raise institutional money twice. Both rounds collapsed.

Şefik's read on the Turkish VC landscape is sharp:

"Most VCs in Turkey come from banking and finance backgrounds, not from startup operations. So they chase whatever's hyped. NFTs were hot — let's invest in NFTs. Metaverse — let's invest there. This year it's AI. A lot of funds in Turkey are underperforming right now."

But the more important point is about when money even helps:

"Money is a lever. If you're growing 3x and capital can turn that into 10x, that's an efficient scenario. But if you have a million dollars sitting in your account and you don't know where to spend it — if that million only takes you from 3x to 4x — then taking the money makes no sense."

For B2B specifically:

"B2C runs on petroleum — marketing money. But in B2B, what are you going to market? You've already dominated the Google keywords. You're running ads on Meta and LinkedIn. Your total addressable audience is maybe 15,000–100,000 people. Your marketing budget has a ceiling. You can't just spend your way to growth — you have to build a channel with strategy, intelligence, and creativity. Not with cash."

Kill Your Zombies

One of the most useful frameworks Şefik picked up came from a founder retreat in Austin:

"Kill your zombies. Whatever zombies you have inside the company — kill them, delegate them, or accelerate them."

In practice for efilli, 2025 became the "optimization year." They cut sponsorships. Dropped memberships. Reduced trade-show spend. Turned inward.

"Yes, you go to international fairs, everyone goes, but the world isn't in that buying mode right now. So return to your own backyard, dominate it, optimize, and focus 100%."

The other operating principle:

"If it's not broken, don't fix it. And keep it simple. A simple product solving a complex problem — everyone loves that."

Why Single-Product Companies Win Now

Şefik's read on the enterprise software shift is one of the sharpest moments of the conversation:

"Before, big enterprises bought SAPs, Oracles, Adobes — million-dollar deals plus hundreds of thousands in maintenance contracts. These platforms tied companies down, made them immovable. From the 2020s onward, people started wanting simpler plug-and-play products. Because when you bring a big system in, the problem actually gets bigger — you need people to train on it, maintenance contracts, technical taxonomies. So smaller tools that solve a sized-appropriate problem are easier to buy."

Combined with the team-shrinkage reality:

"Teams aren't big anymore. Someone leaves, their work gets handed to someone else, and no replacement is hired. With agents, this is changing even faster. One marketing person now manages the agency, ad costs, product campaigns, SEO, marketing automation, cookie management, reporting — everyone has become a Swiss Army knife. So every new task is an annoyance. The most common phrase I hear in meetings is: 'Is there going to be effort required from us on this?' Nobody wants the effort."

That's the actual unlock for SaaS in 2026: not features — absence of effort.

Product-Led Growth as Distribution

efilli's banner has a small "powered by efilli" badge on customer sites. So does Popupsmart's. So does ConvertKit's. This isn't accidental — it's the cheapest, most credible distribution channel in B2B.

"We sold to one coffee chain. The moment their competitor sees it, they want it too. They look at the tool — whatever it is, they buy it. Product-led growth is a fascinating growth story."

For a regulation-driven product, the badge does double duty: it signals "this company takes compliance seriously," which is exactly the trust signal the buyer is searching for.

On Founders Being Visible

A recurring theme: founders can't hide.

"The first sale is brutally hard. To make it happen, you have to create serious trust. And that trust ends with the founder. The founder needs to be visible. When buyers Google your name, there should be good things to find — videos, podcasts, articles, some PR. You need to be in the field, doing the site visits, the in-person sales."

This is why Şefik flies to Ankara, Antalya, Izmir, abroad — for single meetings. Sales in B2B, particularly in regulated industries, still closes face-to-face.

"The founder has to put their hand in the mud."

On AI and Where the Risk Lives

When asked whether AI threatens efilli's moat — couldn't an indie hacker rebuild a cookie consent tool in a month? — Şefik's answer is calm:

"Sure, but they can't rebuild the trust. That's not something you ship in a month."

His broader take on AI is worth quoting in full:

"Something an executive at Andreessen Horowitz said stuck with me: In the future there will be two kinds of jobs — the ones in front of the computer and the ones behind it. The people programming AI, and the people taking commands from AI. Being behind the screen is the advantageous position."

He also sees a regulatory wave coming for AI itself — what he calls "AI governance," a parallel to the data governance wave that built efilli's market in the first place:

"Right now AI is a fun tool. People are making videos, animating cats. But the moment it moves from entertainment to the center of business operations, legislation will need to catch up. The EU already calls platforms like Google, Meta, Amazon, and TikTok gatekeepers. AI platforms will need a similar designation — with corresponding responsibilities for how they process user data."

The Founder Math Worth Stealing

Before you scale, Şefik suggests every founder run these scenarios on paper:

1. What's the minimum team size this company can survive with? (For efilli: ~5 people. For a fintech: maybe 40.)
2. What revenue + margin combination makes this a cash cow at that size?
3. What marketing spend, at what return, lets me scale beyond that?

"You don't have time to calculate these while you're in the flow of growing. But if you've already mapped them on paper, your moves become so much easier when the moment comes."

Closing Advice

Şefik's parting words to aspiring founders:

"Entrepreneurship is genuinely hard. It's not a healthy mental life — your brain runs on the work 24/7. It's not the right job for everyone. If your nerves aren't strong, it's brutal. But if you trust yourself and you have the substance to back it up, try it. And look at AI seriously. Many jobs won't exist in the form we know them. Plan your future with that in mind."

Key Takeaways

• The pivot is the product. efilli's original marketing automation tool failed; the consent management business that emerged from it became the company.
• Demand generation > sales in nascent categories. Spend years being the answer, then collect when the question arrives.
• Money doesn't fix a broken lever. Capital amplifies what's already working — it doesn't manufacture growth.
• Single-product simplicity wins in an era of shrinking teams and AI-augmented operators.
• Founder visibility is non-negotiable for B2B trust-building.
• Kill your zombies. Cut, delegate, or accelerate. Don't let dead initiatives consume oxygen.