When is the right time for a startup to take data security seriously?

Spot on, security is not something that can just be slapped together due to external concerns after the product is done - it needs to be part of the product and the mindset from day zero

I know a few founders that should read this straight away