Security-first software for regulated organisations
Since 2011 we have built resilient software for regulated industries, bringing cybersecurity, compliance, and customer journeys together.
Get in Touch Explore Our ProductsWho We Are
We are a Lisbon-based team of architects, security engineers, and product strategists dedicated to shipping software that financial institutions and critical infrastructure can trust. Every engagement follows our four pillars: design-first discovery, secure SDLC, compliance built in, and measurable outcomes.
That approach has helped Siemens, Nokia, SIX Group, and other leaders modernise payments, automate SOC workflows, and bring new digital products to market faster.
Services
Every engagement starts with collaborative design sprints and regulatory due diligence so the software we ship is tailor-made, auditable, and resilient. We audit source code against OWASP ASVS, and we embed with your teams to accelerate secure delivery of mission-critical fintech and security programmes.
Products
Four products we build, run, and stand behind. Pick one to see how it is put together.
Marmot
Marmot is a local AI deployment your people can actually use, with a border post in front of the internet. One machine holds the chat interface, the local model and your documents, and has no route out. A second holds the cloud credentials and decides, for every single request, whether it may leave.
- The machine holding your documents has no route to the internet
- A per-request decision, made in exactly one place
- Users can force local, and can never force cloud
- A decision log you can check against your own firewall telemetry
Alpaca
Alpaca does not replace your SIEM, it completes it. QRadar, Splunk, Sentinel and Elastic handle the events. Alpaca answers what they leave unsaid: who owns each log source, how critical it is, how long its data is kept, and which assets are escaping security coverage entirely.
- Every log source with a named owner, a criticality and a retention period
- CMDB assets correlated against what actually reports, so blind spots surface by name
- Read-only visibility into SIEM configuration and detection rules, with change history
- Entry, update and decommission under approval, by assistant or API
Ibex
Ibex is a sealed appliance that runs on its own hardware inside your perimeter. It maps the attack surface of the environments the cloud can never reach, scans the code your teams build, and governs every model and agent on the network. It has no route to the internet, and the only thing that leaves is the evidence.
- Its own hardware inside your perimeter, with no cloud and no data egress
- Discovers hosts, services and AI systems, including the models nobody declared
- Inline enforcement on live AI traffic: block, redact, or alert
- Findings ranked against a locally held vulnerability database, with no external lookups
Goshawk
Goshawk turns the source-code security audit into software. Nine independent lenses sweep the repository, every finding is handed to a blind second reviewer instructed to refute it, severity is computed rather than estimated, and the report maps to the framework you actually answer to.
- Nine lenses, each reading the code with its own question
- Blind adversarial verification: what survives refutation, ships
- CVSS v4.0 computed by a deterministic library, never guessed by a model
- Two tiers, stated honestly: automated scan, or full audit with senior review
