Reduce risk in the systems you cannot afford to get wrong. Work with senior engineers across confidential computing, supply-chain integrity, and offline custody.
Reduce risk in the systems you cannot afford to get wrong. Work with senior engineers across confidential computing, supply-chain integrity, and offline custody.
Work directly with security engineers who review, design, and build alongside your team. Practical security work, not a report that leaves the hard decisions to you.
2-8 weeks
We use first-principles threat modeling, system architecture review, code and dependency review, penetration testing, and smart contract reviews to eliminate risks at their source.
1-6 months
Design the system and help build the security-critical parts. Confidential compute platforms, signing ceremonies, hardened build pipelines.
Ongoing
An extension of your team wherever security judgment is needed, including architecture and design reviews, release signoff, due diligence, and security program development.
Work directly with a security engineer to understand the system, define the real risk, and get practical security work done.
01
We discuss the architecture, constraints, risk areas, and decisions where security judgment is needed.
02
We agree on the systems in view, the questions to answer, and what the engagement should produce.
03
We assess, design, test, or embed with your team, depending on what the problem actually needs.
04
We review findings, answer follow-up questions, validate fixes where needed, and leave you with clear next steps.
Distrust stood out from the very first conversation. Their depth of knowledge went far beyond our expectations, and they immediately identified ways we could strengthen our systems before we had even formally engaged them. I'm genuinely glad we chose to work with them.
It doesn't feel like working with a vendor at all. It feels like having seasoned security partners we can bring hard problems to: people who get context fast, push back when our thinking is off, and help us make sharper decisions before issues escalate.
We've worked with Distrust on multiple audits because their reviews are genuinely useful. They stay engaged with our team throughout the process, go deep on the system, and turn complex security issues into clear engineering decisions.
Yes. You work with the people doing the security work, not a delivery bench or handoff team. If we are not the right fit for the engagement, we will say so early.
We treat client information as sensitive by default. We minimize what we collect, keep client work isolated, and avoid routing sensitive material through unnecessary third-party systems. Operationally, we use self-hosted internal tools where practical, compartmentalized client environments, QubesOS-based isolation, and PGP for sensitive material when requested or appropriate. If an engagement has stricter handling requirements, we agree on them up front.
Pricing depends on the system, scope, timeline, and level of involvement required. A focused assessment, embedded engineering support, and an ongoing retainer are priced differently. After an initial conversation, we can usually tell you whether the engagement is a fit and what kind of scope makes sense.
No fixed minimum. Every engagement is scoped around the system, risk, and decisions in front of you. If the work is too small, too broad, or not a fit for us, we will say so early.
Yes. We regularly sign NDAs before reviewing private code, architecture, infrastructure, or internal material. When work touches public or open source systems, we agree up front what is public, what is private, and what can be discussed.
No, and we won’t pretend to. We are best used as senior security support for teams that already have engineers. If you need a full internal security function, we will tell you and help you think through the shape of that hire.
No. Use a specialist compliance auditor for that. Hire us for the security work underneath the certification: architecture, implementation, threat modeling, reviews, fixes, and technical risk.
Distrust is based in San Francisco, US. Our engineering team is distributed globally, with most engagements run remotely across European and North American time zones. We travel when the work needs in-person time.
