Est. 2016 · Washington DC & London

Proof, not
confidence.

We are a formal methods practice. We take the parts of your system that must never fail — allocators, schedulers, drivers, crypto, consensus — and we prove them correct.

Request a scope review See our engagements
  • 140+engagements closed
  • 9CVEs prevented
  • 0unsound proofs

Practice

Six ways we are usually brought in.

Every engagement is scoped and fixed-fee before it starts. The ranges below are what comparable work has cost; the scope review tells you which one you are.

  1. 01

    Verification Readiness Assessment

    Two weeks inside your repository. We come back with the subset of your system that is provable today, the subset that needs restructuring first, and what each would cost. Most clients start here.

    $18k–$26k2 weeks
  2. 02

    Memory-Safety Proof

    Separation-logic proofs of spatial and temporal safety for pointer-heavy C and C++, and for the unsafe blocks a Rust codebase still leans on. Delivered as machine-checked artefacts, not a PDF.

    from $60k6–14 weeks
  3. 03

    Concurrency Audit

    Data races, lock-order inversion, lost wakeups and liveness failures — found with model checking and rely-guarantee reasoning rather than by waiting for them in production at 3am.

    $34k–$70k4–9 weeks
  4. 04

    Proof Infrastructure in CI

    Proofs that are only checked once are decoration. We wire yours into continuous integration with a time budget, a triage path for breakage, and an on-call runbook your team owns afterwards.

    $22k–$40k3–6 weeks
  5. 05

    Specification Workshop

    Three days, up to twelve engineers, in your office or ours. Your people leave able to write pre/post-conditions and invariants that a tool can actually check — and able to read ours.

    $14k3 days
  6. 06

    Technical Due Diligence

    Independent assurance on a target's codebase, written for an audience that includes non-engineers. Used by acquirers, insurers and — twice — by a regulator.

    bespokeon request

Not sure which of these you need? That is what the scope review is for — it is free, it takes about forty minutes, and it ends with a written recommendation whether or not you hire us. Request a scope review

Method

Four stages. No surprises in the invoice.

  1. Stage 01

    Scope

    We read the code before we quote it. You get a written scope naming the exact properties we will prove and the exact ones we will not.

  2. Stage 02

    Specify

    The hardest part, and the part clients underestimate. We write the specification with your engineers, not at them — a spec nobody on your team understands is worthless the day we leave.

  3. Stage 03

    Prove

    Machine-checked, in Coq, Iris or Viper depending on the target. Every obligation is either discharged or explicitly admitted — and admitted ones are listed on the front page of the report, not buried.

  4. Stage 04

    Hand over

    Proofs in your repository, running in your CI, with your team trained to maintain them. We would rather not be a dependency.

Evidence

What the work has been worth.

140+engagements closed since 2016
2.4Mlines of systems code under proof
9CVEs prevented before release
0of our proofs later found unsound
They found a lock-order inversion in a subsystem three separate audits had signed off on. It had been in production for four years. We would never have hit it in testing — the interleaving needed two rare failures at once.
VP Engineeringstorage infrastructure vendor
What I did not expect was how much of the value was in stage two. Writing the specification forced arguments we had been avoiding for two years about what the component was actually supposed to guarantee.
Principal Engineermedical device manufacturer
The report was the first assurance document our regulator accepted without a follow-up round. It said plainly what had not been proven, which is apparently rare enough to be persuasive.
Head of Compliancepayments platform

Working with us

A small practice, deliberately.

Eleven people. We run four engagements at a time and we say no to more, because a proof produced by someone who does not understand the system is a liability dressed as an asset.

There is no sales team. The person who scopes your engagement is the person who works on it.

Hours
Monday–Friday, 09:00–18:00 ET
London engagements run 09:00–18:00 GMT
Response
Scope requests answered within one business day
Hubs
Washington, DC · London, UK
Remote-first; we travel for stage two
Tooling
Coq · Iris · Viper · TLA+ · CBMC

Which part of your system must never fail?

Tell us that, and the scope review will tell you whether it can be proven — and roughly what that costs. Free, about forty minutes, written recommendation either way.

Request a scope review (202) 555-0146