Smallstep
Smallstep operates a Device Identity Platform that issues hardware-bound, short-lived certificates via TPMs and Secure Enclaves. It secures access for enterprises across devices, workloads, SSH, SaaS apps, and AI agents, backed by an open-source CA used by 78 Fortune 100 firms.
- Company typePrivate
- Founded2016
- HeadquartersSan Francisco, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What Smallstep does
Smallstep Labs, Inc. operates what it brands as the world's first Device Identity Platform, providing cryptographically attested device identity for enterprise security. The company's core technology binds access to device silicon via TPMs and Secure Enclaves, issuing hardware-bound, short-lived certificates that extend the ACME Device Attestation (ACME DA) standard co-developed with Google at the IETF. The platform secures Wi-Fi, VPNs, SaaS applications, ZTNA, SSH, mTLS, Kubernetes workloads, and CI/CD pipelines, with native multi-OS support across macOS, Windows, Linux, ChromeOS, Android, and iOS. Complementary product modules include Smallstep SSH for certificate-based shell access, Enterprise Relay for MASQUE-based SaaS traffic protection, and SaaS Application Protection for adding device trust to existing IdP logins. Underlying the commercial product, the open-source step-ca server and step CLI toolchain are reportedly relied upon by 78 of the Fortune 100 and form the company's primary developer-led acquisition funnel.
Smallstep makes money primarily through recurring subscription contracts. The pricing surface spans four SKUs: a hosted Smallstep SaaS Cloud, a customer-managed Run Anywhere deployment, Step CA Pro (a commercial drop-in replacement for the open-source CA), and Enterprise Relay. Pricing is not publicly disclosed. Go-to-market is enterprise field sales, with direct sales to IT security, DevOps, and platform engineering buyers, supplemented by a self-service signup and a partner ecosystem of more than 100 integrations spanning MDM (Jamf, Intune, JumpCloud, Ivanti, Mosyle, Workspace ONE), IdPs (Okta, Entra ID, Google Workspace), cloud providers (AWS, GCP, Azure), and developer tooling (GitHub, Docker, Kubernetes). The company is venture-backed by Accel, Bain Capital Ventures, boldstart ventures, StepStone Group, Upside Partnership, and Haystack, having raised a $19 million Series A in April 2022.
The company is headquartered in San Francisco, was founded by CEO Mike Malone, and has 11-50 employees. Its customer base spans defense technology (Anduril), industrial AI (Phaidra, Hadrian), travel technology (Booking.com), healthcare (Heidi, 4D Medical), standards and government (BSI), and endpoint management (Automox, Sunday). The platform holds AICPA SOC 2 / SOC 1 Type 1 compliance and offers a FIPS-compliant commercial CA upgrade, supporting procurement in regulated environments.
Smallstep firmographics
Firmographics- Name
- Smallstep
- Legal name
- Smallstep Labs, Inc.
- Website
- https://smallstep.com
- Company type
- Private
- Founded year
- 2016
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Smallstep operates a Device Identity Platform that issues hardware-bound, short-lived certificates via TPMs and Secure Enclaves. It secures access for enterprises across devices, workloads, SSH, SaaS apps, and AI agents, backed by an open-source CA used by 78 Fortune 100 firms.
- Ownership category
- akta.pro rank
Smallstep industry classification
Industry- Product category
- Identity and Access Management (Device Identity / PKI)
- NAICS
- Computer Systems Design and Related Services (5415)
- SIC
- Services-Computer Integrated Systems Design (7373)
- akta.pro primary industry
- Access Management & Policy Enforcement (Zero Trust) (BPAMAEAH)
- akta.pro secondary industries
- Confidential Computing & Hardware-backed Protection (TEE/HSM) (HDADAFAJ), Single Sign-On (SSO) & Federation (SAML/OIDC, Identity Providers) (HDAEAJAB)
Keywords
Where Smallstep is headquartered
LocationHeadquarters
- HQ city
- San Francisco
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
Smallstep business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations
Revenue model
- Smallstep SaaS Cloud Offering: Default recommended cloud-hosted device identity and certificate management platform. Includes API, Terraform Provider, and Ansible Collection for automation and IaC integration.
- Smallstep Run Anywhere: Customer-managed deployment option for data centers or cloud providers. Requires Kubernetes cluster with PostgreSQL, Redis, load balancing, and KMS/HSM.
- Step CA Pro: Drop-in upgrade for open-source step-ca with advanced features, support, FIPS compliance, high availability, active revocation, and device identity capabilities. Ideal for transitioning from open-source to commercial.
- Enterprise Relay: MASQUE-based private relay servers with hardware-attested device certificates for SaaS and private network access protection.
Go-to-market motion1 record
Distribution channels4 records
Marketing channels6 records
Smallstep product offering
Product offeringCore offering
Smallstep sells a Device Identity Platform™ that issues short-lived, hardware-bound X.509 certificates via the ACME Device Attestation standard, binding enterprise access (Wi-Fi, VPN, SaaS, internal APIs, SSH, workloads, AI agents, MCP) to TPM/Secure Enclave device silicon. The platform is delivered as a hosted SaaS, a customer-managed 'Run Anywhere' deployment, or an on-prem Step CA Pro upgrade, and is complemented by Smallstep SSH, Enterprise Relay, the Smallstep Agent, and the open-source step-ca and step CLI.
Product overview
Smallstep offers the world's first Device Identity Platform™ providing cryptographically-attested device identity for enterprise security. The platform consists of the core Device Identity Platform, complemented by specialized products: Smallstep SSH for certificate-based SSH access, Enterprise Relay for MASQUE-based SaaS protection, and SaaS Application Protection for adding hardware-bound device trust to enterprise logins. The product lineup also includes Smallstep Certificate Manager as a hosted private CA, the Smallstep Agent for device enrollment, Step CA Pro as a commercial CA upgrade, and the open-source step-ca and step CLI toolchain. Smallstep co-developed the ACME Device Attestation standard with Google at the IETF for hardware-bound device identity.
Differentiator
Problem solved
Functional benefit
Products and services
- Device Identity Platform
- Smallstep SSH
- Enterprise Relay
- Smallstep for DevOps
- Smallstep Certificate Manager
- Smallstep Agent
- step-ca
- Step CA Pro
- step CLI
- Smallstep SaaS Cloud
- Smallstep Run Anywhere
- SaaS Application Protection
Quantifiable outcome
- 78 Fortune 100 companies rely on Smallstep's open-source step-ca
- +2 more outcomes
Companies that use Smallstep
Customer profileNamed customers9 records
Segments3 records
Ideal customer profiles3 records
Smallstep technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration25 records
AI capability2 records
Feature6 records
Smallstep partnerships and signals
Strategic signalPartnerships
Eleven partnerships are on record, tiered core and flagship.
- KeycardcoreCollaboration on integrating hardware-rooted identification with policy enforcement for AI agents. Companies are working together to secure autonomous AI systems with cryptographic device identity.
- ChainguardflagshipInitial program partner in Chainguard's Commercial Builds initiative delivering secure container images with zero known vulnerabilities, full provenance, and defined CVE service-level agreements. Smallstep contributes software to be packaged through Chainguard's AI-native Factory platform.
- Fleet Device ManagementcoreStrategic partnership to extend hardware-backed device identity across the modern fleet. Integration enables organizations to verify device trust, enforce dynamic access policies, and manage secure automation across multiple operating systems.
- GoogleflagshipCo-developed ACME Device Attestation (ACME DA) standard at IETF. Google partnership enables hardware-attested device identity leveraging Google's infrastructure and standards work.
- ApplecoreCollaboration on Apple Managed Device Attestation enabling Secure Enclave-based device identity for macOS and iOS devices. Integration supports hardware-bound credentials on Apple platforms.
- OktacoreIntegration with Okta IdP for SSO and device trust verification. Smallstep works as external IdP factor verifying hardware certificates before granting access. SCIM integration for automated user provisioning.
- MicrosoftcoreIntegrations with Microsoft Intune (Windows, macOS), Entra ID (Azure AD), and Azure VPN. Part of Microsoft for Startups program. Dynamic SCEP support for certificate deployment.
- JamfcoreNative integration with Jamf Pro for Apple device management and certificate deployment. Enables EAP-TLS Wi-Fi deployment and device identity provisioning for macOS/iOS managed devices.
- AWScoreAmazon Web Services integration including instance identity documents, EKS Kubernetes certificate management, and AWS Client VPN support. Terraform modules available for AWS deployment.
- Google CloudcoreGCP integration including instance identity claims verification, Google Workspace user sync, and Google Certificate Authority Service integration for ACME-based certificate issuance.
- GitHubcoreGitHub integration for securing Git operations with device certificates. Protects source code access and enables certificate-based authentication for GitHub Actions and enterprise features.
Scale indicators3 records
Recent moves6 records
Expansion highlights6 records
Smallstep competitors and assessment
Company assessmentDirect peers
- Beyond Identity: Beyond Identity provides passwordless, device-bound authentication that ties user identity to device hardware. It is the most direct competitor to Smallstep's hardware-bound device credential model, serving a similar enterprise security buyer with comparable device attestation technology.
- Venafi (CyberArk): Venafi is a leading machine identity management platform focused on PKI and certificate lifecycle automation. Now part of CyberArk, it directly competes with Smallstep's Step CA Pro and Certificate Manager offerings for enterprise certificate authority and PKI workloads.
- Keyfactor: Keyfactor provides PKI as a service and certificate lifecycle management for enterprise IoT, DevOps, and IT use cases. It competes head-on with Smallstep's Step CA Pro and Certificate Manager across certificate issuance, automation, and IoT identity.
- DigiCert: DigiCert is a major certificate authority and PKI platform serving enterprise TLS, IoT, and DevOps certificate needs. Its Trust Lifecycle Manager product competes with Smallstep's certificate automation and private CA capabilities for large enterprise deployments.
- Sectigo: Sectigo provides commercial certificate authority services and private PKI solutions for enterprises. It overlaps with Smallstep's step-ca and Step CA Pro offerings in automated certificate issuance and enterprise PKI management.
- HashiCorp Vault: HashiCorp Vault offers secrets management with PKI engine capabilities used for certificate issuance and mTLS in DevOps workflows. It is commonly evaluated alongside Smallstep's DevOps and certificate management products by platform engineering teams.
Broad incumbents
- CyberArk: CyberArk is a broad identity security platform that acquired Venafi to expand into machine identity management. Its wider portfolio (privileged access, workforce IAM) competes with Smallstep at the platform layer even where the underlying technology differs.
- Okta: Okta is a leading workforce identity and SSO provider that integrates with Smallstep as an external IdP factor today, but is also expanding its own device trust capabilities. Its installed base represents both a partnership channel and a competitive threat for device-aware authentication.
- Microsoft Entra ID: Microsoft Entra ID (Azure AD) and Intune ship native device identity and certificate deployment features that overlap with Smallstep's enterprise IT use cases. As Microsoft extends Conditional Access and certificate-based authentication, it represents the largest incumbent threat to Smallstep's enterprise IT segment.
Emerging players
- 1Password: 1Password has expanded from consumer password management into enterprise passwordless and device-bound authentication. It is an adjacent competitor in the passwordless and device-trust category, with growing overlap in the enterprise IT buyer persona.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks6 records
Key highlights7 records
Customer concentration
Smallstep social profiles
Digital presenceSmallstep compliance and trust
Trust signalCompliance1 record
Smallstep financial estimates
Financial estimateRevenue estimate
Valuation estimate
Smallstep leadership team
Management profileNumber of profiles
Profiles6 records
Smallstep funding detail
Funding detailFunding overview
Funding rounds2 records
Investors6 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Smallstep M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Smallstep
What does Smallstep do?
Smallstep sells a Device Identity Platform™ that issues short-lived, hardware-bound X.509 certificates via the ACME Device Attestation standard, binding enterprise access (Wi-Fi, VPN, SaaS, internal APIs, SSH, workloads, AI agents, MCP) to TPM/Secure Enclave device silicon. The platform is delivered as a hosted SaaS, a customer-managed 'Run Anywhere' deployment, or an on-prem Step CA Pro upgrade, and is complemented by Smallstep SSH, Enterprise Relay, the Smallstep Agent, and the open-source step-ca and step CLI.
Is Smallstep a public or private company?
Smallstep is a private company. It is classified as venture growth investor backed and is currently operating.
When was Smallstep founded?
Smallstep was founded in 2016. It employs 11 to 50 people.
Where is Smallstep based?
Smallstep is headquartered in San Francisco, United States, in the North America region.
How does Smallstep make money?
Four revenue lines are on record. Smallstep SaaS Cloud Offering is the primary driver. The others are smallstep Run Anywhere, step CA Pro and enterprise Relay.
Who are Smallstep's main competitors?
Direct peers on record are Beyond Identity, Venafi (CyberArk), Keyfactor, DigiCert, Sectigo and HashiCorp Vault. Broad incumbents are CyberArk, Okta and Microsoft Entra ID. 1Password is listed as an emerging player.
Does Smallstep have an API?
Yes. Smallstep provides an API for automation and integration. The platform offers a Smallstep API for managing certificates and device identity programmatically. Additionally, there is a Terraform Provider and Ansible Collection for infrastructure-as-code integration. The platform also supports webhooks for certificate events and Wi-Fi authentication events. Developer documentation is at smallstep.com/docs/platform/smallstep-api.
What industry is Smallstep in?
Smallstep's product category is Identity and Access Management (Device Identity / PKI). Its primary akta.pro industry code is BPAMAEAH, Access Management & Policy Enforcement (Zero Trust), with a secondary code of HDADAFAJ, Confidential Computing & Hardware-backed Protection (TEE/HSM). Its NAICS code is 5415 and its SIC code is 7373.