What Subgraph does

Subgraph is a privately held Montreal-based technology company founded in 2010 that develops Citadel, a hardened Linux-based secure operating system designed for users facing sophisticated adversaries. The platform employs dm-verity filesystem integrity verification, partitioned workspace isolation through container-based or hypervisor-based "realms" (the hypervisor is a custom Rust implementation), atomic signed binary updates, and 100% reproducible builds that allow independent verification of all binaries. The technical architecture addresses the security-debt accumulation problem of conventional operating systems by returning to a cryptographically verified clean state on every boot.

The company operates two revenue streams: open-source distribution of Citadel with commercial licensing available for enterprise deployments, and a professional security services practice delivering security code review, architecture review, application penetration testing, and network penetration testing. Subgraph is an approved supplier for the Open Technology Fund Security Lab and has published security audits for tools serving journalists, activists, and human rights defenders.

Subgraph targets privacy and human rights NGOs, fintech platforms, enterprise software companies, open-source projects, government, financial services, and security researchers. Its go-to-market combines direct open-source downloads from the company website with enterprise field sales for commercial licensing and professional services. The team is small (1–10 employees), the company is bootstrapped with no disclosed external funding, and no headcount growth, M&A, or leadership changes are documented.

Name

Subgraph

Website

https://subgraph.com

Company type

Private

Founded year

2010

Operating status

Operating

Headcount range

1–10 employees

Ownership category

akta.pro rank

Headquarters

HQ city

Montréal

HQ country

Canada

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales

Revenue model

1. Professional Security Services: Expert security testing and code review services including security code review, architecture review, application penetration testing, and network penetration testing. Offered to organizations worldwide through direct engagement.
2. Commercial Licensing: Open source software with commercial licensing available for enterprise deployments. Citadel OS is freely downloadable with commercial licensing options for organizations requiring support and enterprise features.

Go-to-market motion2 records

Distribution channels2 records

Marketing channels3 records

Core offering

Subgraph develops Citadel (Subgraph OS), a custom Linux-based secure operating system built for users facing sophisticated adversaries. The platform provides a tamper-resistant read-only base protected by dm-verity, unlimited isolated partitioned workspaces ("realms") with container- or hypervisor-based isolation, atomic signed updates, and 100% reproducible builds that allow independent verification of every binary. Alongside the OS, Subgraph delivers professional security testing services including code review, architecture review, application penetration testing, and network penetration testing for NGOs, fintech platforms, and enterprise software organizations.

Product overview

Subgraph offers two distinct offerings: Citadel (also called Subgraph OS) is the company's flagship secure computing platform—a hardened Linux-based operating system with partitioned 'realm' workspaces providing strong isolation for different projects, clients, or security contexts. The second offering is Security Services, a professional penetration testing and code review practice that Subgraph operates alongside its product business, having been approved as a supplier for the Open Technology Fund Security Lab.

Differentiator

Problem solved

Functional benefit

Brands

• Citadel: Next-generation adversary-resistant operating system built from the ground up with security architecture including tamper-resistant foundation, partitioned workspaces (realms), atomic updates, and verifiable supply chain. The core product of Subgraph OS.

Products and services

• Citadel (Subgraph OS)

Quantifiable outcome

• 0 persistent base data - system returns to clean state on every boot
• +2 more outcomes

Named customers3 records

Segments10 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature6 records

Partnerships

One partnership is on record.

• Open Technology Fund Security LabcoreStrategic or Co-development PartnerSubgraph is an approved supplier of penetration testing and security audit services for the Open Technology Fund Security Lab. For many years, Subgraph has been trusted to assess the security of critical tools used by journalists, activists, and human rights defenders worldwide.

Scale indicators3 records

Recent moves4 records

Expansion highlights4 records

Others

• CensoredPlanet / ICLab-style anonymity researchers via Guardian Project: Guardian Project builds mobile privacy/security tools for at-risk users. Operates in the same ecosystem (often funded by OTF Security Lab) and overlaps on user base with Subgraph's privacy/human-rights segment, though focused on mobile.

Regional players

• Kali Linux (Offensive Security): Penetration-testing distribution widely used by security researchers - one of Subgraph's targeted personas ("Security Researchers"). Not a direct OS competitor in the at-risk-user sense, but operates in an adjacent security-OS category.

Direct peers

• Cure53: Boutique penetration testing and security audit firm serving open source projects and privacy-focused tools. Comparable to Subgraph in size, methodology, and customer base (often the same human-rights-adjacent organizations).
• Whonix: Security-hardened OS built on the principle of isolation through two virtual machines (Gateway + Workstation) for anonymity. Direct alternative for high-risk-user use cases that overlap with Citadel's privacy/human-rights positioning.
• Trail of Bits: Security services firm offering penetration testing, security audits, and code review - directly overlapping Subgraph's professional services practice. Comparable expertise in low-level software security and use of audits as credibility.
• Qubes OS: Open-source security-focused operating system that uses compartmentalization (Xen-based lightweight VMs) to isolate workloads. The closest direct functional competitor to Citadel, sharing the same user base of high-risk individuals and similar partitioning architecture.
• Tails: Privacy-focused live operating system routed through Tor, designed for journalists, activists, and human-rights defenders - Subgraph's exact target users. Operates as open source with a similar nonprofit/grant-funded ecosystem.

Emerging players

• OpenBSD: Security-focused BSD-derived operating system emphasizing proactive security, code auditing, and integrated cryptography. Shares the high-assurance OS philosophy and similar technical credibility, though without a focused commercial layer.
• Purism: Maker of Librem OS/PureOS and security-focused hardware; sells privacy-respecting laptops and phones to overlapping customers (journalists, activists, security-conscious professionals). Broader consumer-product scope but competes in the same threat-model-driven segment.

Broad incumbents

• NCC Group: Global cybersecurity services firm providing penetration testing, security audits, and assurance services at much larger scale. Comparable service offerings but a broad incumbent rather than a privacy/security-OS specialist.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/subgraph
• LinkedInlinkedin.com/company/subgraph

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Subgraph