Cryspen
Cryspen builds formal verification tools, most notably hax, that translate Rust code into multiple theorem provers so developers can produce machine-checked proofs of security and correctness for cryptographic protocols and security-critical systems.
- Company typePrivate
- Founded2021
- HeadquartersParis, France
- Headcount1–10
- GTM typeB2B
- OfferingSoftware
What Cryspen does
Cryspen is a Paris-based formal verification software company founded in December 2021 by Karthik Bhargavan, Franziskus Kiefer, and Jonathan Protzenko. The company builds tools that translate Rust source code into multiple formal proof backends (F*, Rocq/Coq, ProVerif, EasyCrypt, Lean) so that cryptographic implementations and security-critical protocols can be accompanied by machine-checked proofs of correctness, panic-freedom, and secret independence. Its two principal products are hax, an open-source verification framework, and Spectrum, a specification-driven development toolkit funded by a European Innovation Council Transition Grant that adds AI-assisted proof capabilities on top of hax.
The company's revenue mechanics blend non-dilutive grant funding (EIC Transition Grant for Spectrum), professional services engagements for bespoke protocol verification, and tooling/support around its open-source framework. Named enterprise engagements include formal verification of Signal's post-quantum ratchet protocols (PQXDH and SPQR), verification of Google's ML-KEM implementation at scale, and a partnership with SandboxAQ on a high-level cryptographic library. Cryspen also maintains active academic ties to Inria, Lean FRO, and the Beneficial AI Foundation, co-hosting workshops such as Software Verification in Lean 2026.
In 2026 Cryspen restructured around its tooling focus: it spun off CE Labs under Franziskus Kiefer to handle production cryptographic engineering, transitioned Bhargavan to CEO and Chief Scientist, and accepted the EIC Transition Grant to build Spectrum. The company operates with a team of approximately 6–10 people, has no disclosed revenue figures, and has not raised priced institutional equity; its recognition profile rests on peer-reviewed publications at CCS, USENIX Security, IEEE S&P, and CRYPTO, including the 2023 Internet Defense Prize and Distinguished Paper Award for the TreeSync paper.
Cryspen firmographics
Firmographics- Name
- Cryspen
- Legal name
- Cryspen Sarl
- Website
- https://cryspen.com
- Company type
- Private
- Founded year
- 2021
- Operating status
- Operating
- Headcount range
- 1–10 employees
- Short description
- Cryspen builds formal verification tools, most notably hax, that translate Rust code into multiple theorem provers so developers can produce machine-checked proofs of security and correctness for cryptographic protocols and security-critical systems.
- Ownership category
- akta.pro rank
Cryspen industry classification
Industry- Product category
- Formal Verification Software
- NAICS
- Software Publishers (5132), Custom Computer Programming Services (541511)
- SIC
- Services-Prepackaged Software (7372), Services-Computer Programming Services (7371)
- akta.pro primary industry
- Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC)
- akta.pro secondary industry
- Code & Repository Security (Git Security, Code Integrity) (HDADACAG)
Keywords
Where Cryspen is headquartered
LocationHeadquarters
- HQ city
- Paris
- HQ country
- France
- HQ region
- Europe
Offices1 record
Markets served
Cryspen business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations
Revenue model
- Enterprise Verification Services: Cryspen provides formal verification consulting services to enterprises needing high-assurance security-critical software. Custom engagements for protocol analysis, implementation verification, and security assessments.
- Tool Licensing and Support: Commercial access to verification tools, training, and ongoing support for organizations adopting formal verification practices.
- European Innovation Council Grant: Spectrum project funded by EIC Transition Grant for building specification and verification toolkit for developers.
Go-to-market motion2 records
Distribution channels3 records
Marketing channels6 records
Cryspen product offering
Product offeringCore offering
Cryspen builds and provides formal verification tools and consulting services focused on security-critical software. Its core product, hax, is an open-source framework that translates Rust code into formal verification languages (F*, Coq, ProVerif, Lean, EasyCrypt) so developers can prove security and correctness properties. Its second product, Spectrum, is a specification-driven toolkit (funded by an EIC Transition Grant) that combines specification engineering, formal verification, and AI-assisted proofs to deliver end-to-end guarantees for provably secure software from design to deployment. Cryspen also delivers enterprise verification services for cryptographic protocols and implementations.
Product overview
Cryspen is a formal verification software company that builds and offers a suite of tools for verifying security-critical software. The core products are: (1) hax - an open-source formal verification framework that translates Rust code to multiple theorem provers (F*, Rocq/Coq, ProVerif, EasyCrypt), and (2) Spectrum - an EIC-funded specification-driven toolkit for end-to-end secure software development. Cryspen also provides professional services for cryptographic protocol verification, including work with Signal on post-quantum protocols. The company collaborates with academic institutions to advance software verification research and hosts workshops on formal verification using tools like Lean.
Differentiator
Problem solved
Functional benefit
Brands
- Hax: An open-source formal verification framework that verifies Rust code using multiple provers including F*, Coq, ProVerif, and EasyCrypt.
- Spectrum
Products and services
- hax An open-source formal verification framework that translates a large subset of Rust code into formal verification languages (F*, Rocq/Coq, ProVerif, EasyCrypt) for security and correctness proofs. It targets Rust developers and security engineers who need machine-checked proofs of security properties for cryptographic implementations and security-critical systems.
- Spectrum A specification-driven high-assurance software development product that combines specification engineering, formal verification, and AI-assisted proofs to provide end-to-end security, compliance, and correctness guarantees from design through deployment. Funded by the European Innovation Council (EIC) Transition Grant and targeting developers of security-critical systems.
- Formal Verification Services for Cryptographic Protocols Formal analysis and verification services for cryptographic protocol design and implementation, including work on Signal's PQXDH and SPQR post-quantum protocols. Delivered to enterprise customers needing machine-checked security proofs of cryptographic systems.
Quantifiable outcome
- Formally verified Signal's post-quantum SPQR protocol from design through implementation with proofs integrated into CI
- +2 more outcomes
Companies that use Cryspen
Customer profileNamed customers3 records
Segments3 records
Ideal customer profiles2 records
Cryspen technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Feature5 records
Cryspen partnerships and signals
Strategic signalPartnerships
Eight partnerships are on record, tiered secondary and core.
- AeneasVerifsecondaryCollaboration on Signal Shot challenge to formally verify the Signal protocol using Aeneas verification tools. Cryspen contributes tools and expertise.
- Beneficial AI FoundationsecondaryCo-hosting Software Verification in Lean 2026 (SVIL 2026) workshop and hackathon in Paris, organized by Beneficial AI Foundation and Lean FRO.
- Lean FROsecondaryCo-hosting Software Verification in Lean 2026 (SVIL 2026) workshop and hackathon with Lean Foundation for Formal Reasoning.
- CE LabscoreCryspen spin-off under Franziskus Kiefer's leadership focused on Cryptographic Engineering. CE Labs builds high-assurance software using Cryspen's tools, while Cryspen uses CE Labs' production code to refine its verification suite. Ongoing close collaboration at intersection of formal verification and cryptography.
- SignalcoreCryspen collaborated with Signal from the beginning of the SPQR (Sparse Post-Quantum Ratchet) design process through implementation. Contributed formal analysis using ProVerif, provided post-quantum cryptography via libcrux ML-KEM implementation, and verified the SPQR implementation using hax and F* proof backend. Proofs are maintained in Signal's CI.
- GooglecorePartnership for verifying ML-KEM at scale. Cryspen's formally verified libcrux implementation of ML-KEM used by Google for post-quantum cryptography deployment.
- SandboxAQsecondaryPartnership for cryptographic verification. Cryspen applied hax verification tools to SandboxAQ's sandwich cryptographic library, improving usability for real-world projects.
- InriasecondaryAcademic collaboration with Charlie Jacomme at Inria for formal modeling and symbolic analysis of PQXDH protocol using ProVerif and CryptoVerif.
Scale indicators4 records
Recent moves2 records
Expansion highlights5 records
Cryspen competitors and assessment
Company assessmentDirect peers
- CertiK: Formal verification-led security firm focused on blockchain and smart contracts. Comparable in using formal methods as a differentiator for high-assurance software audits, though more blockchain-centric than Cryspen.
- Certora: Formal verification platform for smart contracts and protocols, combining a prover product with verification services. Comparable verification-as-a-product approach, with overlap on cryptographic protocol analysis.
- Runtime Verification: Formal verification company spun out of academic research; builds verification tools (e.g., for smart contracts and execution clients) and offers audit services. Closely comparable to Cryspen's research-to-product pipeline and verification services.
- Galois: US-based formal methods and high-assurance software company. Directly comparable: applies formal verification to security-critical systems for government and enterprise customers, similar services-led business model anchored in deep research talent.
- Trail of Bits: Security research and engineering firm that combines manual audits with formal methods and tools (e.g., Manticore, Echidna). Comparable consulting-plus-tooling model targeting security-critical software, with strong cryptographic expertise.
- Veridise: Formal verification company offering audits and tools (e.g., Picus, Aderyn) for smart contracts and security-critical code. Closely comparable in combining research-rooted verification tooling with paid audit services.
- Zellic: Security auditing firm leveraging formal methods for high-assurance code review, with strong cryptography practice. Comparable services model targeting the same security-critical customer profile as Cryspen.
- ChainSecurity (Halborn): Smart contract and protocol security firm using formal verification; now part of Halborn. Comparable in selling formal-verification-backed audits for security-critical protocol code.
Broad incumbents
- Microsoft Research (Formal Methods): Maintains formal methods projects (Dafny, Z3, Lean integration) and has historically invested in verified systems (e.g., Everest for TLS). Comparable in advancing formal verification of security-critical code, though as research infrastructure rather than a commercial services/product firm.
Emerging players
- Kudelski Security: Cybersecurity services arm of the Kudelski Group with an established formal methods / cryptography practice. Comparable in offering high-assurance cryptographic and security engineering services, though as part of a larger portfolio rather than a pure-play verification firm.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights5 records
Customer concentration
Cryspen social profiles
Digital presenceCryspen financial estimates
Financial estimateRevenue estimate
Valuation estimate
Cryspen leadership team
Management profileNumber of profiles
Profiles5 records
Cryspen subsidiaries and ownership
Company hierarchySubsidiaries1 record
Cryspen funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Cryspen M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Cryspen
What does Cryspen do?
Cryspen builds and provides formal verification tools and consulting services focused on security-critical software. Its core product, hax, is an open-source framework that translates Rust code into formal verification languages (F*, Coq, ProVerif, Lean, EasyCrypt) so developers can prove security and correctness properties. Its second product, Spectrum, is a specification-driven toolkit (funded by an EIC Transition Grant) that combines specification engineering, formal verification, and AI-assisted proofs to deliver end-to-end guarantees for provably secure software from design to deployment. Cryspen also delivers enterprise verification services for cryptographic protocols and implementations.
Is Cryspen a public or private company?
Cryspen is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was Cryspen founded?
Cryspen was founded in 2021. It employs 1 to 10 people.
Where is Cryspen based?
Cryspen is headquartered in Paris, France, in the Europe region.
How does Cryspen make money?
Three revenue lines are on record. Enterprise Verification Services are the primary driver. The others are tool Licensing and Support and european Innovation Council Grant.
Who are Cryspen's main competitors?
Direct peers on record are CertiK, Certora, Runtime Verification, Galois, Trail of Bits, Veridise, Zellic and ChainSecurity (Halborn). Microsoft Research (Formal Methods) is listed as a broad incumbent. Kudelski Security is listed as an emerging player.
Does Cryspen have an API?
No public API is recorded for Cryspen.
What industry is Cryspen in?
Cryspen's product category is Formal Verification Software. Its primary akta.pro industry code is HDADACAC, Application Security Testing (SAST/DAST/IAST/SCA), with a secondary code of HDADACAG, Code & Repository Security (Git Security, Code Integrity). Its NAICS code is 5132 and its SIC code is 7372.