Least Authority

What Least Authority does

Least Authority is a privately held privacy-enhancing technology company founded in 2011 by Zooko Wilcox-O'Hearn and headquartered in Berlin, Germany (Least Authority TFA GmbH), with a regional subsidiary in Singapore (Least Authority Pte. Ltd.). The firm operates as a remote-first boutique with 11–50 employees spanning up to 19 time zones, delivering two distinct but technologically linked lines of business: professional security consulting services and a portfolio of privacy-by-design consumer and enterprise products.

The consulting practice is the primary commercial engine, having completed more than 200 security audits over 9 years (with 52 completed in 2023 alone) for marquee Web3 and technology clients including Polygon, World/Tools for Humanity, Ethereum Foundation, MetaMask, Tezos, Protocol Labs, Stacks, Mina Protocol, Aleo, Loopring, and Mozilla. Audits cover cryptographic protocols, zero-knowledge proof implementations, distributed systems, and smart contracts, reflecting the firm's deep specialization in zero-knowledge cryptography inherited from Zcash-era roots.

The product portfolio is built on three core technology pillars — Tahoe-LAFS distributed storage, the proprietary ZKAPs (Zero-Knowledge Access Passes) anonymous payment protocol based on Privacy Pass, and the Magic Wormhole identity-less file transfer protocol — and includes PrivateStorage (end-to-end encrypted cloud storage), Winden and Destiny (free encrypted file transfer apps), Gridsync (Tahoe-LAFS GUI), HRO Cloud (hosted storage for human rights organizations), and the MoonMath Manual educational resource (8,000+ downloads). Revenue mechanics mix project-based consulting fees, PrivateStorage subscription payments via anonymous ZKAP tokens, and grant funding from organizations such as the Open Technology Fund and EU NGI programs, with no disclosed external venture or private equity investment.

Name

Least Authority

Legal name

Least Authority TFA GmbH

Website

https://leastauthority.com

Company type

Private

Founded year

2011

Operating status

Operating

Headcount range

11–50 employees

Short description

Least Authority is a Berlin-based, founder-controlled privacy and cryptography boutique delivering security audits for Web3 protocols alongside privacy-by-design products (PrivateStorage, ZKAPs, Winden, Destiny) and grant-funded open-source work. It serves blockchain foundations, enterprise tech firms, and human rights organizations.

Ownership category

akta.pro rank

Product category

Cybersecurity Consulting

akta.pro industry

PRIMARYFSAPAJAA

Smart Contract Auditing & Formal Verification

Financial & Insurance/Blockchain & Web3/Security, Compliance & Risk (auditing, monitoring, analytics, AML/KYC)

SECONDARYFSAPAHAL

Governance Security & Attack Mitigation (monitoring, safeguards, timelocks)

Financial & Insurance/Blockchain & Web3/DAO & Governance Platforms (voting, treasury, coordination tools)

SECONDARYFSAPACAJ

Authorization & Permissions (delegation, allowances, capability-based access, session keys)

Financial & Insurance/Blockchain & Web3/Wallets, Identity & Access (custody/non-custody, DID, key management)

SECONDARYHDADAFAH

Privacy Management (Consent, DSAR, RoPA)

Hardware, Technology & Telecom/Cybersecurity/Data Security & Privacy (DLP, Encryption, Key Mgmt)

SECONDARYFSAPABAI

Smart Contract Security Tooling (static/dynamic analysis, formal verification)

Financial & Insurance/Blockchain & Web3/Smart Contract Platforms & Developer Tooling (SDKs, APIs, indexing, oracles)

Keywords

• Cryptographic security audits
• Privacy enhancing technology
• End-to-end encryption
• Zero knowledge proofs
• Blockchain security consulting

Headquarters

HQ city

Berlin

HQ country

Germany

HQ region

Europe

Offices2 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Security Consulting Services: Comprehensive security auditing and consulting services for cryptographic protocols, distributed systems, and Web3/blockchain projects. Revenue generated through project-based consulting engagements.
2. PrivateStorage Subscription: Subscription-based secure cloud storage service with anonymous ZKAP tokens. Users purchase storage-time tokens without revealing identity or linking payment to usage.
3. Open Source / Grant Projects: Development work funded by grants from organizations like Open Technology Fund, EU's NGI programs for privacy-enhancing technology projects.

Pricing tiers

Go-to-market motion4 records

Distribution channels6 records

Marketing channels7 records

Core offering

Least Authority provides expert security consulting services for cryptographic protocols and distributed systems, conducting audits from design through production phases for Web3, blockchain, and enterprise technology clients. The company also develops and operates privacy-enhancing products including PrivateStorage (end-to-end encrypted file synchronization with ZKAPs anonymous payments), Winden and Destiny (secure file transfer apps), and HRO Cloud (secure storage for human rights organizations), all built on the Principle of Least Authority (POLA) philosophy.

Product overview

Least Authority operates as a privacy-focused technology company offering both security consulting services and a portfolio of privacy-enhancing products. Their product suite centers on PrivateStorage (end-to-end encrypted file storage with ZKAPs anonymous payments), Winden and Destiny (secure file transfer applications built on Magic Wormhole protocol), and Gridsync (Tahoe-LAFS GUI). The company also provides the HRO Cloud hosting service for human rights organizations and publishes the MoonMath Manual educational resource on zero-knowledge proofs. Their security consulting practice offers audits of cryptographic protocols and distributed systems. These products share core technologies including Tahoe-LAFS distributed storage, zero-knowledge proofs (ZKAPs), and the magic-wormhole protocol for identity-less file transfer.

Differentiator

Problem solved

Functional benefit

Brands

• PrivateStorage: Privacy-preserving, end-to-end encrypted file synchronization service that minimizes data collection and uses ZKAPs for anonymous payments.
• Winden
• ZKAPs
• Destiny
• HRO Cloud
• MoonMath Manual
• Magic Wormhole / MW4ALL
• Gridsync

Products and services

• Security Consulting Services Comprehensive security consulting including audits and reviews of cryptographic protocols and distributed system architectures for Web3, blockchain, and enterprise technology clients. Engagements cover design to production phases, covering zero-knowledge proof implementation verification, smart contract audits, and security design reviews.
• PrivateStorage Privacy-preserving, end-to-end encrypted file synchronization and storage service based on Tahoe-LAFS that minimizes data collection about users and enables anonymous payments via ZKAPs (Zero-Knowledge Access Passes) tokens.
• ZKAPs (Zero-Knowledge Access Passes) Anonymous tokens that can be redeemed to access a service without revealing user identity or activity, based on the Privacy Pass protocol. ZKAPs disconnect payment data from service usage data, enabling anonymous payments without behavioral tracking.
• Winden Free-to-use web application for end-to-end encrypted file transfer, built on the Magic Wormhole protocol enabling identity-less transport for secure file transfer without requiring Public Key Infrastructure.
• Destiny Free end-to-end encrypted desktop application for file transfer without revealing user identity, built on the Magic Wormhole protocol. Available for Mac, Windows, Linux, iOS, and iPadOS.
• HRO Cloud Secure cloud storage service offered to human rights organizations, providing hosted Tahoe-LAFS, Magic Folder, ZKAPs, and Gridsync infrastructure for organizations unable to host their own servers.

Quantifiable outcome

• Completed over 200 security audits in 9 years
• +3 more outcomes

Named customers14 records

Segments4 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration3 records

Feature8 records

Partnerships

Ten partnerships are on record, tiered core and minor.

• Bluebik Titans Company Limited (BBIK)coreStrategic or Co-development PartnerPartnership established to support Bluebik Titans' new smart contract audit service to engage with clients in the Asian market. Bluebik is a leading consultancy on end-to-end digital transformation based in Thailand.
• BugcrowdcoreTechnology or IntegrationOfficial alliance with Bugcrowd security research community for managed crowdsourced security services, expanding the company's security testing capabilities beyond traditional audits.
• Blockchain Bundesverband (Bundesblock)minorOthersMember of the German Blockchain Federal Association (Bundesblock), engaging with blockchain industry standards and community in Germany.
• Blockchain Security AllianceminorOthersMember of SUSS NiFT Blockchain Security Alliance, contributing to blockchain security standards and community.
• German AcceleratorcoreOthersCompleted German Accelerator Southeast Asia Market Access Program Class of 2023, receiving mentorship and networking support for Asian market expansion from experienced regional professionals.
• Open Technology Fund (OTF)coreStrategic or Co-development PartnerFunded development of Tahoe-LAFS improvements for human rights organizations. OTF provides grants supporting privacy and internet freedom technologies.
• Tahoe-LAFS ProjectcoreTechnology or IntegrationLong-standing contributors to the Tahoe-LAFS open-source decentralized cloud storage project. The technology forms the foundation of PrivateStorage and represents core expertise in distributed systems.
• EU Next Generation Internet (NGI) TrustcoreStrategic or Co-development PartnerFunded Magic Wormhole for All (MW4ALL) project phases under EU's NGI Trust program, supporting development of identity-less secure file transfers.
• NGI TETRAminorStrategic or Co-development PartnerOrganized NGI Bootcamp where Least Authority's MW4ALL project won best performance award, providing business scale-up support.
• CastlebridgecoreStrategic or Co-development PartnerCollaboration on Privacy Reviews combining Least Authority's security expertise with Castlebridge's strategic data services to provide holistic privacy assessments bridging technical, regulatory, and societal impacts.

Scale indicators7 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• OpenZeppelin: Premier Ethereum smart contract security and audit firm. Direct competitor for security consulting engagements on Ethereum-based protocols; also offers developer tooling and security libraries that compete with parts of Least Authority's portfolio.
• Trail of Bits: Leading blockchain and cryptographic security audit firm. Direct competitor to Least Authority in Web3 security consulting, with overlapping service offerings (smart contract audits, cryptographic protocol reviews) and a similar focus on rigorous technical audits.
• ConsenSys Diligence: Ethereum-focused smart contract auditing service within ConsenSys. Direct competitor in Web3 security audits, especially for Ethereum-based DeFi and infrastructure projects.
• Sigma Prime: Blockchain security firm specializing in Ethereum 2.0/Consensus Layer audits and Lighthouse client security. Direct competitor in cryptographic protocol audits with comparable focus on consensus and cryptographic systems.
• CertiK: Large, well-capitalized Web3 security firm offering smart contract audits and formal verification. Direct competitor for blockchain security audits; scale and funding differentiate it from Least Authority's leaner model.
• ChainSecurity: Smart contract security audit firm with strong academic roots and focus on formal verification. Direct competitor for blockchain security audits, especially for DeFi and consensus protocols.
• Cure53: Berlin-based security consultancy with deep expertise in web application, browser, and cryptographic security audits. Geographic and service overlap with Least Authority, including work on privacy and encryption systems.

Emerging players

• Zellic: Security research firm focused on cryptography and smart contract audits, including ZK circuits and rollups. Emerging competitor with overlapping focus on cryptographic and ZK protocol audits, attracting many of the same Web3 clients.
• Runtime Verification: Formal verification and security audit firm with expertise in smart contracts, consensus protocols, and zero-knowledge proofs. Comparable in their emphasis on mathematical rigor and ZK cryptography.

Broad incumbents

• NCC Group (Cryptography Services): Global cybersecurity firm with a dedicated cryptography services practice. Broader incumbent offering cryptographic reviews and security consulting to enterprise clients, with overlap to Least Authority's cryptographic protocol audit work.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/LeastAuthority
• GitHubgithub.com/LeastAuthority
• YouTubeyoutube.com/channel/UCemZol-P7c9_WxewG0S9j5Q
• LinkedInlinkedin.com/company/leastauthority

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Subsidiaries1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Least Authority