Manufacturing
Connected machines, OT networks and products with digital elements. NIS2 and the Cyber Resilience Act both apply, and one expired device certificate can stop a production line.
Most relevant
Secure everything your software depends on.
Trustefi inspects open source packages, guards certificates and secrets, and builds the security foundations that NIS2 and the Cyber Resilience Act expect.
Built for the ecosystems, platforms and standards you already use
PythonnpmMavenNuGetGoRustRubyGemsDockerKubernetesNIS2Cyber Resilience ActHelmTerraformGitHubGitLabLinuxAzureAWSGoogle CloudEU AI ActISO/IEC 27001PythonnpmMavenNuGetGoRustRubyGemsDockerKubernetesNIS2Cyber Resilience ActHelmTerraformGitHubGitLabLinuxAzureAWSGoogle CloudEU AI ActISO/IEC 27001
Modern software is built from thousands of parts made by others. Every package, certificate and secret is a promise of trust. We make sure those promises hold, quietly and automatically.
Where trust breaks today
Most incidents don't start with a clever attack on your own code. They start with something you already trusted.
Poisoned packages
Attackers publish look-alike or hijacked packages to public registries, waiting for one mistyped install.
Expired and leaked keys
A forgotten certificate stops a production line. A secret left in code opens a door to your cloud.
Unchecked AI use
Teams paste sensitive data into AI tools and connect agents to systems without guardrails.
New regulation
NIS2 and the Cyber Resilience Act turn security from good practice into a legal duty with real penalties.
Two products. Two services. One standard of trust.
Products that guard your software supply chain around the clock, and services that build the foundations under it.
A secure gateway for open source. Every package from every ecosystem inspected before it enters your code.
Learn moreFind, watch and renew every certificate, key and secret before it expires or leaks.
Learn moreNIS2 and Cyber Resilience Act foundations, implemented on your systems and documented for auditors.
Learn moreAdopt AI safely, with risk reviews, guardrails, private deployments and EU AI Act readiness.
Learn moreMalicious packages reach public registries every day.
Trustefi Customs stops them at the border.
Point your package managers at Customs. Everything is inspected before it reaches your developers or your builds.
Inspector
AI inspection catches malicious, typosquatted and vulnerable packages before they are installed.
Night Watch
Fixes prepared overnight, waiting for your approval in the morning.
Manifest
A software bill of materials for every build, ready for the Cyber Resilience Act.
Designed to sit quietly in your stack
Trustefi checks what enters your environment before your developers, scanners or auditors ever see it.
The regulatory clock is running
European rules now make supply chain security, incident reporting and documented controls mandatory for many companies.
17 Oct 2024
NIS2 national laws due across the EU
In effect10 Dec 2024
Cyber Resilience Act enters into force
In effect11 Sep 2026
CRA reporting of exploited vulnerabilities begins
In effect11 Dec 2027
CRA applies in full, including CE marking
UpcomingFind, watch and renew every certificate, key and secret before it expires or leaks.
NIS2 and Cyber Resilience Act foundations, implemented on your systems and documented for auditors.
Built for the industries that keep Europe running
Every sector depends on software, certificates and suppliers it does not fully control. Trustefi adapts to the risks and regulations that matter in yours.
Software and SaaS
Teams that ship every day on open source and cloud. Supply chain attacks and leaked secrets are the risks that matter most, and customers ask for proof.
Most relevantEnergy and utilities
Critical infrastructure under NIS2, with long-lived OT systems where uptime and certificate health cannot fail.
Most relevantFinance and fintech
Regulated teams that must show control over third-party code, keys and AI use to supervisors and customers, under rules such as DORA and NIS2.
Most relevantHow Trustefi works in practice.
Common situations our products and services are built for, from a mistyped package name to a new regulation.
Stopping a typosquatted package in CI
- Challenge
- A developer mistypes a package name, and a look-alike package with a hidden install script is pulled into the build.
- How Trustefi helps
- Customs inspects the package before install, recognises the imitation and stops it with a clear explanation.
- Outcome
- The malicious code never runs, and the developer gets the correct package name straight away.
Avoiding a certificate outage on the factory floor
- Challenge
- Device certificates used by machines and MQTT brokers expire without anyone noticing.
- How Trustefi helps
- Strongroom discovers every certificate in the OT network and alerts the right owner well before expiry.
- Outcome
- Renewals become planned work instead of emergency downtime.
Rolling out an AI assistant safely
- Challenge
- Employees already use public AI tools with customer data, and management wants a sanctioned alternative.
- How Trustefi helps
- Citadel reviews the risks, agrees policy with management and deploys a private assistant with guardrails.
- Outcome
- Teams use AI openly, and sensitive data stays inside the organisation.
Getting ready for NIS2
- Challenge
- A mid-sized company learns it is in scope of NIS2 but does not know where to start.
- How Trustefi helps
- A Rampart Survey maps the gaps, and Rampart Build puts the missing controls in place together with the IT team.
- Outcome
- The company can show management, auditors and customers a documented security baseline.
Why Trustefi
Built in Europe
Developed in Sweden and designed to keep your data in Europe.
Built by engineers
Experience from security platforms in industry, banking and AI.
Honest scope
Clear deliverables and no promises we cannot keep.
Frequently asked questions
Do we need to change how our developers work?
No. Customs sits behind the package managers your teams already use, such as pip, npm and Maven. Developers install packages exactly as before. The only change is a configuration line that points their tools at Customs instead of the public registry. If a package is stopped, they see a clear message explaining why and what to use instead.
Is our data kept in Europe?
Yes. Trustefi is built in Sweden and designed to keep customer data within the EU. For organisations with stricter requirements, parts of our products can run inside your own cloud tenant or on premises, so sensitive information never leaves your environment.
Can we start small?
Yes, and most organisations should. A typical start is one product for a single team, or a fixed-price review such as a Strongroom Audit or a Rampart Survey. You see concrete results within weeks and decide on the next step from there, without a long commitment up front.
How do your products and services work together?
The services build the foundations and the products keep them in place. A Rampart Survey might show that your software supply chain is a gap, and Customs then closes that gap every day. Citadel sets the rules for AI, and Strongroom watches the keys and secrets your AI integrations depend on. Each one also works on its own.
Who is Trustefi built for?
European companies that build or depend on software: manufacturers with connected products and factory networks, software and SaaS teams, energy and utility providers, and regulated finance and fintech companies. What they share is a need to prove that their systems can be trusted.
How does pricing work?
Products are subscriptions, priced by the number of developers or systems covered and the response plan you choose. Services such as Rampart and Citadel start with a fixed-price assessment, followed by a clearly scoped implementation. You always receive a written proposal before any work begins.
Start with trust you can see.
Tell us what you run. We usually reply within two working days.