Privacy-First Apps

End any week, with one message. No notice period, no exit interview, no fine print. We invoice weekly, so the most you’re ever committed to is the current week.

It’s in your contract: tell us, and we refund that week. No questions, no invoices to dispute, no calls to escalate. The only rule: refunds apply to the most recent week.

Because hours are the wrong metric. If we’re optimizing for hours billed, we’re not optimizing for your outcome. The deal is simpler: every week, we earn the next one. If we don’t, you don’t pay. We’re free to spend zero hours or sixty. What matters is whether you’re blown away.

We work with operators, not lottery winners. If a request would require breaking physics, the law, or a third party’s systems, we say so, and if we can’t align, we walk. The guarantee is mutual: you can fire us any week; we can also fire ourselves.

When the privacy guarantee or the off-chain compute verification is genuinely load-bearing for the product. Voting systems, private identity, scalable rollups, and certain compliance flows are clear wins. For most ‘add ZK to it’ pitches, the honest answer is ‘a database with auth is sufficient and 100× cheaper.’ We’ll say so.

We size the proving infrastructure as part of the architecture phase, not after launch. Off-chain proving with on-chain verification (the standard pattern) typically runs in milliseconds-to-seconds for well-designed circuits. We benchmark on real hardware before committing, and we’ll tell you when the proving cost makes the use case uneconomic.

Often yes. ZK doesn’t have to be the whole app. It can be a verifier contract or a single proof-generation flow inside a conventional stack. We’ve integrated ZK identity verification, private balance checks, and proof-of-membership into otherwise normal web apps. The hard part is usually UX, not cryptography.

Groth16 for small, fixed circuits with the lowest verification gas (good for Ethereum mainnet). PLONK or Halo2 for general-purpose circuits where you want a universal trusted setup, or none at all. STARKs (Cairo, RISC Zero, Boojum) when you want post-quantum security or a transparent setup. Noir or Circom for circuit authoring depending on team familiarity. We pick by what verifies cheapest on your target chain and what your developers can audit, not by what’s loudest on Twitter.

A privacy-flow addition to an existing dApp (one circuit + verifier contract): €25-50k. A standalone ZK identity or membership product: €50-120k. A ZK rollup or app-specific chain: €200k+ and 6-12 months, with audit being a non-negligible slice. Audit costs for ZK circuits run higher than for plain Solidity (€30-80k for non-trivial circuits) because the surface area is mathematical, not just code. We quote the audit budget alongside the build budget so it doesn’t surprise you later.