Bring us your hard security problem.
Pragmable is a cybersecurity software house. We build bespoke security tooling for regulated operators — heavy tech, compiler-grade engineering, sovereign infrastructure. Three engagement modes, from a six-week co-design sprint to a multi-year build & operate contract.
If one of these sounds like you.
Your environment is too specific for off-the-shelf.
Custom IAM models, internal RBAC tiers, multi-cloud + on-prem permission graphs that no SaaS vendor will faithfully evaluate. We meet the model where it lives.
A regulator gave you a deadline.
NIS2, DORA, CRA, sector-specific mandates. You need a defensible, signed, traceable answer — not a dashboard screenshot. We ship deliverables your auditors can read.
Your data cannot leave your perimeter.
Air-gapped, on-prem, SecNumCloud, HDS — environments where calling a US-hosted API is not an option. We package, sign, and deliver software that runs offline.
The internal team needs heavy-tech engineers, briefly.
Compiler design, formal methods, applied crypto, distributed systems — skills you need for one project, not one decade. We embed, ship, and hand off.
What we build with.
→ stack-by-stack on requestCustom policy evaluators at the source.
Six-layer chain evaluators, ABAC graph systems, policy-as-code compilers, condition-key coverage — bespoke when off-the-shelf can't cover your model.
IAM graph & behavioral pipelines.
Continuous re-evaluation, blast-radius simulators, deviation detectors — built on streaming infra that scales to millions of principals.
On-prem & SecNumCloud distributions.
Air-gapped builds, SecNumCloud-ready packaging, HDS-compatible deployments. Ship security tooling to environments that cannot phone home.
Provable policy correctness.
SMT-backed policy verification, model-checked authorization rules, machine-checked invariants. For environments where "we tested it" isn't a defense.
Domain-specific query languages.
RQL was our first. We've designed and shipped three more for clients — compliance DSLs, audit query languages, configuration grammars. Compiler-grade tooling.
Three ways to work with us.
→ we'll recommend the right one in the first callAcross all three modes: we own the build's security, quality, and fix lifecycle ourselves. No offshore patches. No third-party hand-offs. Residency follows the workload — EU, US, on-prem, or sovereign-cloud / SecNumCloud-ready.
Scope & specify.
- Threat-model workshop, two sessions
- Architecture RFC + acceptance criteria
- Buy-vs-build analysis
- Implementation roadmap with effort bands
Build & deliver.
- Dedicated 2–4 engineer team
- Weekly written progress reports
- Source code + reproducible build
- Security & bug-fix lifecycle owned by us
Build & run it.
- Production SLA with named on-call
- Quarterly review & roadmap
- Residency: EU, US, on-prem (your choice)
- Sovereign-cloud / SecNumCloud-ready packaging
The process, end-to-end.
→ ~2 weeks from intake to signed scopeTell us your hard problem.
One paragraph is enough for the first reply. We respond within 48 hours, every time. If we can't take it on, we'll tell you who could.
▸ NDAs supported · we sign yours, or use ours
▸ All correspondence reaches both founders
▸ Residency follows the workload — EU, US, on-prem
build[at]pragmable[dot]com
One paragraph is enough for the first reply: the problem, the regulator (if any), the constraint that makes off-the-shelf insufficient. Your email reaches both founders.
build[at]pragmable[dot]com