CryptoEng UG (haftungsbeschränkt) Due Diligence

Run due diligence on CryptoEng UG (haftungsbeschränkt): check compliance and get alerts when suppliers or ownership change.

Germany · owned by Independent (Germany) · celabs.eu · 7 vendors

CE Labs (trading name of CryptoEng UG) is a high-assurance security engineering company specialising in applied cryptography, protocol design, and formal verification. Founded as a spin-off from Cryspen, the company partners with organisations building software where security failures are unacceptable, offering services from threat modelling and protocol analysis to machine-checked correctness proofs. It also maintains open-source cryptographic libraries including post-quantum and classical primitive implementations.

Resilience scores

Technology vendors

Insights

Last updated 2026-10-15 · revision 8

7 direct vendors, 100 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

9 in-scope frameworks identified; showing 3.

GDPR (source) — No public evidence

The company is established in Germany, within the EU, and therefore subject to the General Data Protection Regulation regarding the processing of personal data of employees, customers, and suppliers.

BSI Technical Guidelines — No public evidence

The German Federal Office for Information Security (BSI) issues Technical Guidelines (TRs) that specify security standards. Companies in regulated sectors or those supplying the German government are often required to comply with specific TRs.

ISO 27001 (source) — No public evidence

ISO 27001 is a globally recognized standard for information security management. Certification is often expected by customers in the cybersecurity industry to provide assurance about a company's security posture.

Financials

Three-year financials

Financial Resilience Score: 4/10

CryptoEng UG is a four-person Berlin-based deep-tech micro-enterprise in applied/post-quantum cryptography with highly specialised, hard-to-replicate technical capability led by an ex-Mozilla/Fraunhofer/Wire cryptographer. The company benefits from non-dilutive public R&D funding via Germany's ZIM innovation programme and a strategic affiliation with parent/sister company Cryspen, providing potential pipeline and shared IP (notably the open-source libcrux library). Secular tailwinds from post-quantum cryptography migration (NIST ML-KEM, ML-DSA standards) support multi-year demand. However, the company has an extremely thin capital base of only €500 nominal share capital, making it structurally dependent on project cash flow and grants. Key-person concentration is severe with a single managing director and only four engineers; loss of the founder would be material. Single-shareholder ownership means no external VC/strategic diversification. As a micro UG, financial statements are at best deposited (not published) and unaudited, making third-party due diligence difficult. The service-based consulting model typically creates revenue concentration risk with few large contracts.

Key strengths: Highly specialised post-quantum cryptography niche with few credible European competitors, Credible founder pedigree (ex-Mozilla, Fraunhofer AISEC, Wire), Non-dilutive ZIM public R&D funding from German government, Cryspen spin-off model providing shared IP and referral pipeline, Secular demand tailwind from NIST PQC standards migration, Named partner Crypto Quantique (UK) for libcrux-iot commercial launch

Risk factors: Extremely thin capital base of only €500 nominal share capital, Key-person concentration with single managing director and only 4 engineers, Single-shareholder structure with no external VC diversification, Service-based revenue likely concentrated in few large contracts, No audit requirement and minimal public financial transparency, UG profit retention rule (25% of net profit) constrains distributions until €25,000 equity reached

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report