Protocol Labs

United States · protocol.ai · 15 vendors

Protocol Labs is an open-source software research and development company that builds internet protocols and tools to advance computing. It is best known for creating the InterPlanetary File System (IPFS), a peer-to-peer decentralized web protocol, and Filecoin, a decentralized file storage network. The company aims to improve the internet and push humanity forward through breakthroughs in various technological fields.

Resilience scores

Technology vendors

Services catalogue

4 services in catalogue across 2 categories; runs on 15 sub-vendors.

Insights

Last updated 2026-08-16 · revision 2

15 direct vendors, 214 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Protocol Labs exhibits high migration readiness, largely driven by its highly modern and cloud-native oriented internal tech stack. The extensive use of technologies like Docker, Kubernetes, AWS, Go, and Rust provides a flexible and portable foundation for migrating to new environments or platforms. A significant strength is the reported 'Total Vendors: 0', which implies minimal formal vendor lock-in, greatly simplifying potential migration efforts by reducing contractual complexities and dependencies on proprietary systems. The company's focus on open-source and decentralized technologies further contributes to this flexibility. However, certain aspects remain unknown: there is no data on specific regulatory environments or data residency requirements, which could introduce complexities during migration. Similarly, financial stability data is absent, making it difficult to assess the capacity to fund large-scale migration projects. While the internal tech stack is robust, the unique, highly distributed, and peer-to-peer architecture of their core products (IPFS, Filecoin) might present specialized migration challenges requiring tailored strategies and expertise.

Compliance

7 in-scope frameworks identified; showing 3.

NIS2 (source) — Assessment Required

Protocol Labs is a US-headquartered company (incorporated in Delaware) and primarily operates as an innovation network and R&D organization. NIS2 applies to entities providing services within the EU that fall under Essential or Important Entity categories. Protocol Labs' core activities — funding research, connecting startups, and developing open-source protocols (IPFS, Filecoin, libp2p) — do not straightforwardly map to NIS2's listed sectors (energy, transport, banking, health, digital infrastructure operators, etc.). However, some of its portfolio companies or network members may operate digital infrastructure (e.g., Filecoin is a decentralized storage network that could be considered digital infrastructure). Protocol Labs itself does not appear to directly operate critical infrastructure in the EU. Risk is Low for the parent entity but an assessment is required to determine if any EU-based subsidiaries or network entities fall under NIS2 scope.

Evidence: https://pl.xyz/, https://pl.xyz/legal/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555

GDPR (source) — Partially Compliant

Protocol Labs, Inc. is a US-headquartered company but explicitly acknowledges GDPR and UK GDPR applicability in its published Privacy Policy (last updated July 21, 2026). The company processes personal data of EU/EEA residents via its website (IP addresses, browser data, usage data via Google Analytics), and its global innovation network of 750+ teams and 3,000+ active contributors likely includes EU-based individuals. The company has identified legal bases for processing (consent for analytics cookies, legitimate interest for security), which is a positive indicator. However, the privacy policy is relatively minimal, there is no publicly disclosed Data Protection Officer (DPO), no evidence of a Records of Processing Activities (RoPA), no Standard Contractual Clauses (SCCs) documentation, and no formal GDPR audit or certification. The use of Google Analytics (a US-based third-party processor) without explicit mention of transfer mechanisms raises a medium-level risk. Enforcement risk is moderate given the company's size and the fact that it does not appear to be a large-scale data processor.

Evidence: https://pl.xyz/legal/#privacy-policy, https://pl.xyz/legal/, https://pl.xyz/

CPRA — Assessment Required

Protocol Labs, Inc. is incorporated in Delaware and governed by Delaware law per its Terms & Conditions, but as a US technology company with a global user base, it likely has California-based users, contributors, and employees. CCPA/CPRA applies to for-profit businesses that meet one of three thresholds: (1) annual gross revenue over $25M; (2) buy/sell/share personal information of 100,000+ consumers/households annually; or (3) derive 50%+ of annual revenue from selling personal information. Given Protocol Labs' scale (750+ network teams, 3,000+ contributors, $40B combined network valuation), it is plausible that one or more thresholds are met. The Privacy Policy does not include CCPA-specific disclosures (e.g., 'Do Not Sell My Personal Information' link, California-specific rights), which is a compliance gap if CCPA applies.

Evidence: https://pl.xyz/legal/#privacy-policy, https://pl.xyz/legal/

Financials

Three-year financials

Financial Resilience Score: 5/10

Protocol Labs is a private, US-based crypto-native R&D organization that does not publish audited financial statements. Its financial resilience is anchored by a large treasury built from the 2017 Filecoin ICO (~$257M raised), plus ongoing FIL token vesting from the Filecoin network genesis. This provided years of operating runway without needing traditional equity rounds. The organization has diversified across IPFS, Filecoin, libp2p, and dozens of spinouts, and operates a fully distributed remote-first model that keeps fixed costs low. However, resilience is significantly constrained by heavy exposure to crypto-market cycles. The FIL token fell from ~$237 in April 2021 to below $3 during 2023-2024, and the February 2023 layoffs (~89 employees, ~21% of the workforce) confirmed material cash-burn pressure during the crypto downturn. The lack of traditional recurring revenue, combined with regulatory uncertainty around token issuers post-2017 ICO era, further limits visibility. The pivot to an 'Innovation Network' model with PL Capital and expansion into AI, robotics, and neurotech diversifies exposure but also spreads execution focus. Overall, resilience is moderate: significant treasury cushion but high volatility exposure and no transparent operating profitability.

Key strengths: Large treasury from 2017 Filecoin ICO (~$257M raised), Ongoing FIL token allocations from Filecoin network genesis vesting, Diversified ecosystem across IPFS, Filecoin, libp2p, and spinouts, Fully distributed remote-first operating model with low fixed costs, Strong brand and talent gravity in Web3 R&D, Portfolio approach via PL Capital venture arm

Risk factors: Heavy concentration in crypto-market cycles and FIL token price volatility, February 2023 layoffs of ~89 employees (~21% of workforce) confirmed cash-burn pressure, No operating revenue transparency or recurring revenue model, Regulatory risk from SEC scrutiny of token issuers post-2017 ICO era, Governance/execution risk from spreading focus across Web3, AI, robotics, and neurotech, Talent attrition to spinouts reduces direct operational leverage

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report