Solutions

Products

Pricing

Resources

Github

SOLUTIONS

Research

Meet Stoffel

Your private by design teammate

Build privacy-first products your users can trust from the start

Get Started Now

Talk to the team

stoffel quickstart

$ stoffel init my-app --template rust
✓ created my-app

$ stoffel compile src/main.stfl -o build/main.stflb
✓ private computation compiled

$ stoffel run build/main.stflb --input amount=42
✓ result opened: 42

Build fast. Keep privacy in the stack

While you ship, Stoffel keeps the sensitive part inside the computation boundary

Usual stack

1

Encrypt data at rest on the device

2

Encrypt it in transit to your server.

3

Decrypt to run app logic.(Sensitive data is back in your stack)

4

Your app becomes the place users have to trust.

Stoffel stack

1

Encrypt data at rest on the device

2

Encrypt it in transit to your server.

3

Compute over shares.(Your logic runs across private shares)

4

Less sensitive user data sitting in your app.

Give your product clear privacy boundaries

Turn sensitive user context into shares. Open only the output your product needs

Get Started Now

Inside the stack

Privacy built into the architecture — not bolted on after review

def random_bit() -> secret bool:
  while True:
    var r = Share.random_field()
    var r_squared = Share.open_field(Share.mul(r, r))

    if Field.is_zero(r_squared):
      continue

    var r_prime = Field.sqrt(r_squared)              # canonical root in (0, p/2)
    var r_prime_inv = Field.inverse(r_prime)         # r'^-1
    var two_inv = Field.inverse(Field.from_int(2))   # 2^-1

    var c = Share.mul_field(r, r_prime_inv)          # [c] = r'^-1 [r] in {-1, +1}
    var a = Share.mul_field(Share.add_field(c, Field.one()), two_inv)
    # `a` holds 0 or 1; retag the wide field share as a 1-bit `secret bool`.
    return Share.retag(a, 1)

Define the Logic

Define allowed outputs using Stoffel-Lang (match scores, aggregations, eligibility signals)

def random_bit() -> secret bool:
  while True:
    var r = Share.random_field()
    var r_squared = Share.open_field(Share.mul(r, r))

    if Field.is_zero(r_squared):
      continue

    var r_prime = Field.sqrt(r_squared)              # canonical root in (0, p/2)
    var r_prime_inv = Field.inverse(r_prime)         # r'^-1
    var two_inv = Field.inverse(Field.from_int(2))   # 2^-1

    var c = Share.mul_field(r, r_prime_inv)          # [c] = r'^-1 [r] in {-1, +1}
    var a = Share.mul_field(Share.add_field(c, Field.one()), two_inv)
    # `a` holds 0 or 1; retag the wide field share as a 1-bit `secret bool`.
    return Share.retag(a, 1)

Define the Logic

Define allowed outputs using Stoffel-Lang (match scores, aggregations, eligibility signals)

def random_bit() -> secret bool:
  while True:
    var r = Share.random_field()
    var r_squared = Share.open_field(Share.mul(r, r))

    if Field.is_zero(r_squared):
      continue

    var r_prime = Field.sqrt(r_squared)              # canonical root in (0, p/2)
    var r_prime_inv = Field.inverse(r_prime)         # r'^-1
    var two_inv = Field.inverse(Field.from_int(2))   # 2^-1

    var c = Share.mul_field(r, r_prime_inv)          # [c] = r'^-1 [r] in {-1, +1}
    var a = Share.mul_field(Share.add_field(c, Field.one()), two_inv)
    # `a` holds 0 or 1; retag the wide field share as a 1-bit `secret bool`.
    return Share.retag(a, 1)

Define the Logic

Define allowed outputs using Stoffel-Lang (match scores, aggregations, eligibility signals)

Constrain at the Source

Constrain at the source so raw data never touches the wire unencrypted

Constrain at the Source

Constrain at the source so raw data never touches the wire unencrypted

Compute the Result

StoffelVM runs on encrypted inputs. Nobody sees the raw data. Not you. Not us.

Verifiable Privacy

Cryptographic proof through your architecture. Not promises in a privacy policy nobody reads.

Verifiable Privacy

Cryptographic proof through your architecture. Not promises in a privacy policy nobody reads.

Stop making user trust depend on your app seeing everything

Build features that use sensitive user context while shares stay private. Open only the output your product needs

When something goes wrong

If your app is tested tomorrow…

Traditional stack

Stoffel stack

What gets exposed

The user’s sensitive data

Shares and approved results

What spreads

More risk inside the app

Less sensitive data sitting in app storage

The review story

“We made the app hold it, and now need to explain it”

“The user’s private details stayed outside that system”

What the product keeps

User trust and product focus

The result the product needs — not the user’s private details

Ship trusted features with clear privacy boundaries

Compute over shares. Open only the result. Keep private details out of the center

AI / ML

Train together without pooling user data.

Compute model updates over shares while raw gradients stay distributed.

Learn more

Key management

Generate keys without one holder.

Create and use key shares across teams or partners without appointing one dealer.

Learn more

Build with Stoffel today

Build apps with privacy from day one. Own the stack that makes it possible.

01 Start building

Use the CLI and Rust SDK to move from Stoffel Lang to a working Rust integration without stitching repos together.

Open quickstart

Rust SDK docs

02 Define the boundary

Make private inputs, allowed outputs, and computation logic explicit before anything runs.

Read language docs

View examples

03 Own the stack

Run your own MPC network with the coordinator, networking, and protocol crates when your team is ready to operate the infrastructure.

View infrastructure repos

Coordinator repo

Build with Stoffel today

Build apps with privacy from day one. Own the stack that makes it possible.

01 Start building

Use the CLI and Rust SDK to move from Stoffel Lang to a working Rust integration without stitching repos together.

Open quickstart

Rust SDK docs

02 Define the boundary

Make private inputs, allowed outputs, and computation logic explicit before anything runs.

Read language docs

View examples

03 Own the stack

Run your own MPC network with the coordinator, networking, and protocol crates when your team is ready to operate the infrastructure.

View infrastructure repos

Coordinator repo

Build with Stoffel today

Build apps with privacy from day one. Own the stack that makes it possible.

01 Start building

Use the CLI and Rust SDK to move from Stoffel Lang to a working Rust integration without stitching repos together.

Open quickstart

Rust SDK docs

02 Define the boundary

Make private inputs, allowed outputs, and computation logic explicit before anything runs.

Read language docs

View examples

03 Own the stack

Run your own MPC network with the coordinator, networking, and protocol crates when your team is ready to operate the infrastructure.

View infrastructure repos

Coordinator repo

Questions teams ask before they build

Bring us the sensitive workflow. We’ll help you map the privacy boundary

Can't we just anonymize the data?

You already know the answer to this. The moment you join datasets—or someone subpoenas your logs—'anonymized' becomes 're-identifiable.' Anonymization is statistical hope, not cryptographic proof.

Won't this slow us down?

Compared to what? The three-month security review you're avoiding right now? The slowest part of building privacy-sensitive features is the meetings where you argue about whether you should.

Isn't this massive overkill for our use case?

Depends. Do you prefer 'Yes, but we promise to protect it' or 'No, our architecture makes storing toxic data impossible'?

This sounds like research-lab complexity

That's what we thought too. Then we actually tried it. Stoffel is production-ready infrastructure, not an academic prototype. You write logic in a domain-specific language that feels like defining a function signature. The MPC stuff happens under the hood. You ship like a normal developer.

What's the catch?

Performance overhead for encrypted computation (we're transparent about benchmarks). Learning curve for Stoffel-Lang (not Python, but not assembly either). And you have to actually care about privacy—if you just want legal cover, this isn't it.