For crypto startups selling to institutions
Infrastructure that holds up to institutional due diligence. Built in 30 days.
We build the AWS infrastructure a fund's or custodian's due diligence and your SOC 2 auditor expect. In your own account, at a fixed price, without pulling your engineers off the roadmap.
- Free call, no commitment
- Blueprint fully credited to the Build
- Four written guarantees
Built by Mehdi Bechiri. 7+ years building infrastructure in crypto, early engineer on an institutional staking platform through its acquisition.
| control | finding | built | day |
|---|---|---|---|
| CC6.1 | root access keys, no SSO | ✗ → ✓ | 2 |
| A.8.24 | signer key in environment variables | ✗ → ✓ | 6 |
| A.8.15 | no organization-wide audit trail | ✗ → ✓ | 4 |
| A.8.22 | staging and production share a network | ! → ✓ | 9 |
| A.8.13 | backups never restored | ! → ✓ | 18 |
14 findings · 14 built · evidence attachedday 30
Your path
- Blueprint 5 days · signed plan
- Build 30 days · fixed price
- System monthly · no lock-in
€2,500 Blueprint, credited to the Build
Fixed price stated before you sign
Your account everything as reviewed pull requests
SOC 2 · ISO 27001 evidence generated as we build
Who this is for
An institution wants proof your infrastructure is safe. Your deal has a date.
You're the CTO of a funded crypto startup (custody, staking, tokenization, trading or data tools) and you sell to institutions. You have no dedicated infrastructure team. And one of these just landed on your desk:
- an operational due diligence questionnaire from a fund, a custodian or an exchange,
- a SOC 2 Type II report requested before onboarding,
- ICT security and audit clauses from a regulated EU client (DORA),
- a due diligence request before your next raise.
Hiring a senior platform engineer takes months. The institution won't wait that long.
How it works
Five days to know what to build. Thirty days to build it. Then it stays true.
-
5-Day Blueprint
€2,500 excl. VAT · fully credited toward the Build
Five business days. A dated, signed build plan: what your infrastructure needs to meet what the institution asked for, prioritized and costed. You can forward it to them while we build.
-
30-Day Build
Fixed price, stated before you sign
Thirty days. Everything is built in your AWS account, as pull requests your team reviews and merges. Evidence is generated as we go.
-
Year-Round System
Monthly, no lock-in
Keeps the infrastructure and its evidence current through your Type II observation window and the annual re-audit. Three tiers: Watch, Run, On-Call. On-Call covers 8:00 to 20:00 Paris time, 7 days a week. No 24/7.
Bonus
Free First-Month System Pass. Your first month of the Run tier is included after the Build.
Prices excl. VAT. Your AWS costs are not included. Invoiced in EUR, never paid in tokens.
Free call, no commitment · Blueprint fully credited to the Build · Four written guarantees
What the 30-Day Build includes
Infrastructure that answers yes to the questions institutions ask.
-
01 · Access.
AWS multi-account organization, SSO, least-privilege IAM. No long-lived keys.
-
02 · Keys.
KMS with keys you control. CloudHSM or Nitro Enclaves where a signing key needs it.
-
03 · Audit trail.
Organization-wide CloudTrail into locked storage. Centralized logs nobody can quietly edit.
-
04 · Code, not clicks.
Everything in Terraform, plan-review-apply. No hand-clicking in production.
-
05 · Delivery.
CI/CD with rollback. Staging built from the same code as production.
-
06 · Recovery.
Backups with tested restores: the restore, not just the backup. Multi-region recovery for what can't go down.
-
07 · Perimeter.
Network isolation, WAF, secrets management, observability, runbooks, cloud spend caps.
-
08 · Evidence.
An evidence pack mapped to SOC 2 (CC6–CC9) and ISO 27001 (Annex A.8), wired into Vanta or Drata.
-
09 · Nodes, if you run them.
Your node infrastructure in the same code, logs and evidence.
-
10 · Handover.
Runbooks, a 90-minute training session, 30 days of Slack support.
How we work
We don't write your security answers. We build the infra that makes them true.
Your engineers stay on the roadmap
We need access on day one and your review on each pull request. We don't need your team to build it.
You keep the keys
Built in your AWS account, delivered as pull requests your team merges. We own nothing. You keep the final say on the architecture.
Evidence generated, not declared
Scripts query AWS and GitHub directly. No screenshots, nothing written by hand.
Independent
We don't do the audit. You pick your auditor. We take no commission from any auditor or software vendor.
Not included: security policies and governance (a vCISO or a compliance platform), the audit itself, penetration tests, smart contract audits, custody of client assets, AWS costs. In a questionnaire, we answer the technical questions on what we built.
Example
See what a Blueprint tells you before you pay for one.
An excerpt from a Blueprint, on an example account. Every finding is tied to a control, a fix and a day in the build plan.
| FINDING | CONTROL | FIX | DAY |
|---|---|---|---|
| root access keys active, no SSO | CC6.1 | IAM Identity Center, root keys removed | 2 |
| signer key in environment variables | A.8.24 | KMS key, signing through IAM policy | 6 |
| no organization-wide audit trail | A.8.15 | CloudTrail to locked storage | 4 |
| backups never restored | A.8.13 | scheduled restore test, logged | 18 |
| staging and production share one network | A.8.22 | separate accounts and VPCs | 9 |
| deploys from a laptop | CC8.1 | CI/CD with review and rollback | 12 |
14 findings · 9 blocking · 5 can wait · build plan: 30 days
Four written guarantees
If we miss, we pay for it.
Nothing New? Nothing Owed.
If the Blueprint tells you nothing you didn't already know, you don't pay for it.
Our Bug, Our Dime.
If your auditor or our tests flag a defect in a control we built, we fix it at no cost until the finding is closed, unless it was changed outside reviewed pull requests.
Our Delay, Our Dime.
If delivery slips for a reason within our control, work continues at no charge until delivery. Delays on your side, the institution's or your auditor's are excluded.
Not As Promised? Not Paid.
First paid month of the Year-Round System refunded if the service doesn't deliver what was announced.
Free call, no commitment · Blueprint fully credited to the Build · Four written guarantees
Who builds it
I've spent 7+ years building infrastructure in crypto.
I'm Mehdi Bechiri. I was an early engineer on an institutional staking platform and stayed through its acquisition. I held the Head of DevOps and Cloud seat through a SOC 2 preparation and audit. I've run production infrastructure for more than 15 years.
I build what an institution's due diligence and your auditor expect, because I've been on the operator side of both.
Questions
What CTOs ask before they book.
We're not sure what the institution actually wants. SOC 2? Type I or II? Just a questionnaire?
That's where the Blueprint starts: what they asked for, what proof they'll accept, and what your infrastructure needs to produce it.
Our deadline is in weeks. A SOC 2 Type II takes months.
The report does. The infrastructure doesn't. In 30 days the controls exist and produce evidence, and the observation window can start. Meanwhile, you can forward the dated Blueprint to the institution.
How much of my team's time does this take?
Access on day one, and pull requests to review. Your engineers stay on the roadmap.
We already pay for Vanta or Drata.
Good. They show the gaps. We close the infrastructure ones and wire the evidence into your platform.
How do we know the evidence is real?
Scripts query AWS and GitHub directly. No screenshots, nothing written by hand. Your auditor can rerun them.
What if you disappear?
Everything is in your account, in Terraform, with runbooks and a training session. Your team can run it without us.
Do you audit smart contracts or touch our funds?
No. We build cloud infrastructure. No smart contract audits, no custody, no access to client assets.
Do you work outside AWS?
Not today. The Build runs in your AWS account.
Is there 24/7 on-call?
No. The On-Call tier covers 8:00 to 20:00 Paris time, 7 days a week.
Can we pay in tokens?
No. Invoices in EUR, paid by card, SEPA debit or bank transfer.
Free call, no commitment · Blueprint fully credited to the Build · Four written guarantees
Book a start slot
Book a 20-minute call. Leave with a price and a start date.
Tell us what the institution asked for and when. If it's a fit, you pick a time for the call right after. Booking is free and commits you to nothing.
One Build at a time, three per quarter. Next start slot: November 2026.
Form not loading? Open it on tally.so.
Your answers are used to prepare the call: see our privacy policy.