Services.
Three things we do.
- 01 · Before you back or buy
Due diligence
A company you are about to back or buy, looked at the way the people who built it would.Investors, family offices, acquirers and their advisers.Read - 02 · What you already run
IT security audit
A second opinion on your own systems, security and vendors, from someone with no stake in them.Partners and owners, before a client, an insurer or an incident asks.Read - 03 · Before you let it in
Procurement
A tool or vendor you are about to let in, AI tools included. Every one can reach something: we find out what, then negotiate and onboard.Firms choosing a tool, and firms done choosing alone.Read
How we work.
- Self-funded
- No outside investors, and no commissions from any vendor. We answer only to the firm that hired us.
- Need-to-know
- We see only what the job needs, with read-only access you approve and withdraw. Our findings stay encrypted, in the EU, and nothing else is kept.
- On the record
- Every job ends in a written verdict, yours to keep, for clients, insurers and anyone who asks later.
- In the open
- We invest in companies we love. If a job touches one of them, we tell you before we start.
- Candid
- We say what we see, including when the answer is "don't".
- Alongside
- We work with your IT provider: we check, they run. Afterwards your own people fix what needs fixing, or our collective does, and we come back when you want us to.
Who we work with.
- 01 · Accounts, keys, data rooms
Finance
Fintech, digital assets and venture capital: customer accounts, wallets and keys, and the data rooms behind every round.Read - 02 · Private clients
Wealth management
Wealth managers, and the law and accounting firms that look after private clients: their portfolios, their files, their books.Read - 03 · Research and designs
R&D
Labs and deep-tech companies whose research, designs and test data are the business, and the suppliers who get to see them.Read
Questions people ask.
Is this a fractional CISO?
No. We check and choose; your own people run things. A check has a beginning and an end, and a written result you keep. If you want us back, we come back.
We already have an IT provider.
Good. Keep them. They run your systems every day, and nobody independent looks over their shoulder. We do that, and we hand them the fixes.
Our insurer already scans us.
Keep it. A scan sees what faces the internet; we look at the rest: who can reach what, whether the backups restore, what the tools you have connected can do, how credentials travel.
Do you look at AI tools?
Yes, on every check: what each one can reach, how it was set up, who approved it, and where what it sees ends up. Most firms have more of them than they think.
Can you work under NDA?
Yes. We sign one before we see anything. Access is read-only, limited to what the job needs, approved by you, logged, and withdrawn when we are done.
Who owns notacompany?
Gravity Holdings, which also holds the notacompany.com trademark. We are self-funded and take no outside capital, so nobody else has a say in what we tell you.
What if you find something serious?
You hear about it the same day, with what we would do first. Then it goes in the report with everything else, rated by how much it matters.
Do you build things?
We design, and we choose who builds. When a firm needs hands, our collective includes people who build, and we stay to check their work.
Where do you work?
Anywhere in Europe, in English or Portuguese. Most of a check happens over calls and read-only access; we come on site when it helps.
Tell us what you want checked.
A company, a vendor, or your own systems. We reply within two working days with what we would look at and a quote.
The first conversation costs nothing. Or write to us at hey@notacompany.com.