Investor & Partner Overview

Product definition

Crypt-in is a hardware-backed root of trust commodity. The root secret never leaves the dongle. The computer never possesses the key.

What does not exist today (verified July 2026)

Competitive research conducted July 2026. No product currently combines all of the above. This is a claim about the combination — each element exists elsewhere in isolation.

Why the architecture matters

K_attestation — anti-clone protection

Each physical ESP32-S3 chip generates a unique hardware attestation key (K_attestation) from hardware entropy, independent from the recoverable BIP-39 seed. The license server binds activation to K_attestation — a clone built from the same seed is detected and blocked.

Verified on real hardware: Krypt@9c756da, Krypt@d3e71df.

Vendor-blind by construction

lake8.dev also receives the tax/VAT number where invoicing requires it. It never receives the root secret, the BIP-39 seed, encrypted files, session keys, the Vault master secret, or telemetry of any kind.

This is an architectural property, not a policy promise: the material required to decrypt was never transmitted, so no policy change or legal order can produce it.

Offline-first

The licence server does exactly four things: initial activation, annual renewal, registration of a backup dongle — one per calendar year, both chips stay alive and licensed — and transfer to a replacement dongle, at most three times a year. Backup and replacement are distinct operations with distinct limits; a licence covers two chips in total. There is no periodic check-in during normal use. lake8.dev could shut down tomorrow: already-activated dongles keep decrypting forever.

What exists today (not roadmap)

• ✅ ESP32-S3 firmware — Ed25519, BIP-39, AES-256-GCM, verified end-to-end on real hardware
• ✅ K_attestation — hardware entropy, chip-unique, stable across resets, unchanged after recovery (Krypt@9c756da, Krypt@d3e71df)
• ✅ License server — K_attestation integrated, 8/8 scenarios verified in simulation, 7/7 HID tests passed against production (server-licence@a472adc)
• ✅ cryptin.lake8.dev — live with TLS, Starlight documentation, dedicated access logs
• ✅ Semantic files — llms.txt, llms-full.txt and a knowledge-graph.json, published and interlinked with the lake8.dev graph. JSON-LD injected in the <head> of every page; schema.org validation passes with zero errors and zero warnings
• ✅ HID Protocol — public specification published
• ✅ Vulnerability disclosure — policy published, PGP key at /security.asc, fingerprint repeated in the policy and in the semantic files
• ✅ Windows client (Personal v1) — WinForms, C#, complete August 2026. Core flows (main window, PIN, serial recovery) verified on hardware; the setup, activation and payment wizards have not yet been exercised by an external user
• ✅ Internal security audit — 3 red team sessions run by lake8.dev with Claude Opus 5, report published. Not an independent third-party audit

Prototype render — ESP32-S3 in anthracite PLA case. Case design, not a photograph of a production unit.

In progress

• ⏳ Linux CLI client — .NET 9 wrapper around CryptinSDK, Apache 2.0. Not shipped: expected with the developer beta and not in that package, no date announced

Required before launch

• ❌ CRA compliance — target 28 February 2027, a month before the April 2027 launch
• ❌ Stripe approval
• ❌ Firmware secure update strategy
• ❌ Closed alpha with 20–50 users

Milestones & timeline

Dates for planned items are targets, not commitments. The four proofs below gate expansion, not the public launch: if one of them is not demonstrated, expansion waits.

Kit Standard, render of the case design at true scale — it fits between two fingers, with an ESP32-S3 inside. Kits ship pre-flashed and tested; the factory test ends by erasing NVS, so the keys you use are generated at first boot in your hands, never in ours.

Four proofs before expansion

These are gates, not milestones. Expansion — multiplatform, Vault, SDK — happens only after all four are demonstrated.

When and how we raise

We are not raising now.

Crypt-in is bootstrapped. The infrastructure runs on lake8.dev's existing Raspberry Pi setup. Development cost is near zero — the founder directs architecture, Claude Code accelerates implementation.

We will consider external capital after:

• Closed alpha with positive feedback
• CRA compliance operational
• First paying customers

At that point, external capital makes sense to fund: independent security audit, CE marking for Kit Pro, and vertical marketing (legal, medical, manufacturing).

We are not open to equity dilution.

We consider non-dilutive instruments only:

• Grants
• Zero-interest loans (Smart&Start Invitalia)
• Revenue-based financing
• Royalty agreements on Certified Integrator sales

Team

Giantommaso Fogli — Founder

Full-stack developer, embedded systems, applied cryptography. Architect of Crypt-in, lake8.dev Customer Zero. San Pietro in Casale, Bologna, Italy.

AI-assisted development pipeline

The entire stack — firmware, license server, Windows client, infrastructure — is developed using an AI-assisted pipeline directed by the founder. Every architectural decision is made by a human. The pipeline enables solo-founder velocity without compromising on technical depth.

lake8.dev as Customer Zero

Lagotto BI, Lagotto Meter and MRP Scheduler run in production on a Raspberry Pi 4B. The same discipline that keeps lake8.dev at PageSpeed 100/100 on ARM hardware informs every Crypt-in architecture decision.

Get in touch

If you are a business angel, seed fund, system integrator, or potential Certified Integrator partner, write directly to:

info@lake8.dev

No pitch deck required upfront. Read this page — if it makes sense to you, we can talk.

Full technical documentation ·Vulnerability Disclosure Policy