Our process
Privacy Threat Model
Below is a comprehensive breakdown of every privacy modification we make, what threat it mitigates, and why it matters. We believe in transparency — you should know exactly what you're getting and why.
Physical Surveillance
Protection against hardware-based monitoring.
Webcam Disconnected
Camera module physically disconnected at the hardware level. Not disabled in software — the electrical connection is severed. No driver, no device, no risk.
Microphone Circuit Cut
Microphone circuitry disabled at the board level. The audio input path is physically interrupted. Software cannot re-enable what hardware has disconnected.
Firmware Attacks
Protection against low-level system compromise.
BIOS/UEFI Password Lock
Administrative and boot passwords set on the firmware level. Prevents unauthorized changes to boot order, secure boot settings, and hardware configuration.
Secure Boot Enforced
Only cryptographically signed operating system bootloaders are permitted. Prevents bootkit and rootkit installation at the firmware level.
Boot Device Restriction
USB and external media boot paths disabled. Prevents evil maid attacks via live USB boot.
Physical Tampering
Detection of unauthorized physical access.
Tamper-Evident Seals
Security seals applied to chassis screws and access panels. Any attempt to open the device leaves visible evidence. Verified by you upon receipt.
Chassis Intrusion Detection
Where supported by hardware, BIOS-level chassis intrusion monitoring enabled. Alerts on next boot if case has been opened.
Network & Wireless
Reduced attack surface for network-based threats.
Bluetooth Disabled
Bluetooth radio disabled at the BIOS/firmware level. Reduces wireless attack surface and prevents tracking via Bluetooth beacons.
Network Stack Hardening
PXE/network boot disabled. Wake-on-LAN disabled. Unnecessary network services removed from firmware configuration.
Data Protection
Ensuring data confidentiality at rest.
Encrypted Storage Ready
System prepared for full-disk encryption deployment. TPM module verified and cleared for new ownership. Ready for LUKS, BitLocker, or FileVault.
Have specific threat concerns?
We can discuss custom hardening for your specific threat model. Every machine is built to order.
Get in Touch