# Smallstep

> Smallstep is a San Francisco cybersecurity company building the first hardware-backed device identity platform. Founded in 2016 by Mike Malone, it grew out of the widely used open-source step-ca project - a private certificate authority and ACME server - and now sells enterprises a way to bind access to Wi-Fi, VPNs, SaaS apps and SSH to verified hardware. Its co-developed ACME Device Attestation standard, built with Google at the IETF, uses hardware co-processors to stop credential theft, phishing and impersonation. Smallstep has raised $26M and was a 2025 RSAC Innovation Sandbox top-10 finalist.

- **Founded:** 2016
- **Headquarters:** San Francisco, California, United States
- **Founders:** Mike Malone (Founder & CEO)
- **Team size:** ~29 employees
- **Products:** step-ca, step CLI, Smallstep Device Identity Platform, ACME Device Attestation
- **Notable:** Created step-ca, one of the most popular open-source private certificate authorities and ACME servers., Co-authored the ACME Device Attestation standard with Google at the IETF., Top-10 finalist at the 2025 RSAC Innovation Sandbox competition.

## Products & services

- **step-ca** — Open-source private certificate authority for X.509 and SSH, plus an ACME server, enabling secure automated certificate management so teams can use TLS everywhere and single sign-on for SSH.
- **step CLI** — A zero-trust swiss army knife command-line tool for working with X.509 certificates, OAuth, JWT, OATH OTP and related primitives.
- **Smallstep Device Identity Platform** — Commercial platform that issues hardware-backed device certificates and enforces policy-driven access to Wi-Fi, VPNs, SaaS apps and SSH across multiple operating systems.
- **ACME Device Attestation** — Standard co-developed with Google at the IETF that uses hardware co-processors to attest device identity and bind credentials to hardware, preventing exfiltration, phishing and impersonation - an upgrade over SCEP.

## Achievements

- Created step-ca, one of the most popular open-source private certificate authorities and ACME servers.
- Co-authored the ACME Device Attestation standard with Google at the IETF.
- Top-10 finalist at the 2025 RSAC Innovation Sandbox competition.
- Cited in Gartner's report 'Effectively Manage Your Organization's Certificates.'
- Raised $26M total across seed and Series A rounds.
- Maintains AICPA SOC compliance.

## Latest updates

- **2025-07** — Announced strategic partnership with Jamf to deliver hardware-backed device identity for enterprise-managed Apple fleets.
- **2025-05** — Named a top-10 finalist at the RSAC 2025 Innovation Sandbox for its Device Identity Platform.
- **2023** — Began commercializing the Smallstep Device Identity Platform after years of open-source development, launching ACME Device Attestation.
- **2022-04** — Closed a $19M Series A led by StepStone Group, bringing total funding to $26M.

## Links

- Website: https://smallstep.com
- LinkedIn: https://www.linkedin.com/company/smallstep
- Twitter/X: https://twitter.com/smallsteplabs
- GitHub: https://github.com/smallstep
- Facebook: https://facebook.com/small-step-518983554803386

---

Profile page: https://yespress.io/smallstep
Published by YesPress — https://yespress.io
Last updated: 2026-07-10