The SENTINEL is a hand-built operator unit — every component installed new, every layer of the stack replaced or hardened, every account on every platform pre-provisioned in the operator's name. It boots Libreboot, runs a hardened Arch Linux profile, hosts your own Tor services out of the box, and ships with a pre-configured YubiKey plus a 12-month identity bundle across nine privacy-grade platforms. We don't sell single units. We equip teams.
Stock laptops are designed for the average buyer, not the operator who actually needs the machine to be his. Three layers of attack surface ship by default. We strip all three.
Every modern Intel platform ships with the Management Engine — a separate x86_x CPU running closed firmware, with ring-3 access to RAM, the network, and the disk, alive even when the machine is "off." Closed-source. Signed by a key you don't hold. We neutralise it on every unit before it leaves the workshop.
Boot Guard, Secure Boot, and proprietary firmware decide what your hardware is allowed to run before the kernel exists. We replace the entire stack with Coreboot + Libreboot. You hold the signing keys. You decide what boots. The flash chip is physically write-protected after handover.
Default OS images call home on dozens of channels. Default messaging apps store metadata, link your real-world phone number to your identity, and centralise key management on the vendor's server. Our image has no telemetry. Our identity bundle uses platforms that don't require — or accept — a phone number.
Every functional component on a SENTINEL is installed new. Panel, batteries, keyboard, palmrest, trackpad, RAM, NVMe, fans, thermal compound — all factory-fresh. The motherboard and roll-cage chassis are sourced as factory-sealed New Old Stock with verified Lenovo seals — the last platform with full Libreboot support and no Boot Guard fuse-locking. Every unit is reflowed where needed, stress-tested for 48 hours, and signs off with a cryptographic build attestation.
We open the chassis, isolate the BIOS chip, and flash Libreboot 25.12 over an external SPI programmer — never via the running OS, where a compromised vendor BIOS could intercept the write. The original ROM is dumped and SHA-256 verified twice before rewrite. Every unit ships with a sealed USB containing the original ROM, the new ROM, the build manifest, and a CSSLTD-signed attestation listing the SHA-256 of every binary on the system.
Honest answer first: Libreboot replaces the proprietary Lenovo BIOS with Coreboot plus an open payload (we ship GRUB), and runs me_cleaner against the Intel ME region with the HAP bit set. The runtime ME no longer executes. CPU microcode and the FSP blob remain — they're unavoidable on x86 silicon, and we tell you exactly which they are. Pretending otherwise would be a lie.
The CSSLTD Arch Hardened profile is a minimal Arch base with linux-hardened, AppArmor in enforce mode, full-disk LUKS2, Wayland-only display, and a tooling set curated for operator workflows. No display manager. No telemetry. No AUR helper preinstalled. The complete provisioning manifest is public — you can rebuild every unit from source and verify the SHA-256 matches what we shipped.
Every line below is set up, signed, and verified before the chassis is sealed. You boot, plug in your YubiKey, set your passphrase, and the unit is operational. No further configuration needed for the standard threat model.
Every SENTINEL ships with a configured Tor daemon and ready-to-deploy onion-service templates: static site, file dropbox, SimpleX relay, Matrix homeserver, SSH access. v3 onion only (84-character addresses). Vanity address generation (mkp224o) included. Stream isolation is on by default — every application gets its own SOCKS port, so a leak in one app can't deanonymise the others.
/srv/onionEvery unit ships with a unique operator identity across nine privacy-grade platforms — registered, paid, and configured before handover. None of them require a phone number. None of them are linked to your real-world identity. You receive credentials, recovery keys, and OPSEC notes for each platform on a sealed paper insert at handover, alongside your YubiKey 5C NFC. 12-month licences renewable per-seat.
Every unit ships with a YubiKey 5C NFC. Keys are generated on the operator's hardware in the operator's presence during handover — never pre-loaded by us. CSSLTD never sees private key material. Backup YubiKey can be provisioned at the same session for an additional. FIDO2, OpenPGP, and PIV slots are configured for sudo, system login, SSH, GPG, LUKS unlock, and Vaultwarden 2FA.
Every team package includes a printed binder, the same content cryptographically signed in PDF, and a four-hour live onboarding session over Element with one of our build engineers. The documents are written to be operationally useful, not legally defensive — daily-use playbooks, incident-response runbooks, threat-model worksheets, and recovery procedures keyed to your specific configuration.
Daily-use reference. Keyboard layout, app workflows, identity-bundle navigation, YubiKey routine, common tasks.
Per-team exercise. We help you map your real adversary, real assets, real failure modes — not generic checklists.
If a unit is lost, seized, or compromised — exactly what each operator does, in what order, on what timeline.
Lost YubiKey, forgotten passphrase, hardware failure. What's recoverable, what's not, what we can do, what only you can.
Spinning up your own .onion services step by step. Vanity addresses, scaling, monitoring, common mistakes.
Per-unit signed manifest. Every binary, every blob, every hash, every config. Proves what we shipped.
"Trust" is a marketing word. These are commitments backed by SLAs, written into the contract, and underwritten by professional indemnity insurance. If we fail any of them, you have a documented remedy — financial, material, or both.
Every unit ships with a CSSLTD-signed manifest listing the SHA-256 of every binary, blob, and configuration file on the system. If any hash on your unit fails to match the attestation, we replace the unit and refund in full.
CSSLTD does not retain operator credentials, key material, or access to provisioned identities after handover. We log no operator activity. We hold no master key, no recovery service, no backdoor — even ours. If you lose it, it's gone.
Tamper-evident packaging, signed-for delivery to the named recipient only — never a freight forwarder, never a depot. Each unit's serial, build hash, and courier waybill are recorded. If the seal is broken on arrival, we replace the unit.
We don't bury labour costs or licence fees in a sticker price. Every line item is a real cost, written down, paid for. We don't run discount tiers because the work to build a SENTINEL is the same whether you order five or fifty — and the operators relying on the unit deserve the same level of attention either way.
Yes — every functional component is installed new. Panel, keyboard, palmrest, trackpad, batteries (both cells), RAM, NVMe SSD, fans, thermal compound, screws. The motherboard and roll-cage chassis are sourced as factory-sealed New Old Stock — Lenovo discontinued the line, but factory-sealed parts are still available through enterprise channels and we inspect every seal before opening. We chose the T480 because newer Intel platforms ship with Boot Guard fuses that physically prevent third-party firmware. There is no "more secure new laptop" we could ship instead.
Because bulk discounts mean either we cut margin (hurting the long-term programme) or we cut quality (hurting the team that ordered units 6–10). Neither is acceptable. The same hands build every SENTINEL. The same 48-hour burn-in. The same attestation. If the per-unit price is too high for the team's budget, the answer is fewer operators get equipped, not that the operators we do equip get worse units.
"Military-grade" is a marketing term. The actual answer: X25519 for key agreement, AES-256-GCM for symmetric encryption, the Signal Protocol Double Ratchet for messaging, WireGuard (Curve25519 + ChaCha20-Poly1305) for VPN, aes-xts-plain64 / 512-bit with Argon2id KDF for disk. These are the primitives endorsed by NSA Suite B for SECRET-classified traffic and used by Signal, ProtonMail's E2EE channel, and most modern privacy platforms. The advantage of CITADEL specifically is we operate the relay infrastructure and don't link the account to a phone number.
No, and anyone telling you that on a modern x86 platform is lying or confused. CPU microcode and the Intel FSP (Firmware Support Package) blobs are required to bring the silicon up — Coreboot + Libreboot replace everything else, and we run me_cleaner against the Intel ME region (HAP bit set, runtime stub only). The ME is neutralised, not removed. We document exactly which blobs remain and supply their hashes with each unit. If "literally zero closed blobs" is your requirement, we can quote you on T400 / X200 builds with Libreboot's vendor-blob-free profile — but performance is significantly lower (Core 2 era). For real operator workflows, the SENTINEL is the right trade.
Every account on every platform is registered over Tor, paid with Monero (or cash via a third-party Monero seller for platforms that don't accept it directly), and registered to an operator codename you choose. None of the identities require — or are linked to — your real-world name, address, or phone number. Credentials are printed once, sealed, handed over physically, and not retained by us. If you lose them, they're gone.
If you have the backup YubiKey we recommend at handover (£99) — you swap it in, revoke the lost key from each platform's account settings, and we ship you a new one provisioned over a CITADEL session. If you don't have a backup — most things are recoverable via the printed recovery codes (kept in your secure location, never on the unit), but LUKS unlock and any FIDO2-resident SSH keys are gone. The disk is not. You can boot from a Tails USB and decrypt with your passphrase, then re-provision keys to a new YubiKey. Full procedure is in the Recovery binder.
The infrastructure is operator-owned — we don't audit what you put on it. But the SENTINEL programme is sold to teams operating within the law of their jurisdiction: journalists, security researchers, NGOs, lawyers, doctors, executives in jurisdictions with hostile threat models. We refuse orders that, in our judgement, point at criminal use. We do not ship to jurisdictions where strong encryption itself is restricted by import law (a small list — we'll tell you if you're affected).
Three layers of verification, all of which you can perform yourself: (1) The Libreboot ROM we flash is built from upstream source — we ship the build container, you re-build it, the SHA-256 of the resulting image must match the value on your unit's attestation. (2) The Arch Hardened image is provisioned via a public Ansible manifest you receive — every package, every config, every hash. Re-provision a unit yourself and compare. (3) The CITADEL client is open-source with a third-party audit report shipped per licence. The only thing you have to trust is the silicon and the chassis seal — same as any other laptop, except we let you crack the case open and look inside.
Lead time is 4–6 weeks from order confirmation, longer for bespoke orders. We ship UK and EU mainland by default (couriered, signed delivery to the named recipient). For US, CH, IS, NO, and selected APAC destinations, contact us — there's an additional shipping & customs handling fee, and we discuss tamper-evident chain-of-custody options. We do not ship to jurisdictions where Libreboot, strong encryption, or operator-controlled hardware is restricted by import law.
A 50% deposit confirms the order. The balance is taken on shipment. Refundable in full any time before flashing begins. We respond to every operator brief within 24 hours, in writing, signed.
cyberssl.co.uk · PGP 0x4F2A on request · CITADEL: ops@cyberssl.co.uk