Every mainstream laptop ships with a stack of code you will never see: a proprietary UEFI firmware, a vendor’s binary blobs, and Intel’s Management Engine — a co-processor with deeper access to your machine than your own operating system, which you cannot inspect and cannot fully remove. For most people that’s an abstract worry. For journalists, researchers, executives, and anyone whose threat model includes firmware implants or supply-chain tampering, it’s the last unlocked door in an otherwise hardened setup.
NovaCustom, a Dutch manufacturer, builds laptops that close that door — and they’re one of the few vendors whose privacy claims you can actually verify.
The threat is current, not hypothetical. In the last two weeks alone our breach-tracking sister site covered an MEP on Europe’s own Pegasus inquiry committee being hacked with Pegasus, Dutch intelligence revealing that Russia hijacked security cameras across Europe to track NATO weapons shipments, and North Korea flooding npm, Packagist, Go, and Chrome with 108 malicious packages aimed at developers. Surveillance implants, hijacked cameras, poisoned supply chains — exactly the layers a mainstream laptop asks you to take on faith.
What Makes NovaCustom Different
- Open-source Dasharo coreboot firmware. Instead of a proprietary black-box UEFI, NovaCustom machines boot with Dasharo coreboot — open firmware whose code is public and auditable, with ongoing updates.
- Intel Management Engine disabled. The ME is neutered at the firmware level, removing the most notorious below-the-OS attack surface in modern computing.
- Qubes OS certified. NovaCustom is one of a handful of vendors worldwide with Qubes OS certified hardware — the compartmentalized OS trusted by journalists and security researchers.
- Physical kill switches and camera/mic removal. Configure your machine with the webcam and microphones physically removed, not just software-disabled.
- EU assembly, long support. Assembled in the Netherlands with a 3-year warranty and 7+ years of product support — and the factory runs on its own solar array.
The Lineup
| Line | What you get | Who it’s for |
|---|---|---|
| PrivacyGuard (V54 14″ / V56 16″) | Dasharo coreboot, ME disabled, sensible privacy defaults, Linux-friendly (Zorin OS Pro on the US storefront builds) | Privacy-conscious professionals who want it to just work |
| SecurityTitan (V54 / V56) | Everything above plus Heads firmware with Nitrokey boot attestation, Qubes OS certification, physical camera/mic removal, anti-tamper glitter-sealed screws | Journalists, activists, researchers, high-value targets |
| Custom series | Full configurator: components, Wi-Fi/Bluetooth removal, webcam removal, OS choice, laser engraving, keyboard layouts | Anyone with a specific spec in mind |
| NUC Box mini PC | Dasharo coreboot in a mini-PC form factor | Desks and homelabs |
| SHIFTphone 8.1 | Privacy phone running IodéOS | Completing the de-Googled setup |
The SecurityTitan line’s boot attestation deserves a callout: on every boot, Heads firmware cryptographically verifies that nothing has tampered with your boot chain, using a Nitrokey as the trust anchor. If someone touched your laptop in a hotel room, you’ll know. It’s the classic “evil maid” defense, shipped as a product instead of a weekend project.
The Supply-Chain and Compliance Angle
Firmware is where compliance frameworks are heading. The EU Cyber Resilience Act’s first reporting deadlines land this year, pushing manufacturers — and by extension their customers — to account for the software below the OS. Supply-chain integrity and vendor concentration have become counterintelligence-grade compliance questions, and “data protection by design” under GDPR is much easier to argue when your hardware vendor publishes their firmware source. For EU organizations riding the digital-sovereignty wave that just saw France drop Microsoft Teams and Zoom, an EU-assembled, open-firmware laptop is one of the few straightforward hardware answers.
And for individuals, the privacy case is simpler: a machine with the camera physically absent cannot be spied on through it, and firmware you can audit cannot hide what you can’t see. Modern spyware turns everyday devices into complete surveillance implants, and the consumer version of the problem is thriving too — half a million stalkerware customers were just exposed in a single breach. A software toggle asks the compromised system to police itself; a physical kill switch doesn’t. If you’re building your defenses from the ground up, start with our sister site’s essential privacy guide for the age of digital surveillance.
Where to Buy
- Buy direct from NovaCustom (full configurator, ships from the Netherlands): go.cisomarketplace.com/novacustom
- US buyers: securitygadgets.shop/novacustom is the authorized US storefront — pricing runs roughly 13% below EU rates, shipping is free, and you get the identical hardware and 3-year manufacturer warranty as buying direct. PrivacyGuard models start around $1,259; SecurityTitan builds run $2,695–$2,749.
NovaCustom at CISO.POKER — August 5 at The Wynn
NovaCustom is also putting hardware on the table — literally. At CISO.POKER, the invite-only CISO poker night on August 5, 2026 at The Wynn, Las Vegas, NovaCustom is the second-place prize sponsor, with the specific machine staying under wraps until the event. Somebody is walking out of The Wynn with a privacy laptop.
See their sponsor profile at ciso.poker/sponsors/novacustom.
Verdict
Most “privacy laptops” are ordinary hardware with a Linux sticker. NovaCustom is the real thing: open Dasharo coreboot firmware, a disabled Management Engine, Qubes certification, and physical controls over your camera and microphones — from an EU vendor that will still be supporting the machine seven years from now. The PrivacyGuard line is the right call for most buyers; step up to SecurityTitan if tampering is in your threat model.
Affiliate disclosure: This article contains affiliate links. If you purchase through our links we may earn a commission at no extra cost to you.
