FOR ORGANIZATIONS
Newsrooms, NGOs, hospitals, and government agencies need bulk deployment, signed lifecycle management, and a compliance posture they can defend. Here is how that looks at scale.
WHO THIS IS FOR
Press Edition and the institutional Sovereign tier did not emerge from a focus group. They emerged from talking to editors who had lost devices and clinicians who had lost a network.
Reporters cross borders with material that cannot leak. Editors need to revoke a seized device in seconds, without burning the rest of the bureau.
Field workers operate where the cellular network is the surveillance network. Messages still need to reach the head office.
Patient data is sensitive. Networks fail in disasters. Triage and tracking must run offline.
Procurement requires traceable supply chains, signed updates, and a transparent compliance posture.
WHAT YOU GET
Flash 100+ devices in one session with the organization’s own root certificate. Profiles, allowlists, and signed defaults travel with the image.
Enrollment, rotation, attestation refresh, and end-of-life revocation — all through a private operator console with three-signature gating.
Reproducible-build evidence, signed SBOMs, audit chain export, and per-jurisdiction data-residency. Materials prepared for procurement reviews.
Standard (community + 72-hour response), Critical (24×7 with named escalation), and Sovereign (on-prem federation node and editor console).
A short, predictable agreement for pilots. We do not require exclusivity, NDAs that lock you in, or claw-back clauses.
If you have a niche requirement — language pack, decoy profile, regional alert source — we evaluate it openly and write the result into the public roadmap.
SECURITY QUESTIONNAIRE
Short answers that will survive a security review. We supply a longer written form on request — but these are honest enough to start the conversation.
Inside the secure element (Titan M2, StrongBox, or OpenTitan on reference hardware). It does not leave the chip — not under any of our processes, not under remote attack, not under physical compromise short of a destructive chip-level extraction.
Three independent roles must sign before the device will accept an update — release, security, and operations. Each role’s key is held in a hardware security module under M-of-N officer ceremony.
Hashed patterns and broad region buckets for federated immunity. Nothing else without explicit user consent. The OS-layer privacy gate fails the build if raw data ever reaches the wire — this is an automated test, not a policy promise.
Yes. The Sovereign tier includes the federation node software, the editor console, and the signed peer registry. Your devices can prefer your nodes — and fail closed if they cannot reach them.
Wherever your jurisdiction requires. The federation is multi-node by design and does not require any centralized data plane. Many institutional deployments choose an in-country node for data-residency.
Citizen Lab, Amnesty Tech, and EFF are scoped. Open Crypto Audit Project and Trail of Bits are planned. Findings are published the same day we patch — even when they hurt.
NEXT STEPS
Tell us how many devices and which jurisdictions you operate in. We send back a short proposal, an MoU draft, and a date for a working session — usually inside seven business days.