TactiQ Provision Book a diagnostic
Embedded Linux security for device makers

Secure Boot that holds up on the production line.

We take Yocto-based devices on NXP i.MX, TI Sitara and Rockchip from a working prototype to a signed, locked boot chain and a provisioning procedure your factory can repeat. Then we keep you ready for EU Cyber Resilience Act reporting for as long as the product is on the market.

Start with a diagnostic See prices

What we lock down

each stage verifies the next
1
BootROMChecks the first loader against the key hash fused into the chip
2
SPL / TF-AVerifies the signed U-Boot image
3
U-BootShell disabled, environment fixed, kernel and device tree verified
4
Linux kernelMounts the root filesystem through dm-verity
5
Root filesystemRead-only and checked block by block
Root of trust: public key hash in eFUSE / OTP. Burned once, after your sign-off.
EU Cyber Resilience Act, Article 14

The reporting clock has been running since 11 September 2026.

When a vulnerability in a product you sell in the EU is actively exploited, you must report it to ENISA and your national CSIRT. This applies to manufacturers outside the EU who sell into it, and to products released years ago.

24 hEarly warning
72 hVulnerability notification
14 daysFinal report after the fix is available

Full CRA obligations apply from 11 December 2027.

Services and prices

Fixed scope, fixed acceptance tests.

Prices are starting points in euro, excluding VAT. You get a fixed quote after the diagnostic.

Start here

Secure Boot diagnostic

€600launch price for our first three clients, then €1,500. 3 working days
  • Your boot chain and trust boundaries as they actually are
  • Bypass attempts and test results
  • Review of U-Boot and every boot interface
  • Fix plan with a fixed quote for integration

You pay after you receive the report. The fee is credited in full against Secure Boot integration if you order it.

Secure Boot integration

from €4,500per board, up to 15 working days
  • Yocto layer that signs bootloader, device tree and kernel on every build
  • U-Boot hardening: no shell, fixed environment, closed boot interfaces
  • Key procedure: generation, storage, backup, revocation
  • Documented eFUSE / OTP procedure for production

Acceptance on your reference board: a signed image boots, a modified image is rejected, the shell is unreachable.

CRA reporting readiness

from €9,000per product line, up to 20 working days
  • SBOM for every version you have on the market
  • CVE and VEX analysis built into your CI
  • Disclosure policy and a channel for incoming reports
  • Response runbook, report drafts, ENISA platform registration
  • A 24-hour drill with your team on a real product version

Each further product line on the same build system: from €2,500.

CVE monitoring

from €900per month, per product line
  • Weekly scan of your SBOM against vulnerability databases
  • Monthly triage with VEX: affected or not, and why
  • Same-day alert when a vulnerability in your image is exploited
  • Monthly report and engineering hours for fixes

Six-month minimum. Set-up is free after a diagnostic or integration project.

Platforms

Three silicon families, one method.

FamilyMechanismWhat to know
NXP i.MX 6, 7, 8, 8M, 93HABv4 / AHABSigning with the NXP Code Signing Tool, integrated into your Yocto build.
TI Sitara AM62x, AM64xHS-FS → HS-SETI supplies the OTP Keywriter under NDA. You request it from TI; we build the procedure around it.
Rockchip RK3399, RK3568, RK3588eFUSE key hash, signed FITVendor loader binaries need extra care. We plan a few more days for this.
Other SoCsafter diagnosticWe quote only once we have checked your board.
How it starts

No fuse is burned before you sign off.

  1. Tell us the basics

    Product, SoC, Yocto version, and where you sell it.

  2. Diagnostic

    Three working days on your board and build. You get a written report.

  3. Fixed quote

    Scope, timeline and the acceptance tests we will run.

  4. Integration

    Tests pass on your reference board first. Production provisioning follows your approval.

Where our work stops

Clear limits

  • We do not certify products or give legal opinions on CRA conformity.
  • We do not file reports with ENISA for you. Deciding that a vulnerability is exploited and submitting the report stay with you as the manufacturer.
  • We do not burn keys into production units until the procedure has passed on your reference board.
Work you can check

Public record

  • SELinux policy module for the RAUC update service, written by our founder and merged into the SELinux Reference Policy: PR #1181.
  • TactiQ OS public build: SPDX 3.0.1 SBOM, keyless Sigstore signing, Rekor transparency log, 99.94% reproducible builds: repository.

Shipping a Linux device into the EU?

Send the SoC and the product name. We reply with what a diagnostic would cover on your board.

hello@tactiqprovision.com