## Why it matters when a device goes missing

The moment a Calyraen device leaves your hands, the data on it is already unreadable to anyone else. You do not have to react fast or hope you had time to react at all. The protection was in place the whole time.

This changes what a loss means. A lost laptop becomes a hardware cost, not a data breach. You can still remote lock, locate, and wipe from your account, but even before you do any of that, the files are safe.

## The recovery key is yours

Encryption comes with one responsibility: the recovery key. This is the backup that unlocks the drive if you are ever locked out, such as after a repair or a forgotten sign-in.

- You hold it, not us. We cannot see your files and we have no secret way in. - Keep a copy off the device. Your Calyraen account, a printout, or a password manager all work. - Guard it like a key. Anyone with the recovery key and the device can get in, so store it privately.

## What a hardware root of trust actually is

Every Calyraen device has a small, locked piece of hardware that never changes. It is set at the factory and it holds the trust anchor: the reference the device uses to decide whether the code trying to run is really Calyraen's. Because it lives in hardware and cannot be rewritten by software, an attacker cannot talk it out of its answer.

From that anchor, the device checks each stage before it hands over control. This is a chain:

- The hardware verifies the firmware is signed by Calyraen. - The firmware verifies the bootloader. - The bootloader verifies the CalyOS kernel.

If any link fails the signature check, the device stops. It does not "try anyway". Only Calyraen-signed firmware and OS get to boot.

## Why signing beats trust

A signature is math, not a password. Calyraen signs each firmware and OS release with a private key that stays inside Calyraen. Your device carries only the matching public key, which can check a signature but cannot create one. So the device can confirm "this came from Calyraen and was not changed since" without ever holding a secret a thief could steal.

This is what stops the classic attacks. An evil-maid attack is where someone with brief physical access swaps your firmware or bootloader for a tampered version, then hands the device back looking normal. On a Calyraen device that swap fails the signature check on the very next boot, and you get a tamper alert instead of a silent compromise.

## Updates are signed too

Firmware updates use the same check. An update is only applied if it is signed by Calyraen, so a fake "update" from a bad website or a hostile network cannot install. This is also why you should never try to load firmware from anywhere but the device itself. There is no legitimate reason to sideload unsigned firmware, and the device is built to refuse it.

## What "7 years" actually means

When you buy a Calyraen device, we commit to sending it signed security updates for 7 years from the purchase date. That is a published commitment, not a rough estimate, and the exact end date is printed in your device settings under the support timeline.

Security updates are the ones that matter most. They close holes that attackers could use, and they keep the parts of the system that check for tampering working correctly.

- Signed means every update is cryptographically stamped by Calyraen. The device checks that stamp before installing anything, so a fake or altered update is refused. - Tested means each update goes through our own testing before it reaches you. We are not using your device to find out whether the update works. - Dated means you always know when support ends. No device quietly stops getting fixes without telling you.

## No forced feature churn

Plenty of products use "update" to mean "we changed things and moved your buttons." We keep those separate. Security updates keep you safe and leave the way you work alone.

New features are optional and clearly labelled. If a release adds something, you decide whether to turn it on. Your device will not look and behave differently one morning because an update reshaped it overnight.

This matters for a simple reason. A machine that stays familiar is a machine people keep using safely. When the layout never shifts under them, non-technical owners and busy teams keep patching instead of putting it off.

## Why this protects you

An unpatched device is the most common way data gets stolen, and the risk grows the longer a known hole stays open. A steady stream of tested fixes, for years, on a clear timeline, is what keeps a device trustworthy long after the day you bought it. You are not left to wonder whether it is still supported. The answer is in your settings, with a date.

## How you *sign* in

Calyraen does not force one way to log in. You choose what fits the device and the person using it.

- Passkeys and biometrics by default. Your face or fingerprint releases a passkey held on the device. Nothing to type, nothing to leak. - Passwords, optional. You can still use a password if you prefer one, on its own or as a fallback. - Multi-factor. Add a second check for online or work accounts, so a stolen password is not enough by itself. - No online account required. A plain local account gives you the full device. You never have to sign up for anything to use the hardware you bought.

Account types cover most situations. A local account lives only on that device. A family setup gives each person their own space and lets an adult manage a child's account. A business account is managed by your organisation's IT, which can join the device to your directory the same way a Windows PC joins Active Directory, so people sign in with their work identity and one account works across the fleet.

## Where your face and fingerprint *live*

This is the part people worry about, so here is the plain answer.

- On the device, not in the cloud. Your biometric data is turned into a template and stored in the hardware security chip. It does not sync anywhere and it never reaches Calyraen. - A template, not a photo. It cannot be read back out as a picture of your face or a copy of your fingerprint. - Tied to encryption. Every Calyraen device is encrypted from the moment you set it up, and signing in is what releases the key. A locked device is not just logged out, its files are unreadable to anyone without your sign-in. That one fact is what keeps a lost device safe.

## What the management layer actually does

Every Calyraen device can be managed from one console, whether you have five or fifty thousand. Management does not mean watching people. It means the device configures itself to your rules, proves it is following them, and can be corrected or recovered without a desk visit.

The pieces fit together like this:

- Enrolment ties a device to your organisation before anyone uses it. Zero-touch means a factory-fresh device joins your fleet the first time it goes online, with no manual imaging. - Configuration profiles carry the settings: network, sign-in, installed apps, encryption enforcement, lock screen, and update windows. - Security baselines carry the hardening: tested, CIS-style rule sets that shut off risky defaults and set sane password, lockout, and service policy. - Compliance reporting is the proof. Each device reports whether it is encrypted, updated, and on-baseline, so you can show auditors a real picture instead of a guess.

## Cloud or on-prem, your choice

You can run the whole thing from Calyraen's management service, or you can run the on-prem option so the fleet never has to phone a cloud. On-prem keeps enrolment, policy, and reporting inside your own network, which matters for regulated work and for sites with poor or no internet.

Both options do the same jobs:

- Remote management to push settings, apps, and fixes to a device or a whole group. - Bulk provisioning so a shipment of hundreds is handled by rules, not by hand. - Remote lock, locate, and wipe for lost or stolen hardware, backed by activation lock so a thief cannot re-enrol the device.

Because every device is encrypted from the start and only boots Calyraen-signed firmware and OS, your baseline sits on top of hardware that already resists tampering. You manage the fleet. The hardware defends itself.