Your files are already locked
Everything on the device is encrypted from the start. If it is ever lost, the data on it stays unreadable.
How encryption works
Set it up
Safe from the first switch-on.
Most of the protection is already on when your Calyraen device arrives. A few minutes finishes the setup, and none of it needs a specialist.
Most of it is already on
On by default Encryption and secure boot
7 yr Signed security updates
~10 min To finish the full setup
1 place To manage every device
Why this feels calm
Less to do than you think.
The device left our workshop with its defences switched on. Encryption is running, secure boot is guarding start-up, and signed updates are set to keep arriving for years. Setup is mostly you confirming what is already there, plus four small jobs worth doing once.
The first time a device switches on, it walks you through a short checklist. You run it once, and then it stays out of your way.
Three things you needn't worry about.
These come switched on. You do not set them up, you just confirm them.
It checks itself as it starts
Secure boot makes sure only trusted software loads when the device wakes. Nothing slips in underneath.
Device security ›Fixes keep arriving for years
Signed security updates run for seven years. Turn on automatic updates once and they land on their own.
Read more ›Four small jobs, done once.
Run these the first time the device switches on. Nothing here takes long, and nothing needs a specialist.
-
01
Confirm encryption, save your key
Encryption is already on. Check it, then save your recovery key somewhere off the device. That is the one step people skip.
-
02
Turn on automatic updates
Signed security updates run for seven years. Set the window so they land when the device is not in use.
-
03
Set passwordless sign-in
A passkey or your fingerprint is quicker and harder to steal than a password. Add a backup method while you are there.
-
04
Register for remote lock
Link the device to your account so you can lock it, find it, or wipe it if it ever goes missing.
Want to understand before you tap?
Imagery in production
How your files stay private
Encryption scrambles everything on the device so it reads as noise to anyone without your key. It is switched on before the device reaches you. The one thing worth doing is saving your recovery key somewhere away from the device, a password manager or a note kept safe at home. Keep the key and a lost device is a lost object, nothing more.
Device security explained ›Imagery in production
Why updates can be trusted
A signed update carries proof that it really came from us and was not tampered with along the way. The device checks that proof before it installs anything. Signed security updates keep arriving for seven years. Set an automatic window once and you can stop thinking about it.
Imagery in production
How the family controls fit together
Every device you set up is managed from one place under your account. From there you can see what is on, lock a device that has wandered off, and adjust the settings for the people who share it. You set it up once. After that it is a page you visit only when something changes.
The things parents ask.
Do I need to be technical to set this up?
No. Most of the protection is already on, and the four jobs worth doing are each a confirmation or a single switch. There is nothing to install and no specialist to call.
How long does setup take?
About ten minutes to finish the full setup on a device. You do it once, the first time it switches on.
What happens if the device is lost or stolen?
If you registered it for remote lock, you can lock it, find it, or wipe it from your account. Because the device is encrypted, the files on it stay unreadable either way.
Will the updates ever stop?
Signed security updates run for seven years. Turn on automatic updates once and they arrive on their own, with no charge and nothing to chase.
Can I manage more than one device?
Yes. Every device you set up sits in one place under your account, so you can check on all of them from the same page.
Take your time
Prefer the why first?
Each setup step has a fuller explanation on the topic pages: how encryption works, how updates are signed, and how the family controls fit together. If you would rather ask, a real person is one message away.
CalyOS Desktop setup
*Desktop*
Turn on a home or office desktop and confirm the safety features that ship on by default. This walks you through the recovery key, updates, sign-in, accounts, and remote lock in order.
Set up a new CalyOS desktop
Work through these in order the first time you switch the machine on. Each step takes a minute or two, and none of it needs a cloud account. Set aside about fifteen minutes.
-
01
Finish first sign-in
Power on and follow the setup screens. Pick your region, keyboard, and network. When asked, create the first account as the owner. This account is an administrator by default, so keep the password to yourself. You do not need a Calyraen ID to use the desktop, and you can skip any online sign-in prompt.
-
02
Verify encryption and save the recovery key
Disk encryption is already on. Open Settings, then Security, then Encryption. Confirm the system drive reads Protected. Choose Save recovery key and put it somewhere off the machine: a printout in a drawer, a password manager, or a USB stick you store elsewhere. This key is the only way back in if the machine forgets your sign-in. Do not leave the only copy on the desktop itself.
-
03
Set the update window
Go to Settings, then Updates. Confirm automatic security updates are on. Set an install window for a time the machine is on but you are not using it, such as early morning. CalyOS Desktop receives updates for seven years from release, so you can leave this alone once set.
-
04
Turn on passwordless sign-in
In Settings, then Accounts, then Sign-in, add a second method. A PIN or a fingerprint is faster than a password and stays on the device. Your password still exists as a fallback. Test the new method by locking the screen and signing back in before you move on.
-
05
Add accounts
At home, open Family and add an account for each person. Give children a Standard account, not an administrator one. In an office, open Settings, then Organisation, then Join directory, and enter the address your admin gave you. The machine then follows your workplace policies.
-
06
Register for remote lock
Open Settings, then Security, then Device recovery, and turn on Remote lock. Note the device name shown. From another signed-in device or the owner portal you can now lock or erase this desktop if it is lost.
Already on
What is already protected
A CalyOS desktop does not wait for you to switch on the basics. The parts that matter are set before you ever see the screen.
- Encryption is applied to the system drive at the factory and stays on. The only thing left for you is to save the recovery key somewhere safe, because Calyraen does not hold a copy for you.
- Security updates are on by default and continue for seven years from the model's release date. You control the timing, not whether they arrive.
- Sign-in starts as a password and can be strengthened with a PIN or fingerprint that never leaves the device.
None of this depends on a subscription or an online account. The desktop works fully on your own network, and it keeps working if the internet is down.
Home versus office
Imagery in production
At home
Family accounts
Use Family accounts. The owner account manages the household, each person gets their own space, and children get Standard accounts with parental controls you set. Nothing is shared with a workplace.
Imagery in production
In an office
Join the directory
Join the directory during setup or later under Organisation. The machine then follows the rules your administrator sets: who can sign in, which updates apply, and what software is allowed. A fleet of desktops can be managed together this way, on-prem, without sending data outside the building. Pick one path deliberately, because a machine that has joined a directory is managed by that directory.
If a desktop is lost
Imagery in production
Lock
Lock freezes the machine and shows a message and contact detail on screen.
Imagery in production
Erase
Erase wipes it and leaves it useless to whoever has it. Because the drive is encrypted, the data is already unreadable without your sign-in or recovery key.
Imagery in production
Register early
Remote lock is the reason to register the device early. Register before anything goes wrong, because you cannot enrol a device you no longer hold.
Common questions.
No. The desktop completes setup and runs entirely on your own network. An online account is optional and only adds conveniences like syncing settings across your own devices. Encryption, updates, and sign-in all work offline.
It becomes a managed machine and follows your organisation's policies from that point. Existing local accounts may be restricted, and your admin controls updates and sign-in. Only join a directory you intend the machine to belong to, and back up personal files first.
Yes, as long as you can still sign in. Open Settings, then Security, then Encryption, and choose Save recovery key again to generate and store a fresh copy. Do this before you need it, because without the key or a working sign-in there is no way to recover the drive.
Related topics.
Set up a laptop or tablet to travel.
Your Calyraen laptop or tablet ships encrypted and ready to travel. Spend ten minutes to save the recovery key, set up biometric sign-in, and turn on remote lock so a lost device stays yours.
What each safety feature actually does
A laptop or tablet leaves the building more than a desktop, so its protections are built around loss and theft.
Encryption
Unreadable without you
Encryption scrambles everything on the disk. Without your PIN, biometric, or recovery key, the drive is unreadable, even if someone removes it and plugs it into another machine.
Imagery in production
The recovery key
The one thing only you hold. It is the fallback when a PIN is forgotten or the hardware changes. If it is lost and the PIN is forgotten, the data cannot be recovered. That is the point, and it is why you save the key somewhere separate.
Biometric sign-in
Faster and harder to shoulder-surf than a typed password. The scan is matched on a secure chip on the device, not sent anywhere.
Find My Device
Remote lock and wipe let you act from anywhere. Lock shows a message and blocks access. Wipe erases the device the next time it connects.
Set up a new laptop or tablet safely
Do these steps in order the first time you sign in. Each one takes a minute or two, and you only do them once per device.
-
01
Confirm the disk is encrypted
Open Settings, then Privacy and Security, then Device encryption. It should already read On. The disk was encrypted at the factory, so there is nothing to wait for. If it reads Off, tap Turn on and leave the device plugged in until it finishes.
-
02
Save your recovery key
On the same screen, tap Recovery key, then Save. This is the code that unlocks the disk if you forget your PIN or the device asks for it after a hardware change. Save it to your Calyraen account, print it, or write it down and keep it somewhere away from the device. Do not store it only on the laptop itself.
-
03
Set up biometric sign-in
Go to Settings, then Sign-in options. Add a fingerprint or face scan, then set a PIN as the backup. The biometric data stays in a secure chip on the device and never leaves it. From now on you can sign in without typing your account password, and the password stays available if you ever need it.
-
04
Turn on Find My Device
Go to Settings, then Privacy and Security, then Find My Device, and switch it on. This lets you see the device on a map, play a sound, lock it, or erase it from another device or the web. It needs the device to be powered on and connected to a network to respond.
-
05
Test remote lock
From a phone or another computer, sign in to your Calyraen account and open Devices. Find this laptop, choose Lock, and set a short message with a contact number. Confirm it locks, then unlock it with your PIN. Now you know the feature works before you ever need it in a hurry.
-
06
Set updates to install on their own
Go to Settings, then Updates. Leave automatic updates on and choose active hours so restarts happen overnight. Security fixes then arrive without you thinking about it, for the full seven years the device is supported.
Sharing and fleets
Imagery in production
Parental and shared-device controls
You can hand a tablet to a child or share a laptop without giving up control. Create a separate profile per person under Settings, then Family. Set per-app limits, screen-time windows, and content ratings on the child profile. Approvals for new app installs come to the adult account first. Nothing here needs a cloud subscription. Controls are stored on the device and enforced locally.
Imagery in production
For schools and 1:1 fleets
If you manage student devices, do not set them up one by one. Enrol them through the Calyraen admin console before handing them out. Enrolled devices get their profile, apps, and restrictions applied on first sign-in, and you keep remote lock and wipe for the whole fleet from one screen. See the fleet notes on the Servers tab for enrolment steps.
Common questions.
No. The disk is encrypted so that no one, including us, can read it without your credentials. If the PIN is forgotten and the recovery key is lost, the only option is to erase and reinstall, which removes the data. This is why saving the recovery key somewhere separate is the most important first step.
The wipe command is queued and runs the next time the device connects to any network. If it never goes online, the data stays protected by encryption instead, so a stolen device with no network is still unreadable without your PIN or recovery key.
No. The device only reports its location when you ask for it from your account, and only if it is powered on and online. There is no continuous tracking running in the background, and the feature can be switched off in Settings at any time.
Related topics.
01
CalyOS Server setup
Set up a server safely
A CalyOS Server runs on-prem and stays yours. This walks you through the admin sign-in, backups, updates, directory join, and remote management so the machine is safe before it does real work.
Turn on the safety features on a server
Do these in order the first time you set up a server. Each step is quick, and most of the protection is already on. You are confirming it and writing down what you would need to recover.
-
01
Sign in as admin and turn on MFA
Sign in with the admin account you created during install. Open Server Settings, then Accounts, then Sign-in. Turn on multi-factor for every admin. Register a phone authenticator app or a hardware security key, then print the backup codes and store them somewhere off the machine. Do not leave the built-in admin account without a second factor.
-
02
Confirm disk encryption and save the recovery key
Open Server Settings, then Storage, then Encryption. The system and data volumes are encrypted from install. Check that each volume reads On. Click Save recovery key and send it to your key store or a sealed envelope. Without that key, a failed boot means the data stays locked.
-
03
Set the update window
Open Server Settings, then Updates. Choose a maintenance window when the server is quiet, for example Sunday 02:00. Turn on automatic security updates and let feature updates wait for your approval. CalyOS Server ships security fixes for seven years, so this window is where they land.
-
04
Join your directory
If you run a domain, open Server Settings, then Directory, then Join. Enter the domain name and an account allowed to join machines. Once joined, sign-in and permissions come from the directory, and you manage this server alongside the rest of the fleet.
-
05
Apply the security baseline
Open Server Settings, then Security, then Baseline. Pick the profile that fits the role, for example General or Hardened. Review the changes it lists, then Apply. The baseline closes unused ports, enforces strong sign-in, and turns on the audit log.
-
06
Turn on remote management
Open Server Settings, then Remote. Enable encrypted remote management and restrict it to your admin network or VPN. Confirm you can reach the server from an admin machine before you walk away from the console.
Backups
Backups you can restore from
A backup you have never restored is a guess. Set backups up on day one and test them.
- Schedule. Open Server Settings, then Backup. Choose what to protect, how often, and where copies land. Keep one copy off the server and, ideally, off-site.
- Encryption. Backups are encrypted with their own key. Store that key apart from the server, or a restore will fail when you need it most.
- Test restore. Once a month, restore a single file or a snapshot to a scratch location. This is the only way to know the chain works.
CalyOS Server keeps point-in-time snapshots so you can roll a volume back to a moment before a bad change or a ransomware event.
Two settings, most of the work
Imagery in production
Updates
Land in your window
Updates land in the window you picked. Security fixes install on their own; larger feature updates wait for your approval so nothing reboots mid-shift. You keep getting fixes for seven years from release.
Imagery in production
Baseline
A known state to return to
The baseline is a named security profile you can re-apply any time. If a server drifts, open Security, then Baseline, and Apply again to bring it back to a known state. The audit log records who changed what, which matters when more than one admin has keys.
Recovery
Remote lock and recovery
A server is rarely next to you, so plan for the day you cannot reach the console.
- Remote management over an encrypted channel lets you sign in, patch, and reboot from an admin machine. Keep it behind your VPN, not the open internet.
- Recovery keys for disk and backups belong in a store the server cannot reach. If the machine is stolen or its disk is pulled, the data stays encrypted and useless without them.
Common questions.
What happens if an admin loses their second factor?
Use the printed backup codes you saved during MFA setup to sign in, then register a new phone or security key. If you kept a second admin account with its own MFA, that account can also reset the first. This is why we ask you to keep backup codes off the machine and to enroll more than one admin.
Do updates reboot the server on their own?
Security updates install inside the maintenance window you set, and only reboot if a fix requires it. Larger feature updates wait for your approval, so they never restart the machine during a busy shift. You can also mark a server to always ask before rebooting.
Do I need a domain to run a CalyOS Server?
No. A standalone server works with local admin accounts and MFA. Joining a directory is for shops that already run a domain and want one place to manage sign-in and permissions across many machines. You can join later without a reinstall.
Related topics.
Imagery in production
Embedded and edge setup
A sealed appliance
An embedded or edge unit ships as a closed appliance. There is no desktop and no end-user login. Setup is about confirming it only runs firmware Calyraen signed, keeping it current, and handing control to your management console.
Confirm signed firmware and lock it down
Embedded and edge units are meant to run one job and nothing else. You do most of this once, from the local console screen or over SSH on first boot, then never touch the box again. Work through these in order.
-
01
Confirm secure boot is on
Open the local menu (hold the recessed button while powering on, or connect over the setup SSH port shown on the label). Look under Security for Secure Boot Enabled and Firmware signature Calyraen. This means the unit refuses to load any firmware image we did not sign. It is on from the factory. If it reads Disabled, the box may have been tampered with in transit, so stop and call support before you deploy it.
-
02
Verify the running firmware version
On the same screen, note the firmware build and check it against the current build shown in your management console or on the product page. Embedded units get security fixes for seven years from release. If the box has sat in storage, let it pull the latest build now before it goes into service.
-
03
Turn on automatic updates
Set Updates to Automatic and pick a maintenance window that suits the site, for example 3am local. Edge units apply updates as an A/B swap: the new image installs to a spare slot and the box only switches over if it boots cleanly, so a bad update rolls itself back. You do not need to babysit it.
-
04
Close unused ports and remove default accounts
Under Access, disable any interface the job does not need: USB data ports, the debug serial header, unused network ports, and Wi-Fi if it runs on wired. Delete or disable the factory setup account once your management enrolment works. An appliance with no login is one less thing to attack.
-
05
Enrol it in remote management
Point the unit at your Calyraen fleet console with the enrolment code from the console, or scan the QR on the label. Once it checks in you can see its health, push config, lock it, or wipe it remotely. Confirm it shows as Managed and online before you leave the site.
## What "no end-user accounts" really means
An embedded or edge appliance is not a small PC you log into. It boots straight into its one job: a sensor gateway, a controller, a signage driver, a local inference box. There is no desktop, no browser, no general sign-in.
That changes how you keep it safe:
- There is no password to phish because there is no interactive user. Access is either physical, at the setup console, or through your management console over an authenticated channel. - The attack surface is whatever you leave open. Every port, radio, and service you do not disable is a door. The defaults are conservative, but a real deployment should turn off everything the job does not use. - Trust starts at the silicon. Secure boot checks each stage against a Calyraen signature before it runs, so a swapped or modified firmware image simply will not start.
## Updates without a person present
These boxes often live somewhere no one visits: a cabinet, a pole, a factory floor. So updates have to be safe to apply blind.
- A/B images. A new build installs to a second slot. The unit boots it, confirms it came up healthy, and only then makes it permanent. A failed image rolls back to the last good one on its own. - Signed all the way. The update itself is signed, so a box will not install a package that did not come from us. - Seven years. Each embedded model gets security updates for seven years from its release date. Plan replacement around that, not around a subscription lapsing.
## Fleet control from one place
Enrolment is the step that turns a lone box into part of a managed estate. From the fleet console you can group units, push a config to all of them, watch health and uptime, and lock or wipe any unit that goes missing. Keep the enrolment codes and any recovery keys in your own records, not on the device.
Common questions.
Use the setup channel printed on the label. Most edge units expose a local SSH port on first boot, or a small config web page on a fixed address when you connect a laptop directly. Once the unit is enrolled in the fleet console you do the rest remotely and never need to touch it physically again.
Open the fleet console, find the unit, and issue a remote lock or wipe. If it is offline it carries out the command the next time it connects. Because storage is encrypted at rest, the data on a powered-off unit is not readable without the key, which is held by you and not stored on the device.
Embedded units run signed Calyraen firmware only, and secure boot will refuse anything else, so you cannot swap the OS. You can run your own workload inside the supported container or application slot the model provides. If you need a fully open machine, an edge server or a desktop is the better fit.
Related topics.
Kiosks and displays
Locked to one app
A kiosk runs one app in a public place, with the rest of CalyOS hidden from view. This page shows you how to lock it to that single app, keep it patched overnight, and watch it from a distance.
Put a kiosk into single-app lockdown
Kiosk mode turns the whole screen over to one app and blocks everything else. No desktop, no settings, no way out without your admin key. Set it up on a bench first, then take it to the floor.
-
01
Sign in as the admin
Boot the kiosk and sign in with your admin account, not the account the public will use. If this device is enrolled in your fleet, do this step from the CalyOS management console instead and skip to the policy. Local setup and remote setup end in the same place.
-
02
Choose the single app
Open Settings, then Kiosk. Pick the one app the kiosk should run. This can be a web page in kiosk browser mode, a point-of-sale app, or a check-in app you wrote. CalyOS launches it full screen at boot and relaunches it if it ever closes.
-
03
Lock the exits
Turn on Hide system UI. This removes the taskbar, hides the clock and tray, and swallows the key combinations people use to escape a kiosk. Set the gesture or key that brings back the admin sign-in, and make it something the public will not find by accident.
-
04
Set the auto-return
Under Idle, set how long the kiosk waits after the last touch before it clears the session and returns to the start screen. Thirty to sixty seconds suits most counters. This wipes the previous person's cart, search, or form so the next person starts clean.
-
05
Confirm the lock holds
Sign out to the kiosk session. Try to reach the desktop: swipe from every edge, press the usual escape keys, pull the network cable. You should stay inside the one app. When nothing gets you out except your admin gesture, the lock is holding.
-
06
Enrol for remote care
Before it leaves the bench, enrol the kiosk in your management console so you can update, lock, and check on it later. A kiosk you cannot reach remotely is a device someone has to visit in person every time.
Lockdown
What lockdown does and does not do
Single-app lockdown is a fence, not a vault. It stops the ordinary passer-by from reaching the desktop, changing settings, or opening another app. The disk underneath is still encrypted, and the app still runs as a limited user with no admin rights.
- The app is the boundary. Whatever the single app can do, the public can do. If it is a browser, restrict it to your own sites with an allow-list so nobody wanders off to the open web.
- Physical access is separate. Lockdown protects the software. Ports, cables, and the power button are up to the enclosure. Cover or disable USB ports on a device the public can touch.
- One account, no data left behind. The kiosk session is disposable. Auto-return clears it, so no card, no search, no form survives to the next person.
Updates, health, and PCI
Imagery in production
Patch out of hours
Set an update window for the quiet part of the night. CalyOS downloads in the background, applies the update in the chosen hour, restarts, and comes back in the same locked app. It will not reboot during trading if you set the window correctly, so set it.
Imagery in production
Watch from the console
The management console shows each kiosk: online or offline, on the right app, patched or behind, disk healthy or failing. Turn on alerts so an offline screen or a full disk reaches you before a customer notices.
Imagery in production
If you take card payments
If you take card payments, the kiosk is in scope for PCI DSS. CalyOS gives you the encryption, the locked single app, and audit logging that a PCI review asks for, but scope also covers your network, your payment app, and your card reader. Treat CalyOS as one part of that review, not the whole of it.
Imagery in production
Accessibility
Public devices should reach everyone. CalyOS carries screen reader, high-contrast, and larger-text options into kiosk mode. Leave a visible way to turn them on, and mount at least one screen at a reachable height.
Common questions.
Not through the software if lockdown is set correctly. Hide system UI blocks the taskbar and the usual escape keys, and only your admin gesture returns to a real sign-in. Always test this on the bench by trying every escape yourself before the device goes public. Then handle the physical side with the enclosure and by disabling exposed ports.
No single product does that. CalyOS provides the encryption, single-app lockdown, and logging that a PCI DSS review expects from the device. Compliance also depends on your network, your payment app, and your card reader, so treat the kiosk as one part of the assessment.
No, not if you set the update window to a quiet hour. CalyOS downloads patches in the background and only restarts to apply them inside the window you chose. Point it at the middle of the night so the screen is back in its locked app long before you open.