Computers and devices

Every desk, the same machine.

A managed desktop fleet on CalyOS Desktop. Each one arrives imaged, encrypted and joined to your directory before it ships, so every seat is the same known machine and you run all of them from one screen.

Talk to engineering See all solutions

The problem

No two machines end up alike.

Most offices grow their desktops one purchase at a time. Someone buys a consumer PC from a shop, sets it up by hand, installs whatever the last person asked for, and passes it along. Six months on, no two machines match. Windows versions drift apart. Half of them carry a local admin account nobody is tracking. Drives sit unencrypted, and when a laptop goes missing there is no way to wipe it. Patching is whatever each person clicks. When a machine breaks, rebuilding it eats an afternoon, because there is no image to fall back on.

More IT hours will not fix this. Treating desktops as a fleet will: one signed image, one directory, one console, and every seat identical the day it ships and every day after.

Design targets

Numbers we build to.

< 20 min Network reimage to known-good

XTS-AES-256 Full-disk encryption, TPM sealed

CIS L1 Security baseline out of the box

5 yr Support and parts on the fleet

The system

One image, one directory, one console.

Imagery in production

The standard image

Every desk ships from staging with the same sealed, signed image.

Every desktop leaves staging with one sealed image: CalyOS Desktop, your office apps, printer and VPN profiles, and the security baseline already applied. Nothing is hand-built at the desk, so nothing drifts. The image is content-addressed and signed. A machine whose checksum does not match the record never joins the fleet, which keeps a tampered or half-finished build away from your users. A reimage over the network takes under 20 minutes and puts any seat back to known-good. You can keep more than one image, say a standard office role and a design role, and a machine gets the right one from its directory group.

Imagery in production

The directory join

On first boot the desktop joins your directory, the way a Windows machine joins a domain.

The user signs in with the same account they use for mail and files. There is no separate local password to reset and no orphaned local admin account left behind. Group membership decides what the machine looks like. A finance desk and a reception desk get different apps, different drive mappings and different rules, and nobody touches either one by hand. Policy lands before the first login, so the seat is compliant the moment it switches on. When someone leaves, disabling their directory account locks every desktop they could reach. There is nothing local to clean up.

Imagery in production

The management plane

A light agent checks in every 15 minutes and reports the truth about each machine.

It reports hardware, installed software, encryption status and patch level, so you read the whole fleet off one screen instead of asking people what they are running. From that same console you push updates in a controlled window, lock a screen, wipe a lost machine, or trigger a full network reimage. Every action is logged with who did it and when, which is what an auditor asks for. The plane runs on your CalyOS Server, or as a managed service we operate for you. Either way the data stays under your directory and your control.

How it works

Imaged before it leaves us.

From your order to a working desk, the build happens in staging, not at your office. Your team plugs in and signs in.

You tell us the roles

Give us the seats you need and what each one does. We turn that into golden images, one per role, with your apps and your security baseline built in.
We seal, sign and join

Each machine is imaged in staging, its checksum recorded, and set to join your directory on first boot. Encryption and the CIS L1 baseline are on before it ships.
Your team signs in

Unbox, plug in, sign in with a normal account. The seat is compliant from the first login, and every desk you add later works the same way.

Built for this fleet

The seats we configure.

Two desktop bodies and the peripherals that ship with them, all imaged and joined before they reach you.

Imagery in production

Compact

Vale Desk Mini

1L chassis, 8 core, 16 to 64 GB, 512 GB to 2 TB NVMe, 2.5 GbE, TPM 2.0

A one-litre desktop that hides behind a monitor or clips to a VESA arm. Right for reception, call desks and hot-desk banks, where space is short and the work is office work.

Request datasheet

Imagery in production

Tower

Vale Desk Tower

Micro-ATX, 12 core, 32 to 128 GB ECC, dual NVMe, discrete GPU option, 500 W 80 Plus

An expandable tower for finance, engineering and design seats that need more memory, a graphics card or a second drive. Tool-free access, so a part swap is minutes instead of a rebuild.

Request datasheet

Imagery in production

Peripherals

Vale Display 24

24 inch, 1920 x 1200, 100 Hz, USB-C 65 W power delivery, height and pivot stand

One USB-C cable carries video, power and USB to the Mini, so the desk has a single wire. Matte panel, and a stand that raises, tilts and pivots for a healthy sitting position.

Request datasheet

Imagery in production

Peripherals

Vale Input Set

Quiet membrane keyboard and 4000 dpi mouse, USB-A receiver, replaceable AA cells

A wireless keyboard and mouse paired to one receiver at staging, so the user has nothing to set up. AA cells instead of a sealed battery mean the set lasts as long as the desktop.

Request datasheet

Your call

Run the console your way.

Imagery in production

On your server

Keep it in the building

The management plane runs on your CalyOS Server. Your fleet inventory, patch state and logs stay on hardware you own, behind your own directory.

Imagery in production

Managed by us

Let our team run it

Prefer not to host it? We operate the plane as a managed service and keep it updated and healthy. The data still sits under your directory and your control.

Talk to engineering

Questions

What buyers usually ask.

How fast can we get a broken desk back?

A network reimage returns any seat to a known-good state in under 20 minutes. There is no per-machine build sheet to work through.

What happens to a lost laptop?

Every drive is encrypted with XTS-AES-256 and sealed to the TPM. From the console you can wipe a missing machine, and disabling the person's directory account locks every desktop they could reach.

Do we have to host the management plane?

No. It runs on your CalyOS Server if you want to hold it yourself, or as a managed service we operate. Either way the data stays under your directory.

Can different teams get different setups?

Yes. You can hold more than one image, one per role, and a machine gets the right apps, drive mappings and rules from its directory group. Nobody configures a desk by hand.

Is the fleet supported long term?

Support and parts run for five years across the fleet, and the security baseline ships at CIS L1 from the first boot.

“A desktop should be identical the day it ships and every day after. If a seat needs a build sheet, we have already failed the buyer.”

Our fleet engineering standard

Ready when you are

Roll out one fleet.

Tell us how many desks you run and what each one does. We will size the images and send back a plan you can read in one sitting.

Talk to engineering See all solutions

What is included

Everything the desk needs.

A seat is not just a box. It is the machine, the image, the applications your people actually use, and the paperwork to keep it running for years. All of it is set before it ships.

In the box

What each seat carries.

Ready to sign in

Imaged

The desktop arrives with CalyOS Desktop, your office suite, browser, mail and line-of-business apps installed from the sealed image. Printer and VPN profiles are already in place. The user switches it on, signs in with their directory account, and works.

Imagery in production

The machine

A Vale Desk Mini or Tower configured to the role, with TPM 2.0, Secure Boot and full-disk encryption set from the factory.

The image

One signed CalyOS Desktop image per role, so the design seat and the reception seat differ by policy, not by a hand build.

The baseline

CIS Level 1 hardening, no local admin, disk encryption on and BitLocker-style recovery keys escrowed to your directory.

The cover

Five years of parts and next-business-day support, plus asset tags and a serial register handed over on day one.

How each seat is supplied

1 Sealed image applied

0 Local admin accounts

< 15 W Idle draw, Mini

5 yr Parts and support

Pick by role

Three ways we build a seat.

Same image and management on all three. The difference is the body and what runs on it.

Desk

Standard office

Vale Desk Mini, 16 GB, 512 GB. Mail, browser, office suite and your line-of-business apps. The volume seat for most of a building.

Power

Finance and engineering

Vale Desk Tower, 32 to 64 GB ECC, dual monitors. Spreadsheets that never end, drawing packages and local databases.

Shared

Hot desk and kiosk

Vale Desk Mini locked to a shared account, auto-wiped between sessions, no data left at rest. For touchdown benches and shared rooms.

Specify it with us

Build your standard seat.

Tell us your roles and your apps and we will define the images and the bill of materials. You approve one seat, we ship the fleet.

Talk to engineering OEM & ODM

Under the hood

Managed, not trusted.

Imagery in production

Identity

One account, no local doors

Every desktop joins your CalyOS directory and users sign in with their central account. There are no standing local admin accounts and no shared passwords on a sticky note. Rights come from directory groups, so promoting or removing access is one change in one place. Disable a leaver once and every machine they could reach locks with them.

Imagery in production

Encryption

Sealed to the machine

Full-disk encryption uses XTS-AES-256 and the key is sealed to the desktop's TPM 2.0, so a drive pulled out and put in another body reads as noise. Recovery keys are escrowed to your directory, not to the user, so a forgotten passphrase is a two-minute unlock for IT and not a lost machine. Secure Boot blocks an unsigned operating system from starting on the hardware.

Imagery in production

Control

Patch, lock, wipe from here

The management console shows live patch state across the fleet and pushes updates in a window you choose, so a bad update never hits everyone at once. A lost or stolen desktop is locked or wiped remotely on its next check-in. Software installs come from an approved catalogue rather than a user download, and every administrative action is logged with a name and a timestamp.

Assessed against

The standards it meets.

The baseline maps to the frameworks an auditor and an insurer actually ask about.

Hardening

CIS Benchmark L1

The default image ships hardened to CIS Level 1 for the desktop OS, with the settings documented so you can show what was applied and why.

Attestation

Cyber Essentials

No local admin, patching in policy, disk encryption on and a managed firewall line up with the Cyber Essentials controls, which cuts the certification paperwork.

Data

GDPR at rest

Drives are encrypted to XTS-AES-256 and wipe on command, so a lost desktop is a hardware loss and not a reportable data breach under UK GDPR.

Security posture

TPM 2.0 Hardware root of trust

100% Drives encrypted at rest

< 24 h Window for critical patches

0 Standing local admin rights

Engineering questions

The details IT checks.

Can we keep our existing directory and identity provider?

Yes. CalyOS Desktop joins your directory the way a Windows machine joins a domain, and it can federate to your existing identity provider for single sign-on. You do not replace what you have.

What happens to a stolen laptop before it connects again?

The disk is already encrypted and sealed to that machine's TPM, so the data is unreadable offline. The remote wipe fires the next time it touches any network, and until then the encryption is the protection.

Do users get local admin for the odd install?

No standing local admin. Approved software comes from the managed catalogue, and a one-off elevated task can be granted for a set time and logged, so nobody carries permanent admin they forget about.

“Our insurer wanted encryption at rest, patch evidence and no local admin. The fleet gave us all three on one report instead of a spreadsheet we maintained by hand.”

Head of security, mid-market insurer

How we land it

A rollout without an afternoon per desk.

The slow part of new desktops is never the hardware. It is the human hours of building each machine, chasing licences, and standing over a user while they sign in. We move that work off the desk and into staging. You approve one standard seat. We image the fleet against it, join each machine to your directory, tag and register every asset, and ship them boxed by floor or by team. On the day, a machine comes out of the box, goes on the desk, and the user signs in with the account they already have. A technician is not needed at each seat. If a machine ever fails, a network reimage returns it to the same known-good state in under twenty minutes, so a broken desktop is a swap and not a rebuild.

Rollout

From order to desk.

Define the seat

We sit with IT, agree the roles, the applications and the baseline, and build one image per role. You sign off a single standard machine.
Image and join

Every desktop is imaged against the approved build, joined to your directory, encrypted, asset-tagged and entered on the serial register in staging.
Ship by team

Machines arrive boxed and labelled by floor or department, with peripherals paired, so unpacking follows your seating plan and not a pile in reception.
Sign in and go

The user powers on, signs in with their directory account, and policy is already applied. No local setup, no build sheet, no technician at the desk.
Run and refresh

The console keeps the fleet patched and inventoried. When a machine fails or a hire starts, a reimage or a spare from stock returns a known-good seat the same day.

The difference

Fleet, not a pile of PCs.

Calyraen managed fleetShop-bought PCs

Setup per machine Imaged in staging, signed in at the desk Built by hand, an afternoon each

Identity Directory join, one central account Local accounts and shared passwords

Encryption On by default, key escrowed to IT Off unless someone remembers

Patching Controlled window from one console Whatever each user clicks

Lost machine Remote lock and wipe on next check-in No way to reach it

Rebuild Network reimage in under 20 min Reinstall from scratch

Specify it with us

Plan your rollout.

Give us the seat count and the floor plan and we will scope the images, the staging and the delivery. You get a date and a fixed price per seat.

Talk to engineering OEM & ODM

Resources

Read it before you buy it.

The briefs, the baseline and the cases behind the fleet. Open any card for the detail, or request the files for your own review.

Reading room

Briefs and real rollouts.

What we hand IT and procurement when they evaluate the fleet. Open a card for the summary.

Two-page brief

Imagery in production

The managed desktop brief

How the fleet model works

Image, directory, console What ships and what it costs For IT and procurement

Baseline sheet

Imagery in production

The security baseline

Every setting, documented

CIS L1 mapping Encryption and TPM detail Cyber Essentials cross-reference

Use case

Imagery in production

120 seats in one weekend

Professional services rollout

120 desks, three floors Deployed over a weekend Zero technician time at desks

Use case

Imagery in production

A laptop went missing

Lost device, no breach report

Device lost off-site Encrypted, sealed to TPM Wiped on next connection

Request the files

Take it to your team.

We send these on request so we can point you at the right build for your seat count and your directory.

Managed desktop brief and per-seat pricing Brief PDF, on request CalyOS Desktop security baseline sheet Baseline PDF, on request Vale Desk Mini and Tower datasheets Datasheet PDF, on request

Specify it with us

Standardise your desks.

Send us your seat count and your apps and we will come back with the images, the bill of materials and a price per seat. One approval, one fleet.

Talk to engineering OEM & ODM

Every desk, the same machine.

No two machines end up alike.

The standard image

The directory join

The management plane

You tell us the roles

We seal, sign and join

Your team signs in

Vale Desk Mini

Vale Desk Tower

Vale Display 24

Vale Input Set

Keep it in the building

Let our team run it

Roll out one fleet.

Everything the desk needs.

Imaged

The machine

The image

The baseline

The cover

How each seat is supplied

Standard office

Finance and engineering

Hot desk and kiosk

Build your standard seat.

One account, no local doors

Sealed to the machine

Patch, lock, wipe from here

CIS Benchmark L1

Cyber Essentials

GDPR at rest

A rollout without an afternoon per desk.

Define the seat

Image and join

Ship by team

Sign in and go

Run and refresh

Plan your rollout.

Read it before you buy it.

The managed desktop brief

The security baseline

120 seats in one weekend

A laptop went missing

Standardise your desks.