Name: Firmware Security — ceremony-signed, grant-gated distribution
Brand: CRM Sync
SKU: firmware-security
Price: 1900.00 USD
Availability: InStock

Shield with chip core — protected firmware vault, monochrome line art

Firmware Security — ceremony-signed, grant-gated distribution

$1,900.00

A locked vault for distributing firmware and software updates — encrypted, logged, and revocable. It replaces the download link you use today: your update is never a file anyone can grab, it's released only to machines you authorize, one at a time, and every event is written to a record you can prove.

How it works

Every build is sealed into the vault encrypted — a new version is a new record, never an overwrite.
Each upload comes back with a signed certificate binding product, version, digest, and parts-list.
Releases go out one grant at a time, to devices you authorize — every grant, denial, and served byte lands in the ledger.

What makes it different

A storage link, once shared, is shared forever. Here the link is replaced by a grant — and a suspected leak is healed by rotating a key, not by recalling devices.

Under the hood

AES-256-GCM per-image encryption; Ed25519 upload certificates anyone can verify against the published public key — no account, no trust in the platform required; a hash-chained access ledger; per-device attestation grants. The evidence chain CRA Article 14 reporting presumes.

Preview the vault wizard → — browse the Upload, Access, SBOM, Embed, and Vault tabs before you buy; it unlocks the moment your order is paid.

Open the Channel Wizard →

Mint an attributed link or QR for this product — preview it free in the modal; minting unlocks with the Channel Publish add-on.

Distribute firmware through an encrypted vault: ceremony-signed images, released only under per-device attestation grants. The link becomes a grant — and you choose whether we hold the keys or you do.

What you get

✓The firmware vault — AES-256-GCM per-image encryption, certificate-tracked uploads, grant-gated verified downloads.
✓An Ed25519 certificate per image — binding product, version, digest, and SBOM.
✓A hash-chained access ledger — every grant, denial, and served byte-stream.
✓Key rotation — heals a suspected leak without a recall.
✓Two ways to run it — hosted, where the vault is a capability on your account; or self-hosted, where the worker, the object store and the master key all live in your own Cloudflare account. In the second, we cannot decrypt your images even if we were compelled to.
✓Priced as a posture, not a purchase. $1,900 to deploy — the key ceremony, your DNS and namespace rules, your first vaulted image, and the runbook your team keeps. Then $300/month, invoiced directly; or $480/month delivered as an app installed against your Shopify instance, so it sits with your other apps and lands on the bill you already pay — no new vendor to onboard, no new purchase order, cancel from your admin. There is no one-time price, because there is no one-time security: the calendar keeps moving, the dependencies keep changing, and a fee that ends implies a diligence that ended with it.

Firmware distribution is usually a signed installer behind a storage link — a URL that, once shared, is shared forever, with no record of who fetched it or when.

Self-hosted, precisely. You run the worker in your own Cloudflare account: your R2 bucket holds the ciphertext, your KV holds the wrapped keys, and the master secret is set with wrangler secret put by your own staff. We never see it. Your security review is then reviewing your own infrastructure, not ours — which is usually the difference between a two-day approval and a two-quarter one. Priced as a licence plus a deployment engagement rather than a SKU; the durable ledger mirror can run on a Xano instance we provision in your account, or on a Postgres you already own.

Anyone verifies any certificate against the published public key at /.well-known/jwks.json — no account, no trust in the platform required. It is the evidence artifact CRA Article 14 reporting presumes. Verify a certificate now → — paste any certificate, check it in your browser, no sign-in.