The engagement

Fixed scope. Fixed price. Eight weeks.

Most embedded platform work is sold by the hour, which means you carry the schedule risk and find out what it costs afterwards. We scope it up front instead: one price, one date, and a defined list of what lands on your board at the end of it.

  1. Weeks 1–2

    Board bring-up & base image

    A Yocto layer for your board, a kernel config trimmed to what you actually ship, and a minimal mostly read-only root filesystem. The build is reproducible and running in CI before we go further.

  2. Weeks 3–4

    Secure boot & root of trust

    A verified chain from power-on to userspace — signed U-Boot or UEFI, signed and integrity-checked rootfs, an encrypted data partition, and a key-management scheme where the signing keys are yours, not ours.

  3. Weeks 5–6

    Updates and the patch pipeline

    A/B updates with automatic rollback via RAUC, delta payloads for constrained links, and writes that are safe against power loss mid-update. Plus an SBOM out of the build and a CVE feed against it, so you know what needs patching before a customer asks.

  4. Weeks 7–8

    AWS IoT onboarding & handover

    Zero-touch provisioning with per-device certificate identities, onboarding to AWS IoT Core with device shadows and telemetry, one fleet-wide update campaign run end to end, then documentation and a live handover to your team.

What you own on day 57

  • Your Yocto meta-layer, in your Git organization
  • A reproducible CI pipeline that rebuilds the image from scratch
  • A signed boot chain — with your signing keys, held by you
  • A/B OTA with automatic rollback and delta updates
  • AWS IoT onboarding, provisioning, and a device-shadow schema
  • A cross-compiled SDK so your app developers never touch the OS build
  • Written documentation and a recorded handover session

Pricing is agreed in writing before work begins, following an initial scoping consultation at no cost. Any material change to scope is requoted and approved by you before it proceeds.

What it doesn't include

Your application

The product logic is yours. We give your developers an SDK and a target that behaves the same on their desk as in the field.

Board design

We bring up and harden the hardware you have — or source and configure something suitable. We don't design PCBs.

Certification testing

We build toward IEC 62443 and CE/EMC requirements and hand you the evidence, but an accredited lab issues the certificate, not us.

Or tell us what you actually need

The package covers the common case. If yours isn't that, the first call is the same free scoping call — we'll tell you what the work is and quote it.

Image customization only

You already have the cloud side handled and just need the OS image done properly — trimmed, hardened, reproducible, and yours to rebuild.

Onboarding an existing fleet

The devices are already shipping. You need them onto AWS IoT with real per-device identities, telemetry, and a way to push updates.

Software help alongside it

Application work, protocol integration, a Yocto build that someone else left broken, or a second opinion before you commit to a board. Tell us the problem and we'll scope it.

Not ready to commit? Start with an audit

One week

A fixed-fee, one-week assessment of your board and current build: BSP state and kernel provenance, CVE exposure, secure-boot and update readiness, and whether it's buildable and maintainable for the long haul. You get a written report and a firm, fixed-price quote for the work it turns up — and if you go ahead with a build, the audit fee is credited toward it.

  • • Board & BSP assessment
  • • CVE / security exposure
  • • Written report + fixed quote

After week 8

A device you ship for ten years needs kernel CVE backports, a Yocto LTS migration every couple of years, and someone to run update campaigns when a fix has to reach the whole fleet. That's an ongoing maintenance agreement, priced per year — and it's optional. Everything above is yours whether or not you take it.