01 · Malware that persists
Immutable by design
On a writable OS, ransomware and drive-by installs survive reboots and spread. SecureOS boots a signed, read-only root — malware can't take hold, and every boot is known-good.
SecureOS · Immutable Linux OS
The endpoint OS that can't be tampered with.
SecureOS is an immutable Linux OS for secure thin clients, kiosks and edge devices — signed and read-only so it can't be tampered with, unbrickable by updates, and managed from one console, on x86 and ARM.
- Signed read-only root
- A/B OTA · auto-rollback
- x86 + ARM
- Citrix · VMware Horizon
Everything an endpoint OS should be
- Immutable rootSigned, read-only SquashFS
- A/B updatesSigned kernel + filesystem, reversible
- Self-healing3-layer auto-rollback
- USB controlPer class and vendor, at the port
- LockdownNo root shell, locked GRUB
- Factory restoreOne-step wipe to known-good
- VDI clientsCitrix and VMware Horizon built in
- Remote managementOTA, admin UI, AD / LDAP login
The challenge → the answer
Endpoints are the soft underbelly of the fleet.
02 · Configuration drift
Locked down
Writable devices slowly diverge until they're impossible to support or audit. With no root shell, controlled apps and USB policy enforced at the port, every SecureOS endpoint stays identical.
03 · Risky updates
Unbrickable
A bad patch can brick a remote device and force a truck-roll or a full re-image. A/B slots with automatic rollback mean a failed update can never strand a device.
04 · Aging fat clients
Remotely managed, on any hardware
Heavy desktop OSes on old PCs are slow, costly and exposed. SecureOS turns any x86 or ARM machine into a locked-down endpoint, updated over signed OTA from one console.
Embedded architecture
Layers you can trust, verified from the silicon up.
Signed boot, an immutable read-only OS, an isolated overlay, a hardened lockdown layer and a controlled desktop — each verified as the device boots.
- hardware x86 / ARM platform up
- boot signed chain · GRUB locked
- rootfs slot A read-only · signature valid
- overlay writable layer · ephemeral
- lockdown usbguard · firewall · no root shell
- session thin-client desktop ready
- Hardwarex86 · ARM (Pi / Nano boards)
- Secure boot + GRUBPassword-locked bootloader
- Immutable root · A/B SquashFSTwo signed, read-only OS slots
- Writable overlayEvery change isolated here
- Lockdown layerusbguard · firewall · no root shell
- Desktop / thin-clientCitrix · Horizon · approved apps
Backend & root lockdown
Locked to the core. Nothing sticks.
The root filesystem is signed and read-only. Ransomware, malware and unauthorized writes bounce off — every change lands in an overlay that a reboot wipes back to known-good.
Restore to factory
Back to known-good in one step.
One action wipes the overlay back to the signed factory image. The read-only root is never touched — ideal for shared terminals and kiosk hygiene.
Ransomware-proof endpoints
Nothing to hold hostage.
On a normal OS, ransomware encrypts and persists. On SecureOS it can only touch the throwaway overlay — a reboot restores the signed image, and there is nothing to ransom.
USB & peripheral locker
Every port under policy.
Granular by device class and vendor, enforced the moment a device is plugged in: keyboards, smart-card readers and printers work; USB storage is blocked; webcams only from an approved vendor.
USB policy engine · usbguard
- Keyboard / mouseHID input always allowedCheckingAllowed
- USB pendriveMass storage blockedCheckingBlocked
- Smart-card readerAuth tokens permittedCheckingAllowed
- USB hard driveMass storage blockedCheckingBlocked
- Webcam · unknownCameras blocked by defaultCheckingBlocked
- Webcam · approvedApproved vendor onlyCheckingAllowed
- allow
class:HID# keyboard, mouse - allow
class:smart-card# auth tokens - allow
class:printer - block
class:mass-storage# pendrive, hard drive - allow
class:video vendor:approved - block
class:video# any other webcam
A/B remote updates · phase 1 of 4
Updates that can't brick a device.
A new kernel and root filesystem are written to the spare slot while the device keeps running, untouched, on the active one.
Phase 2 of 4 · verify
Signed, or it never switches.
The image's RSA-4096 signature and integrity are verified on-device before anything is applied. A tampered build simply never boots.
Phase 3 of 4 · switch
One reboot to switch.
The bootloader activates the new slot. The previous slot stays intact as the last-known-good fallback.
Phase 4 of 4 · self-healing
Three guards. Zero bricked devices.
A GRUB boot counter, an initramfs fallback and a userspace watchdog each catch a bad boot. Three strikes and the device rolls back by itself — no truck-roll, no re-image.
UI-based admin control
Manage the whole OS from one panel.
TcManager, the on-device Thin Client Manager, puts VDI clients, certificates, network, users, AD domain join, USB control, OTA and factory reset in one place.
SecureOS
- Dashboard
- Certificates
- VMware Horizon
- Citrix
- Network
- USB Control
- Users
- OTA Update
- AD / LDAP login
- Factory Reset
System & OTA
Thin-client mode- Active slot
- A · v1.0.0
- Standby slot
- B · v1.0.0
- Mode
- Thin-client
- USB
- Locked · HID allowed
ota › checking signed update server… current build v1.0.0 · signature verified
Managed at fleet scale.
Signed OTA server
Push kernel + filesystem builds fleet-wide; every image is verified on-device before it is applied.
Central configuration
Policies, the admin password, USB rules and settings — managed centrally, synced to each device.
Fleet visibility
Pairs with DeviceManager endpoint management for inventory, monitoring, alerting and remote support.
Productivity
A day without interruptions.
Lockdown that makes users faster: only approved apps, nothing to break or infect, recovery in minutes — and hot-desking, where any user gets the same desktop on any device in seconds.
Standard fat client≈ 2–3 hours of the day lost to interruptions
SecureOS thin client0 interruptions — every hour is productive
Slow boot
Forced update
AV scan
Malware alert
IT ticket
Re-image
Instant boot
Uninterrupted work
Self-heals if needed
Illustrative — a typical knowledge-worker day.
The productivity math
~10sPower-on to VDI / desktop
0Downtime from malware
~5 minTo fully recover a device
99.9%Endpoint uptime
Work hours lost per device, per year
Standard endpoint~40 hrs
SecureOS~4 hrs
Illustrative figures — actuals vary by environment.
Defense in depth · security proof
Not a single wall — many.
Signed boot, a read-only root, least privilege, peripheral control and signed self-healing updates. An attacker has to defeat every layer — and every threat meets a matching control.
A fraction of the attack surface
- Read-only OS
- Minimal footprint
- RSA-4096 signed images
- No root shell
- Password-locked GRUB
- Default-deny inbound firewall
- 1Signed boot · locked GRUB
- 2Read-only signed root
- 3Least privilege · no root shell
- 4usbguard peripheral control
- 5Signed OTA · auto-rollback
- Endpoint and data — reached by nothing
Every threat, a matching control.
- 01
Ransomware / malware persistence
Read-only signed root; every change confined to an overlay a reboot wipes
- 02
USB data theft / BadUSB
usbguard policy by device class and vendor; HID keyboard/mouse allow-listed
- 03
Tampered or malicious update
RSA-4096 image signature verified on-device before anything is applied
- 04
Configuration drift / tampering
Immutable OS — the base image cannot be modified, only the overlay
- 05
Bad patch bricking a device
A/B slots with an automatic three-strike rollback
- 06
Boot / physical tampering
PBKDF2 password-locked GRUB; Secure Boot-capable signed chain
- 07
Network attacks / remote exploits
Built-in default-deny firewall blocks all inbound requests; no exposed services
- 08
Local privilege escalation
No root shell; least privilege; systemd-sandboxed services
Built for compliance.
Immutability, least privilege and signed updates map directly to recognised security frameworks — and give regulated teams audit-ready technical controls.
Maps to
- NIST SP 800-53
- NIST SP 800-193
- CIS Benchmarks
- Zero trust · assume breach
Supports compliance with
- RBI
- SEBI CSCRF
- CERT-In
- DPDP
- PCI DSS
- HIPAA
Audit-ready technical controls that support compliance. Formal certification is a separate, third-party engagement.
Hardware & VDI
Turn any PC into a secure thin client.
Repurpose old PCs as thin clients or deploy low-cost ARM boards, with native Citrix and VMware Horizon clients and single sign-on from your existing directory. Extend hardware life, cut desktop-OS licensing and reduce e-waste.
Aging x86 PCrepurposed
ARM boardPi / Nano class
SecureOSimmutable · signed
Citrixnative client
VMware Horizonnative client
AD / LDAP · Kerberos / SSSDsingle sign-on into VDI — no new passwords
Who it's for
Built for endpoints that must stay locked and reliable.
- 01
Kiosks & self-service
Kiosk lockdown for public terminals, POS and signage — clean, tamper-proof, recoverable.
- 02
VDI / thin-client fleets
Large Citrix and Horizon estates, managed centrally and identically.
- 03
OT, industrial & edge
Unattended field devices that must self-heal and can't be bricked remotely.
- 04
Regulated sectors
Healthcare, finance, government and education — where lockdown and audit are mandatory.
Lower risk. Lower cost. Less to manage.
Extend the life of existing PCs instead of buying new, give malware nowhere to persist, cut re-imaging to minutes, and lower licensing, energy cost and e-waste across the estate.
x86 + ARMRuns on new or repurposed hardware
100%Signed, verified OS images
0Bricked devices — auto-rollback
1Console for the whole fleet
FAQ
SecureOS, answered.
- What is SecureOS?
- SecureOS is an immutable Linux OS for locked-down endpoints such as thin clients, kiosks and edge devices. It is signed and read-only, updates through A/B slots with automatic rollback, and is managed from one console — on x86 and ARM.
- Can SecureOS repurpose our existing PCs as thin clients?
- Yes. SecureOS runs on x86 PCs and ARM boards (Pi / Nano class), giving aging desktops a secure second life as thin clients — extending hardware life, cutting desktop-OS licensing and reducing e-waste.
- Which VDI platforms and directories does SecureOS support?
- Native Citrix and VMware Horizon clients are built in, and users sign in with existing Active Directory or LDAP credentials via Kerberos / SSSD — single sign-on into the virtual desktop.
- What happens if an update fails?
- Updates are written to the inactive A/B slot and RSA-4096 signature-verified on-device before anything switches. If the new slot won't boot, a GRUB boot counter, an initramfs fallback and a userspace watchdog roll the device back to its last working slot after three strikes.
- How does SecureOS stop ransomware?
- The root filesystem is signed and read-only, so malware has nowhere to persist. Changes land in a writable overlay that a reboot wipes, and factory restore resets it to the signed factory image — there is nothing to hold hostage.
- How is a SecureOS fleet managed?
- Each device runs TcManager, an on-device console for VDI clients, certificates, network, users, AD / LDAP login, USB control, OTA and factory reset. Fleet-wide, a signed OTA server and central configuration push builds and policies, and SecureOS pairs with DeviceManager for inventory, monitoring, alerting and remote support.
Let's talk
Ready to lock down your endpoints?
Let's pilot SecureOS on your own hardware, map it to your VDI, kiosk or edge fleet, and agree a rollout and licensing plan.