We build secure firmware for connected devices
The complete firmware for your device, or only its security-critical components — from architecture to production, built to meet the EU Cyber Resilience Act. For device manufacturers and hardware startups.
CRA Readiness Status
- Hardware Root of Trust
- Secure Boot verified
- Device Identity (PKI)
- SBOM Generated
- Threat Model Complete
- OTA Updates Signed
- CRA Documentation Ready
Curious what we've built? See our project case studies →
When Clients Typically Contact Us
Companies typically engage us when:
- The hardware is ready, but there's no in-house team to build secure production firmware for it
- An existing product's firmware needs security hardening before it ships
- A secure provisioning process is needed before manufacturing starts
- Backend and cloud integration is needed to manage devices securely in the field
Where our clients start
CRA requirements apply at every stage
HOW WE HELP
Real problems. Concrete fixes.
COMMON PROBLEMS
You have a prototype. Not production firmware.
A working prototype and a production-ready device are not the same thing. Field reliability, OTA updates, and secure boot need to be engineered in from the start, not bolted on once the hardware is locked.
Why Platanor
We build complete device firmware — architecture to production — with security engineered in, not bolted on after.
Security-first architecture
Security is designed as a core system property - not added later. We design device identity, provisioning, authentication, and secure communication as fundamental architectural elements.
Deep embedded expertise
Our work happens close to the hardware: firmware, RTOS-based systems, communication protocols, and device-level security mechanisms.
Full-stack
From device firmware and tools to companion apps and backend servers - designed together by one team. This avoids the common problem of fragmented development across multiple vendors.
Production-ready mindset
We design systems for the entire lifecycle of a device - from development and manufacturing to provisioning, deployment, and long-term operation.
Regulatory-driven reality
Modern regulations such as the Cyber Resilience Act (CRA) require manufacturers to implement proper device security. We translate these requirements into concrete engineering decisions and production-ready systems.
Listed on
Frequently Asked Questions
Practical answers about the Cyber Resilience Act and how we work. If your question is not here, ask us directly.
Does the CRA apply to our product?
If your product connects to a network or another device - directly or indirectly - and is sold in the EU, the CRA almost certainly applies. This covers consumer IoT, industrial sensors, smart home appliances, and most hardware products with digital elements. A few categories are excluded because they are already covered by other EU regulation, such as medical devices and vehicles.
Our device is not a “security product”. Does this still apply to us?
Yes. Even seemingly simple connected devices such as smart home appliances can introduce serious risks if security is not designed properly - they connect to networks, store credentials, and interact with cloud services. The CRA was introduced in response to these real risks. Security is not optional - it is a fundamental requirement for any connected device.
What are the actual deadlines?
Two dates matter. From September 11, 2026, manufacturers must report actively exploited vulnerabilities and serious incidents. From December 11, 2027, the full CRA requirements apply to every product placed on the EU market on or after that date.
What happens if we do nothing?
Non-conforming products can face fines of up to €15 million or 2.5% of global annual turnover, whichever is higher, and can be withdrawn from the EU market. In practice the bigger cost is usually the forced redesign: security retrofitted after production is far more expensive than security designed in from the start.
When is the right time to bring you in?
The earlier, the easier - architectural decisions such as device identity, secure boot, key storage, and provisioning are cheapest to get right before production. Products already on the EU market are not off the hook either: vulnerability reporting applies to them from September 2026, and the full requirements land once you substantially modify them. We work with both: building firmware for new products with security designed in from the start, and hardening the firmware of products already on the market.
How do we find out where we stand today?
Run our free CRA Readiness Check: 56 questions across 9 security domains, instant results, no signup. It takes 20-35 minutes and gives you a domain-by-domain breakdown of the gaps.
Start the free check →What does Platanor build?
Firmware for device manufacturers: the complete device firmware from architecture to production, or the security-critical components inside your existing codebase. Security is where we go deepest - device identity and provisioning, secure boot and signed OTA updates, the backend that supports them, and CRA-ready technical documentation. Delivered as production source code you own, not a subscription platform.
See our services →Secure firmware, ready before December 11, 2027
From that date, the Cyber Resilience Act applies to products with digital elements placed on the EU market. We build the firmware and security components your device needs to meet its requirements — delivered as source code you own.