Clea OS
Secure Embedded OS
Clea OS is a Yocto LTS-based Linux distribution for industrial edge devices on ARM and x86. Secure boot, signed updates and unified access control make every device fleet-ready from day one.
sync_altInteraction
Clea OS generates the SBOM and monitors vulnerabilities, aligning devices with CRA, RED and IEC 62443. It is recommended, not mandatory: existing Linux devices join Clea with the Edgehog runtime and Astarte SDK.
Built-in Core Features
Clea OS makes devices fleet-ready.
Secure boot
Only signed, trusted code starts, from a factory chain of trust.
TPM / FDO provisioning
Devices are provisioned with their keys stored in the TPM, so data and keys stay sealed on the device.
Container runtime
Containerized apps and AI models run on the device, deployed from Clea App Hub through Device Manager.
On-device AI inference engine
Each model runs on its chip's AI engine through the vendor toolkit: Intel OpenVINO, NXP eIQ, Qualcomm Neural Processing SDK, MediaTek NeuroPilot or Rockchip RKNN Toolkit.
Remote OS updates
Signed, encrypted OTA updates on A/B partitions with failover, applied remotely or locally.
SBOM and audit trail
Every release ships with an SBOM in SPDX and CycloneDX, and CVE discovery runs in the CI.
Yocto-based OS
A Yocto LTS-based Linux distribution for industrial edge devices on ARM and x86.
OS fleet policies
Centralized rules for OS configuration across device groups.
Why Choose Clea OS
Any silicon, one baseline
The same OS on x86 and ARM, from high-end edge AI boxes to low-power devices: Intel, AMD, NXP, Qualcomm, MediaTek, Rockchip, Raspberry Pi and QEMU.
Faster time to market
Pre-integrated BSPs, container runtime and AI engine. Past IoT investments carry over.
Secure by design
Secure boot, encrypted storage, signed OTA and SBOM in every release.
Managed from day one
Device Manager updates, debugs and deploys apps remotely, from pre-qualified App Hub apps and AI models.
Manage the lifecycle of the product, not just the initial build
Clea OS supports the full lifecycle of connected products, providing a continuous management loop from initial bring-up to long-term reliability in the field. Long-term support releases: Clea OS 1.x on Yocto Kirkstone and 2.x on Scarthgap.
Provisioning
Simplified onboarding, secure boot initialization, and hardware-software pairing.
Configuration
Tailored OS blueprints, application layer setup, and service orchestration.
Deployment
Fleet-wide roll-out with simplified provisioning and automated field activation.
Maintenance
Proactive health monitoring, automated patching, and secure OTA updates.
Evolution
Scaling to new hardware, AI model updates, and seamless feature enhancements.
Security is built into every image
Standard controls in every release, from boot to supply chain. The same controls support CRA, RED (EN 18031) and IEC 62443 requirements. Maintenance comes in two levels: standard, or extended with the Cybersecurity Package add-on.
Trusted boot
Only signed, trusted code starts.
- Secure boot
- Measured boot
- Read-only boot partition
- Factory chain of trust
Protected data
Data and keys stay sealed on the device.
- Encrypted partitions
- Keys stored in the TPM
- TPM/FDO provisioning
- Encrypted links
Safe updates
Updates cannot brick or tamper with the device.
- Signed, encrypted OTA
- A/B partitions, failover
- SWUpdate and RAUC
- Remote or local updates
Open supply chain
Every component is known and tracked.
- SBOM: SPDX, CycloneDX
- CVE discovery in the CI
- Yocto LTS baseline
- LTS kernel
Built for Every Industry
Deployed across large edge fleets.
Industrial Automation
Deploy on factory-floor gateways. Collect machine telemetry, manage firmware across lines, and run edge analytics in containers on a hardened, LTS OS.
Energy Management
A/B partitions with failover protect grid nodes from failed updates; system telemetry keeps them visible.
Vending & Retail
Power connected kiosks with a minimal, secure footprint. Remote diagnostics and OTA app updates reduce truck rolls and unlock new revenue streams.
EV Charging Infrastructure
Secure boot, encrypted communications, and automated rollback allow managing firmware campaigns across thousands of distributed stations reliably.
Ready to Build Your Edge Foundation?
Start configuring Clea OS for your hardware platform today, or contact us to discuss custom BSP development.