Fleet updates without the leap of faith.
Meshanics ships software, configuration and ML models to industrial and edge-AI fleets — every byte signed and verified on-device, every change on an append-only record, every update able to roll itself back. Zero integration for your application and model code.
our cloud · your cloud · fully air-gapped on one on-prem node
of artifacts signed — no unsigned path exists, not even in dev
verified model hot-swap on-device, previous version retained
from factory-fresh device to enrolled, attested fleet member
ENISA early-warning window your update record is ready for
Fleet updates you can bet production on
Built on proven open standards — The Update Framework (TUF) for update security, A/B partitioning for OS updates, OCI artifacts for apps and models — orchestrated into one control plane.
Signed end to end
Every artifact — OS image, container, ML model, config — is signed before it exists in the system. Devices verify full TUF metadata chains against a root of trust pinned in the device image. There is no unsigned path, not even in dev.
Rollback is a feature, not error handling
Each update declares a health probe. If the new version fails it, the device atomically restores the previous version on its own — no operator, no truck roll. The previous version is always retained.
Evidence by construction
Every state change — publish, rollout, approval, device update, rollback — is an append-only audit event the moment it happens. Compliance reporting reads from the record, not from reconstruction.
Canary waves & halt rules
Roll out 1% → 10% → 50% → 100% with manual approval gates where you want them. Fleet-wide halt rules pause everything the moment failure rates cross your threshold — mid-wave, automatically.
Heterogeneous fleets
Jetson next to Raspberry Pi next to x86 gateways. Devices report their hardware profile; rollouts target capabilities, not a single golden image.
Zero integration
Your application and model code don't change. Payloads ride in signed containers and artifacts on top of our signed, A/B, rollback-safe base layer — drop in your software and ship.
Connect your devices
A single static agent (<15 MB, arm64/amd64) registers over mutual TLS and reports its hardware profile. Identity lives in the device certificate — never in a payload.
Publish signed artifacts
Push a model, container or config with one call. It's signed into the update repository before anything is recorded.
Roll out with confidence
Pick a fleet, a wave strategy and a health probe. Watch devices verify, swap and report live — and roll themselves back if anything is off.
Factory-fresh to fleet in one command.
The device generates its own key — it never leaves the device — exchanges a one-time token for a signed identity and the root of update trust, then appears in your console within seconds. How it works →
$ curl -fsSL https://meshanics.com/install.sh | sudo bash -s -- --token mesh_…ML models as first-class deployable units
Nobody else ships this turnkey: deploy, canary, A/B-test and roll back vision models (ONNX, TensorRT, TFLite) across device fleets the same way you ship code.
- [✓]Verified hot-swap in seconds — new model live on-device in under a minute, signature-checked before the swap
- [✓]Canary cohorts for models — try the new weights on 5 devices before the other 500
- [✓]Instant rollback — bad confidence distribution? The previous model is still on disk
- [✓]Model manifests — framework, input spec, target hardware profile and license travel with the artifact
What the DIY update stack actually costs
Every OEM has shipped updates with scripts and good intentions. It works — until the one time it doesn't, in front of a customer, or an auditor.
| Dimension | Scripts & good intentions | Meshanics |
|---|---|---|
| Update signing | Optional, hand-rolled, easy to bypass under deadline pressure | Mandatory — the unsigned path does not exist in the code |
| Failed update | Bricked unit, truck roll, angry plant manager | Health probe fails → device restores the previous version itself |
| ML models | scp and a prayer | First-class signed artifacts: canary cohorts, manifests, instant rollback |
| Device onboarding | Manual key ceremonies per device | One command — key generated on-device, never leaves it |
| CRA evidence | Reconstructed from logs the week before the audit | Append-only record written as updates ship; exportable |
| Air-gapped sites | Cloud-only tooling stops at the firewall | Entire control plane runs on one on-prem node |
We assume the supply chain is the target
Update infrastructure has SolarWinds-class blast radius, so Meshanics is built like it: offline roots of trust, scoped online signing, verification at the edge — and nothing else trusted in between.
Offline root keys
TUF root and targets keys live on an air-gapped machine and never touch our backend. Online signing is scoped to a delegated artifact namespace — a compromise is contained and recoverable by design.
Untrusted transport
CDNs, registries and storage are treated as hostile. Devices independently verify signatures, hashes, lengths, versions and freshness — tampered, replayed, stale or wrongly-signed updates are rejected on-device.
mTLS everywhere
Every device holds its own X.509 identity (hardware-backed where the silicon supports it). Device identity comes from the certificate — never from a request payload.
Air-gap & on-prem ready
The entire control plane runs on a single on-prem node with no cloud dependencies — built for defense and critical-infrastructure deployments from day one.
No payload telemetry
We see metadata, never the contents of your artifacts or your data. Auditable by your security team — and by ours.
Attack-tested updates
Our device client ships with negative tests for the attacks that matter: tampered artifacts, frozen metadata, rollback replays, wrong-key signatures. Rejection is the default.
CRA compliance as a product feature, not a PDF
The CRA requires secure update mechanisms, vulnerability handling and evidence. Meshanics generates that evidence as a by-product of how updates actually ship.
- [✓]Secure-update attestation — demonstrate a signed, verified, rollback-safe update path per product
- [✓]Complete update history — per device, per product, signed and append-only
- [✓]Vulnerability timelines — SBOM-driven affected-fleet queries supporting the 24h / 72h / 14d ENISA reporting flow
- [✓]Exportable reports — hand your notified body the record, not a reconstruction
From this date, actively exploited vulnerabilities and severe incidents must be reported on the ENISA 24 h / 72 h / 14 d timeline. Full conformity follows 11 Dec 2027.
The higher of €15 M or 2.5% of worldwide annual turnover, for non-compliance with essential cybersecurity requirements — secure updates among them.
Put your fleet on rails.
Industrial OEMs, vision-device makers and edge-AI teams shipping to real hardware in the EU — we're building the roadmap with you.
Become a design partner