Edge Operating System
Deploy code to edge hardware. We handle the rest.
Hurricane OS is an immutable operating system that turns any x86 or ARM device into a secure, cloud-managed edge platform. Power-cut-proof. Zero-touch provisioning. Flat-rate pricing.
Industrial engagements withPwC
- In service aboard STS Kapitan Głowacki
- x86 · ARM · UEFI
- Built in Poland
The Platform
An operating system built for unattended hardware
Hurricane OS eliminates the complexity between your code and your edge fleet. Push containers, not kernel patches.
$ hurricane deploy --profile gse-3 --tag v2.4.1
→ resolving profile gse-3...... 1284 devices
→ signing image sha256:9f2c1a4e... ok
→ staging to bank B............ 1284/1284
→ verifying signatures......... ok
→ health probe 30s................ ok
✓ committed in 41s · bank A retained for rollback
$ -
Survival
Nothing you do to it corrupts it
The system volume is mounted read-only, so an unclean shutdown has nothing to damage. Updates write to the idle bank and switch only after a health probe passes; if it fails, the bootloader returns to the bank that was working. No operator, no site visit.
-
Security
Verified boot, keys sealed to the device
Measured boot rejects unsigned or modified images. Full-disk encryption keys are sealed to the hardware, so a removed disk reads as noise. Only signed containers execute. These are table stakes for edge Linux and we treat them that way — the architecture is documented below rather than described in adjectives.
-
Operated
We run the platform. You write the application.
OS patching, rollout scheduling, health monitoring and failure response are ours, not a console we hand you. Your team pushes code to a repository and it reaches the fleet. Every comparable platform maintains their OS but leaves you to operate it — which means hiring someone who knows embedded Linux, or discovering you needed one.
-
Sovereignty
An EU vendor, for buyers who have to care
The OS, the control plane and the engineering are ours, in Poland. For defence, critical infrastructure and NIS2-scoped operators, the jurisdiction of the vendor maintaining your boot chain is a procurement question — and every comparable platform answers it from the UK or the US.
Separately: for teams who need more than running their own code at the edge, we also take on data collection and processing engagements. That is a distinct offering, contracted on its own — it is not part of the OS subscription.
Field Report
Running in a ship's engine room, at sea, since June
An engine room is a deliberately unkind place to put a computer. Sustained vibration from a running diesel, heat with nowhere to go, salt in the air, and power that comes and goes with the engine rather than with anyone's permission.
The unit reads the engine's own CAN bus, a second CAN vibration sensor mounted on the block, and NMEA 0183 navigation data from the ship's instruments. It buffers locally and reconciles with the cloud when there is a link — which at sea there frequently is not.
This deployment runs on partner hardware, not one of our own enclosures. That is the ordinary case: an Advantech industrial box is entirely adequate here, and Hurricane OS does not care whose metal it is running on.
- Vessel
- STS Kapitan Głowacki — sail training ship, built c. 1942
- Engine
- Volvo Penta D6-300
- Data sources
- Engine CAN bus · dedicated CAN vibration sensor · NMEA 0183 navigation
- Hardware
- Advantech UNO-238 industrial box PC — partner platform, not our own build
- Conditions
- Vibration, heat, salt air, unscheduled power loss, intermittent connectivity
- In service
- Since June 2026
What's actually on the device
Four partitions, one of them writable. The system volume is mounted read-only, so a power cut during a write is not a failure mode — there is nothing to corrupt.
- Why two banks. An update never touches the running system. It is written to the idle bank, verified, then booted. If the health probe fails, the bootloader falls back to the bank that was working.
- Why read-only. Field failures in unattended hardware are dominated by filesystem corruption after unclean shutdowns. Removing write access to the system volume removes the class of failure.
- Why keys in hardware. Disk encryption sealed to the device means a stolen unit yields no data, and an unsigned image will not boot even with physical access.
Developer Experience
From commit to edge in one pipeline
Your team pushes code. The platform handles build, validation, and deployment to your entire fleet.
-
Push
Client commits code
Application microservices are pushed to your designated source repository. Standard Git workflow, no custom tooling.
-
Build
Cloud compiles & validates
Your infrastructure compiles, scans for vulnerabilities, and packages isolated container images signed against your enterprise registry.
-
Deploy
Fleet receives update
The control plane orchestrates over-the-air delivery to targeted devices, writes to the inactive bank, and keeps the previous one for rollback.
Control Plane
Every device, every version, one view
Fleet state is authoritative in the cloud and reconciled by the device. Roll out to a profile, watch banks flip, and revert without sending anyone to site.
fleet / profiles / gse-3
1284 devices
On target version
1276
Staging
6
Rolled back
2
Unreachable
0
| Device | Profile | OS version | Boot bank | State | Last seen |
|---|---|---|---|---|---|
| gs-3f9a21c4 | gse-3 | 2.4.1 | A | healthy | 12s ago |
| gs-8b7e04d1 | gse-3 | 2.4.1 | A | healthy | 34s ago |
| gs-1c55ba90 | gse-3 | 2.4.2 | B | staging | 8s ago |
| gs-d024e7f6 | gse-3-marine | 2.4.1 | A | healthy | 2m ago |
| gs-47ab9e02 | gse-3-marine | 2.3.8 | A | reverted | 1m ago |
Representative fleet view. Device identifiers are illustrative.
Hardware
Three ways to get the hardware under it
Hurricane OS runs on standard x86 and ARM platforms, so most projects need no new hardware at all. Where the environment gets harder, our partners cover it. Where it gets genuinely punishing, we build it ourselves.
Your own
Bring the hardware you already ship
Any 64-bit Intel, AMD or ARM platform with UEFI firmware. We certify it as a profile and maintain it from there.
Existing x86 gateways · ARM SBCs · COTS industrial PCs
Partner
Sourced through Advantech
Industrial gateways, vision nodes, DIN-rail compute, vehicle units. Advantech's catalogue covers effectively any commercial requirement, already validated against the OS.
Advantech industrial PCs and edge gateways
In-house
Built by us, for conditions that break other hardware
Defence-grade enclosures for salt spray, sustained vibration, shock and thermal extremes. This is where we design and manufacture ourselves, because nothing off the shelf survives it. Physical tamper detection wired to key erasure is available on these builds — specified per project, not a catalogue option.
IP68 aluminium · MIL-STD shock/vibration · tamper-evident enclosures
Alternatives
How we differ from the platforms you're also evaluating
Ubuntu Core, balenaOS and Torizon are all good at this. We are not going to pretend otherwise, or claim security features that all four of us have. Here is where the choice actually turns.
| Hurricane OS | Ubuntu Core | balenaOS | Torizon | |
|---|---|---|---|---|
| Immutable system volume | Read-only by design | Snap-based | Read-only | OSTree-based |
| Automatic rollback on a failed update | Bootloader-level, no operator | Per-snap revert, not whole-image | Host OS updates | OSTree rollback |
| Verified boot with keys sealed to hardware | Measured boot, keys sealed | TPM 2.0, sealed to EFI state | Not standard | Supported |
| Runs on hardware you already ship | Any x86_64 or aarch64 with UEFI | Certified boards; enablement fee otherwise | Supported device-type list | Built around Toradex modules |
| Extreme-environment hardware from the same vendor | We design and manufacture it | Software only | Software only | Module vendor, not ruggedised builds |
| Who operates the fleet day to day | We do — patching, rollouts, monitoring, response | You do, in your own store and tooling | You do, in their dashboard | You do, in their cloud |
| What scales with fleet size | Fleet component only — the OS fee is per profile | Per device, on every device | Per device beyond a free allowance | Per device, discounted at volume |
| Vendor jurisdiction | Poland — EU | United Kingdom | United States | Switzerland — non-EU |
Compiled from each vendor's published documentation at the time of writing. Our own rates are quoted per engagement, so this table compares how cost behaves rather than headline prices. All four are capable platforms and every one of them does immutability and verified boot properly — those are table stakes, not differentiators. The distinctions that survive scrutiny are hardware independence, who can supply hardware for punishing environments, how cost behaves as the fleet grows, and where the vendor sits.
Commercial Model
You subscribe to an operated fleet. You do not licence software.
Everyone else in this market sells you an operating system and a console, then leaves you to run it. We charge a subscription to run it for you. No perpetual licence, no upfront capex, no per-seat fees — while the subscription is active your devices are patched, monitored and recoverable, and when it ends that stops.
Billed annually per hardware profile and per device. Cancel and you keep running the last image you received; you stop receiving new ones.
- OS subscription per hardware profile
-
Kernel and BSP maintenance, CVE backports, signed builds and release QA on your specific hardware. A profile we have already certified costs less than custom silicon, because its maintenance is shared across everyone running it.
Flat. Identical at 10 devices and at 100,000.
- Fleet subscription per device
-
The control plane, rollout orchestration, health monitoring and failure response — the operated part. It is the only component that grows, because it is the only one where our cost grows: cloud metering and incident handling both scale per unit. We price it close to that cost.
Proportional. Same rate at 100 devices and at 100,000.
- Support tier optional
-
Response targets, named contact, and on-site attendance where the deployment warrants it. Priced separately so you are not paying for a response time you do not need.
Chosen, not scaled.
What the subscription replaces
- An embedded Linux engineer on staff to own kernel, CVEs and release QA
- A per-device OS licence that grows every time you ship a unit
- An on-call rota watching devices you cannot physically reach
- Separate line items for updates, rollbacks and delivery bandwidth
- The integration work to make secure boot, encryption and A/B updates actually cooperate
Never charged extra
- The operating system, per device — that fee is per profile
- A second profile on hardware we already maintain, at full rate
- Per-seat or per-user access to the console
- OS version upgrades, including major ones
- Rollbacks, re-provisioning or replacing a failed unit
- Bandwidth for update delivery
This model suits fleets with many identical units. If you are running fifty devices across six different hardware types, the profile fees will dominate and we are probably the wrong choice — we would rather say so on the call than after the invoice.
Request a quoteTell us your hardware types and roughly how many units. Those two numbers are all we need to price it.
Company
Built by engineers who deploy in the field
We design the full stack — immutable operating system, cloud control plane, and the machined enclosure it runs inside. Two founders, one codebase, no outsourced core.
- Founded
- Warsaw, Poland — incorporated November 2023
- Partnership
- PwC — joint industrial engagements
- In the field
- Reading engine CAN and NMEA 0183 in the engine room of a sail training ship since June 2026
- Discipline
- Embedded systems · OS security · cloud-native delivery
Get Started
See Hurricane OS in action
Book a 30-minute demo or request a pilot unit for your environment. No commitment required.