01
Private before it leaves the device.
Telemetry is encrypted at the edge, so the data moving across the link is protected from the start.
Tunnel-X
Trusted devices. Protected data.
Tunnel-X encrypts IoT telemetry from device to sink, checks each frame, and refreshes keys without interrupting the connection.
Trust the device. Then protect the data.
Auth-X authenticates a device and establishes a trusted session. Tunnel-X encrypts telemetry before it leaves the device; the receiving sink verifies and decrypts it.
Auth-XAuthenticate device
Tunnel-XProtect telemetry
The protected path
Readable here. Protected in between.
A sensor reading is encrypted on the device, travels as a protected frame, then is authenticated, decrypted, and processed at the sink.
Simulated sample data. This page is not connected to a live device.
Security that travels with the signal.
From the ESP32 to the receiving sink, each part of the path has a clear job.
Verified before it is used.
The receiving sink checks the session, order, and integrity of each protected frame before decoding its contents.
Fresh keys, steady connection.
In-band rekeying renews the protected session while the existing TCP connection stays in place.
Built from a working device-to-sink path.
The current reference implementation connects ESP32 clients to a C++ sink. It records accepted telemetry and gives the operator per-device rekey control.
The reference build supports five concurrent client sessions. Broader fleet scale and new hardware integrations are work for a deployment pilot.
ESP32 to sinkProtected telemetry on a live TCP session
Per-device controlRekey policy managed for each connected device
Observable deliveryVerified readings recorded at the gateway
Bring a device. We’ll map the protected path.
Tell us what your devices send and where it needs to arrive. We’ll scope a focused Tunnel-X pilot.