Freedom251 › Code Signing Software
LAAVAT PKI and Signing Platform
What LAAVAT PKI and Signing Platform is
LAAVAT PKI and Signing Platform is a managed cloud PKI and code-signing service for embedded and IoT device manufacturers. It operates customers' PKI, signs firmware, and issues device identities. Certificate capabilities include CA hierarchies, lifecycle management, EST and REST enrollment, and CRL lifecycle functions. Supported signing targets include NXP HAB/AHAB, AMD/Xilinx Bootgen, TI, MCUboot, FIT, RAUC, SWUpdate, Mender, OP-TEE, OCI/Cosign, Windows, Java, JWT, and detached signatures. The platform also supports AES-GCM-256 image encryption, manufacturing key delivery, key escrow, and key export. It provides secure boot, signed firmware updates, and per-device certificates for mutual TLS, attestation, and factory onboarding. Signing keys are generated inside AWS CloudHSM and remain out of plaintext form outside the HSM. Governance options include role-based access, group signing policies, quorum approvals, and immutable exportable audit trails. Deployment can use shared or dedicated LAAVAT-managed HSMs, a customer-managed AWS HSM, or on-premises infrastructure. The service offers a 14-day trial; pricing is on request. Its information security management system is certified to ISO/IEC 27001:2022.
Who it suits
The platform is for engineering, security, product, and manufacturing teams building connected devices and managing firmware signing across pipelines and production lines.
What it does well
- Supports a wide range of listed signing targets.
- Signing keys are generated inside AWS CloudHSM.
- Offers shared, dedicated, customer-managed, and on-premises deployment.
- Includes quorum approvals and exportable audit trails.
What to know first
- Pricing is available on request.
- There is no free plan.
- Using the platform alone does not make a product CRA compliant.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Custom quote | Pricing on request · 14-day evaluation · no free plan | On request |
As laavat.io lists them, read 1 Oct 2026. The maker's own page has the final word.
Verdict
LAAVAT brings device PKI, firmware signing, key protection, and governance functions together for connected-device teams. Its maker cautions that platform use alone does not establish CRA compliance.
Facts from LAAVAT PKI and Signing Platform's own pages
- Compliance
- LAAVAT’s information security management system is certified to ISO/IEC 27001:2022, certificate 244147. · docs.laavat.io, 1 Oct 2026
- CRA scope limit
- LAAVAT states that using the platform alone does not make a product CRA compliant because compliance also covers the whole product and process. · docs.laavat.io, 1 Oct 2026
- Deployment models
- Customers can use a shared HSM, a dedicated LAAVAT-managed HSM, a customer-managed HSM in their AWS account, or on-premises deployment. · docs.laavat.io, 1 Oct 2026
- Device security
- LAAVAT provides secure boot, signed firmware updates and tamper-resistant per-device certificates for mutual TLS, attestation and factory onboarding. · laavat.io, 1 Oct 2026
- Encryption
- It supports AES-GCM-256 image encryption, manufacturing key delivery, key escrow and key export. · laavat.io, 1 Oct 2026
- Governance
- The platform offers RBAC, group-based signing policies, quorum approvals and immutable exportable audit trails. · laavat.io, 1 Oct 2026
- Headquarters
- Tampere, Finland · laavat.io, 28 Sept 2026
- Integrations
- Integrations include REST, EST, Microsoft Entra ID, Google SSO, Yocto, CI/CD clients and provisioning-station clients. · laavat.io, 1 Oct 2026
- Key protection
- Signing keys are generated inside AWS CloudHSM and never exist in plaintext outside the HSM. · docs.laavat.io, 1 Oct 2026
- Managed service
- It runs customers’ PKI, signs firmware and issues device identities as a managed service. · laavat.io, 1 Oct 2026
- PKI capabilities
- The platform provides CA hierarchies, certificate lifecycle management, EST and REST enrollment, and CRL lifecycle functions. · laavat.io, 1 Oct 2026
- Product purpose
- LAAVAT is a cloud PKI and code-signing platform for embedded and IoT device manufacturers. · docs.laavat.io, 1 Oct 2026
- Signing formats
- Supported signing targets include NXP HAB/AHAB, AMD/Xilinx Bootgen, TI, MCUboot, FIT, RAUC, SWUpdate, Mender, OP-TEE, OCI/Cosign, Windows, Java, JWT and detached signatures. · laavat.io, 1 Oct 2026
- Support
- The documentation directs users to contact [email protected] for unanswered questions. · docs.laavat.io, 1 Oct 2026
- Target users
- The platform is aimed at engineering, security, product and manufacturing teams building connected devices and managing firmware signing across pipelines and production lines. · laavat.io, 1 Oct 2026
Where LAAVAT PKI and Signing Platform stands on Freedom251
- Code Signing Software#14 of 28