Absolute offline autonomy. Sovereign connectivity on demand
Hardware-Level Encryption
A dedicated RISC-V NPU running at 160 MHz executes 512 MAC/cycle inside a CC EAL-6+ secure enclave. Firmware is signed at the foundry; boot-loader verifies the signature before every wake-up. Runtime decryption keys are stored in e-Fuses blown after provisioning—no JTAG, no debug interface, no firmware update port. Raw biometric vectors are hashed with a 256-bit device-unique key; only the hash leaves the enclave (for pendant-to-pendant authentication), making reconstruction of the original signal cryptographically infeasible.
User-initiated, returns to radio silence
The user triggers “cloud sync” by a deliberate gesture (triple-tap + fingerprint). A one-time TLS 1.3 session negotiates a 256-bit ephemeral key; the handshake includes a hardware-rooted attestation certificate proving the firmware has not been modified. Once the encrypted payload is acknowledged, the radio stack powers down, the session key is zeroised, and the device reverts to air-gap—total window < 3 s, no background telemetry possible.
Peer-to-peer distress signal (FCC Part 15) independent of cellular grids
In a grid-down scenario the pendant automatically boosts TX power from 0 dBm to +10 dBm and shifts to the 868 MHz ISM band (LoRa, 250 kHz BW, SF = 9) for maximum range. A forward-error-correcting codec (Reed-Solomon 255,223) gives 8 dB coding gain, allowing a 50-byte distress packet to be decoded at -137 dBm—roughly 12 km line-of-sight. The message format is compatible with amateur 869.4 MHz simplex and with commercial SAR receivers that support open-standard LoRaWAN—no proprietary hardware required.