# Secure Desktop in brief

### One secure workplace family — laptop, desktop, workstation, server — on standard hardware

**One family, your hardware.** The secure workplace is one design in four form factors: Secure Laptop, Desktop, Workstation and Server. It runs on standard enterprise laptops, mini-PCs, workstations and rack or tower servers — the chassis you already standardise on. The only addition is a small hardware vault in the machine's M.2 slot; the firmware is ours, the hardware is yours.

**Trust starts below the operating system.** Open-source firmware replaces the vendor BIOS and locks USB, storage and network at power-on (Ring -1). The only way to start the machine is a FIDO2 WorkPermit: a time-bound, signed credential on a hardware key, bound to the authenticated natural person, not to a corporate account. The firmware then hands over to a small, hardened micro-hypervisor that opens the first network connection. No permit, no boot.

**Nothing stays on the machine.** The workload — operating system, applications, data — runs in volatile memory on a read-only, signed golden image; for top-secret work it is streamed into RAM. Power off, and the state is gone: no local software to patch, nothing to recover from a lost device, no forensic trace to protect.

**No central VPN concentrator.** In 2025 four of the five large perimeter-device vendors had at least one actively exploited critical vulnerability: one internet-facing box as the door to the whole network is a structural attack surface. Each secure workplace instead builds its own direct, point-to-point tunnel after the pre-boot permit check — no shared concentrator to compromise, no broad network to move through laterally.

**EU-sovereign image.** The golden image follows the organisation's role profile. An EU-sovereign Linux desktop, aligned with a Dutch-government open-source workplace initiative, is proposed as the primary image for sovereignty-focused organisations, with Windows alongside and a second Linux base kept viable so that no single project becomes a dependency.

**Secure BYOD.** One physical device carries several organisations and roles with hardware-enforced separation — the consultant's or contractor's own machine instead of a bag of client laptops and smart cards. The contractor's employer signs the attestation of employment, clearances and contract; if the claims prove false, the liability is theirs. Enterprise BYOD, made trustworthy.

**Operated by a partner, never by us.** The fleet is operated by a certified operating partner — proposed: a European sovereign collaboration-platform vendor or its hosting partners — inside a fixed boundary: never the FIDO2 keys, the vault secrets or sensitive and top-secret content, and a second operator must always remain possible. We design and verify the security architecture and hold no role in operations.

*Wols CA — security architecture for sensitive and top-secret assets. Operating partner and EU-sovereign image are proposals, not contracts.*