One of our engineers will take you through a live rollout.
Update with confidence, from one device to a million.
Airframe brings Amazon's proven device update infrastructure to embedded Linux. You get a console, an on device agent, and layered security throughout, all running inside your own AWS account. It's built on the same AWS based approach we designed that's been proven on over a million devices, and now brought to Linux for the first time.
One of our engineers will take you through a live rollout.
Rufilla is trusted by teams building smart products for:
The problem.
When a company ships thousands of smart devices, it needs a way to manage them from head office: see them, group them, and above all, send them software updates remotely.
Amazon solved this years ago, but only for small microcontroller devices. Bigger devices that run Linux, meters, instruments, chargers, gateways, were left out. Amazon’s update service simply doesn’t reach them.
Teams have fallen back on ageing open source tools, several of which are struggling to keep up, or built their own update systems from scratch. Getting this right by hand is months of specialist work, and getting it wrong mid rollout usually means finding out from a support ticket, not your own dashboard.
The rules now require this too
The UK’s PSTI Act requires manufacturers to publish how long they’ll keep providing security updates for a product, and to actually stick to that commitment. It doesn’t force a product to have an update mechanism in the first place, but once you’ve published a support period, you need a reliable way to deliver on it. The EU’s Cyber Resilience Act goes further. Reporting obligations apply from September 2026, and from December 2027 manufacturers will need to actually provide and securely distribute security updates where they’re needed, not just identify problems and hope customers patch them.
A reliable update mechanism isn’t a nice to have any more, it’s part of what makes a product legal to sell.
What Airframe actually does
Airframe closes the gap Amazon left. It brings the same rock solid update infrastructure to embedded Linux devices, with no extra server for you to run, since the agent on the device talks directly to AWS.
It’s one product, made up of four parts, and all four live in your account.
What Airframe actually does
We design the deployment with you once, covering device groups and test versus live channels, and Airframe then builds the whole thing inside your own AWS account automatically, with security best practice applied throughout. Doing this by hand is months of specialist work.
The console
The agent
The reference operating system
A ready made, heavily hardened Linux build for the devices themselves, covered in full in our Hardened Linux pack.
See it running
Watch it happen, live
See exactly how a rollout is progressing as it happens, not after the fact. Query firmware versions across your whole fleet whenever you need to, rather than guessing what’s actually deployed, and group your fleet however makes sense to you so you can target rollouts precisely.
Many layers of security
Each device is protected by a chain of measures, each one backing up the last.
Signed updates only
Secure connections
Verified boot
Can't be bricked
Updates use an A/B scheme with automatic rollback. The new version is only kept once a health check confirms it’s working.
The agent contains itself
Tamper evident logging
No going back
Protection against rolling back to older, vulnerable software, and against winding the clock back to reuse expired credentials.
This isn't a theoretical model. It's the same proven, AWS based approach already running on over a million devices.
Every device proves who made it
At manufacture, each device is given a cryptographic identity, and the private half never leaves the device’s security chip. From then on, the device can prove it was made by you, and no other device can pretend to be one of yours. This is also what lets new devices join the system automatically and securely, with no manual onboarding step.
Built to scale
One site, ten sites, national, worldwide: it’s the same infrastructure underneath, because it’s built on AWS. We’ve already seen that backbone carry over a million devices, and Airframe brings that same backbone to Linux. A deployment that starts with fifty devices can grow to fifty thousand without being rebuilt. Test groups and staged rollouts are designed in from day one.
Ready to see the numbers for your own fleet?
Get in touch and we’ll talk it through.
Airframe compared to open source options
Open source tools are usually the first place teams look. They’re a reasonable place to start, but they come with real trade offs once you’re relying on one in production.
Open source options
Web interface
Open source options
Often limited, deprecated, or unmaintained
Open source options
Open source options
Often limited, deprecated, or unmaintained
Open source options
Open source options
Core capability
Brings Amazon's update infrastructure to embedded Linux devices, with an agent that works with any Linux device
Runs entirely inside your own AWS account, so there's no lock in
Infrastructure built for you automatically, covering device groups and test versus live channels
Full console: upload, group, stage, and monitor rollouts
Layered security throughout, from signed updates and secure boot to tamper evident logging
Automatic rollback if a health check fails, so a bad update can't brick a device
Fleet wide firmware version querying
Automatic, secure device enrolment through cryptographic device identity
Built on infrastructure we already run at real scale, in production, today
Built to survive contact with a real fleet
The AWS based update infrastructure behind Airframe is the same infrastructure we designed for Octopus Energy’s Home Mini. It already keeps over a million devices current in homes across the country, every day, and we’re the team that built and run it. Home Mini isn’t a Linux device, so Airframe is what makes that same proven, reliable approach available to Linux devices for the first time. Airframe takes that same proven engineering and puts it in your hands as a complete, ready to use product for Linux devices, so you get the confidence of infrastructure that’s already proven at real scale, without having to build any of it yourself.
Frequently Asked Questions
Do we need our own AWS account?
Yes. Airframe is built and runs entirely inside your own AWS account, so there’s no lock in and nothing sits between your devices and AWS.
How is this different from building our own OTA system on top of AWS?
Amazon provides update infrastructure for small microcontroller devices, but nothing for bigger Linux devices, and no management console either way. Airframe is that missing piece: the infrastructure, the console, the agent, and a hardened reference operating system, already built rather than something you have to build yourself.
Can we see it running before we commit to anything?
Yes. One of our engineers will take you through a live rollout first. You won’t need any hardware or an AWS account.
See Airframe in action
We’ll show you Airframe on a call. We’ll register a device, push out a new version and you can watch it arrive. If you tell us a little about what you’re building, we can talk about how it might fit.
Prefer to talk first? Call us on +44 (0)1865 601201 or email hello@rufilla.com