What happens if a private key leaks?

A leaked key lets anyone sign malicious code in your name. With bitSign, keys are always protected inside an HSM and can never be exported.

What happens if we lose a private key?

Losing a key can mean losing the ability to update your products. With bitSign, every key comes with a Disaster Recovery Kit. Choose our default model (cold escrow) and we also keep a copy in a separate secure facility - redundancy without having to build it yourself.

Why does code signing need approvals?

If anyone in the organisation can sign code, a hacker - or a disgruntled employee - could ship malware in your name. With bitSign, you can require sign-off from several trusted people before anything gets signed. Everything is logged tamper-evidently - the logs cannot be manipulated.

Do we keep full control of our keys?

Yes. You choose the model - either an HSM that only you own (zero-copy), or our default cold escrow model for maximum redundancy.

How quickly can we get started?

Most customers are up and running in days, not months.

Do you support complex tooling (e.g. RAUC)?

Yes. We provide ready-made jobs for advanced flows, and can adapt to your setup where needed.

Does bitSign hold up to compliance and audits?

Yes. Every signing operation is auditable, with complete logging. That makes it easier to satisfy ISO 27001, IEC 62443 and other relevant standards.

Is bitSign a fit for small and mid-sized companies?

Absolutely. bitSign gives you the same level of security the large enterprises rely on. Without having to build expensive infrastructure yourself.

bitSign: Code Signing as a Service

01 — The risk

Every unsigned – or wrongly signed – release is a liability.

/ 01

Product risk

Tampered firmware can harm your customers – and your reputation.

/ 02

Compliance risk

Regulated industries demand secure code signing (e.g. ISO 27001, IEC 62443, automotive).

/ 03

Operational risk

Building and maintaining your own signing environment is expensive and slow.

02 — The flow

From file to signed code – through a flow you can trust.

1

Create a request

Send your file to the portal.

2

Approve

You decide who has to sign off – and how many.

3

Sign

bitSign signs with your HSM-protected keys inside our trusted environment.

4

Download

Your signed software is ready – with a complete audit trail.

03 — Key model

Decide how you want to own your keys

Zero-copy model

/ A

You store your own cold keys and own your disaster recovery. We provision our HSM on your premises using the PkOS security system. The key exists only inside the HSM – we can never recreate or leak your private key.

Maximum control – the keys are entirely yours
Secure on-site provisioning with PkOS
You build your own DR model

Recommended

Cold escrow (default)

/ B

We handle your private key securely with PkOS and create disaster recovery kits – we keep one, you get one. Redundancy is built in: if bit42 ever disappears, you hold a copy; if your office burns down, we hold one. Stored encrypted in a high-security safe.

Redundancy built in – two independent copies
Straightforward for any security firm to restore
Encrypted storage in a high-security safe

	Zero-copy model	Cold escrow
Control	Maximum	High
Disaster recovery	Your own DR model	Dual protection
Technical safeguards	PkOS + HSM	PkOS + security safe

04 — Demo

See the portal in action

Watch how easily your developers and security officers manage signings – from request to finished, signed software.

Effortless onboarding

Keys never leave the HSM

Approval flows you control

Audit-ready logging

bitSign solves the signing of our Infix releases in an elegant way. You can tell it was built by someone who understands the practical challenges developers face. A real gamechanger!

Joachim Wiberg

Kernel Kit Organization

05 — Integrations

Works with industry-leading tools & platforms

06 — API & Automation

Automate your signing – keep control

Integrate secure code signing straight into your CI/CD pipelines. Speed, without compromising on security.

Faster time-to-market

Make signing part of every build and release. No manual steps slowing your team down.

Defence against supply-chain attacks

The workflow pauses and waits for human approval – protecting you even if your CI/CD environment is compromised, or an insider goes rogue.

A complete audit trail

Every signature is logged automatically, with timestamps and approvals. Compliance reporting becomes trivial.

Simple API integration

3 straightforward endpoints

Plain REST + JSON

API-key authentication

GitHub Actions-ready

The workflow

CI/CD → HSM

1

CI/CD pipeline

Builds and packages your software (automated)

2

API: create a signing request

Your workflow calls the bitSign REST API (automated)

3

Human approval required

Trusted signers are notified by email and approve with 2FA

4

Secure signing

The HSM signs your software (automated)

5

Download the signed result

Your pipeline continues with signed software (automated)

Workflow pauses here

Integrate your way

signing session — bitSign CLI HSM · ONLINE

.github/workflows/release.yml

# Sign firmware in your pipeline – approval happens in the portal
- name: Sign firmware with bitSign
  run: |
    REQ=$(curl -s -X POST https://portal.bitsign.se/api/v1/requests \
      -H "Authorization: Bearer $BITSIGN_API_KEY" \
      -F "key=prod-secureboot-2026" \
      -F "file=@build/firmware-${{ github.ref_name }}.img")

    # The pipeline pauses until trusted signers approve (2FA)
    bitsign wait --request $REQ --timeout 24h
    bitsign fetch --request $REQ -o build/firmware.img.sig

curl — bitSign REST API

# Create a signing request straight against our API
curl -X POST https://portal.bitsign.se/api/v1/requests \
  -H "Authorization: Bearer $BITSIGN_API_KEY" \
  -F "key=prod-secureboot-2026" \
  -F "file=@firmware-v4.2.1.img"

# Response – the request now awaits human approval
{ "id": "SR-1847", "status": "awaiting_attestation" }

The same flow — whether you run it from your terminal, your CI/CD or straight against our API.

View the example on GitHub

07 — Security

We've thought of everything – so you don't have to

From implementation to physically protected keys, we cover the whole chain – so you can stay focused on your core business.

// DR kit Confidence when the unexpected happens — a physical DR kit for every key.

Proven security expertise

MAINLINE LINUX Accepted & Merged

nvmem: add new NXP QorIQ eFuse driver

Add SFP (Security Fuse Processor) read support for NXP QorIQ series SOC's

commit 0861110b View Details →

Contributing secure-boot support to the mainline Linux kernel – our expertise, proven in practice.

// Under the hood

Our in-house OS for key generation & management.

A data diode for isolated internal transfers.

I'm fairly sure Alex still has a copy of the private key on a USB stick somewhere

A concern we hear from security officers all the time — bitSign eliminates it completely.

08 — FAQ

Frequently asked questions

09 — Plans

A plan to match your needs

// Base

4,900 SEK / month

A perfect fit for smaller companies that need secure signing without the complexity.

3 users
1 key
Approvals & traceability
Signing in a trusted environment
Complete audit log
Email support

Book a walkthrough

Recommended

// Standard

9,900 SEK / month

The complete solution for mid-sized companies with regular signing needs and high security requirements.

10 users
3 keys
Approvals & traceability
Annual Disaster Recovery Kit drill
Signing in a trusted environment
Complete audit log
Priority support

Book a walkthrough

// Advanced

Custom

A tailored solution for organisations with specific requirements on hosting and isolation.

Tailored on-premise environment
Approvals
DR setup to your requirements
Customer-hosted / bespoke
Can run fully isolated from the internet

Book a walkthrough

Every plan includes HSM-backed key storage, approvals and signing in a trusted environment.

Annual contract · Prices excl. VAT

10 — Contact

Ready to secure your code signing?

Email

info@bitsign.se

Phone

+46 79 102 30 35

PGP Fingerprint


                                B1C7 05C6 B1BF 719C A5CD
                                6739 8BEE 8379 084B C511

Sign your software.
Simple, secure
and traceable.

Every unsigned – or wrongly signed – release is a liability.

Product risk

Compliance risk

Operational risk

From file to signed code – through a flow you can trust.

Create a request

Approve

Sign

Download

Decide how you want to own your keys

Zero-copy model

Cold escrow (default)

See the portal in action

Effortless onboarding

Keys never leave the HSM

Approval flows you control

Audit-ready logging

Works with industry-leading tools & platforms

Automate your signing – keep control

Faster time-to-market

Defence against supply-chain attacks

A complete audit trail

Simple API integration

The workflow

We've thought of everything – so you don't have to

Proven security expertise

nvmem: add new NXP QorIQ eFuse driver

Private Key Environment (PKE)

Hardware Write Protect

Physical Data Diode

Frequently asked questions

A plan to match your needs

Ready to secure your code signing?

Sign your software. Simple, secure and traceable.

Every unsigned – or wrongly signed – release is a liability.

Product risk

Compliance risk

Operational risk

From file to signed code – through a flow you can trust.

Create a request

Approve

Sign

Download

Decide how you want to own your keys

Zero-copy model

Cold escrow (default)

See the portal in action

Effortless onboarding

Keys never leave the HSM

Approval flows you control

Audit-ready logging

Works with industry-leading tools & platforms

Automate your signing – keep control

Faster time-to-market

Defence against supply-chain attacks

A complete audit trail

Simple API integration

The workflow

We've thought of everything – so you don't have to

Proven security expertise

nvmem: add new NXP QorIQ eFuse driver

Private Key Environment (PKE)

Hardware Write Protect

Physical Data Diode

Frequently asked questions

A plan to match your needs

Ready to secure your code signing?

Full demo

Sign your software.
Simple, secure
and traceable.