In transit
Signed and sealed to one board
Encrypted to the receiving board's own key, signed by the store and carrying a one-time ticket. It travels over USB from the Store page or over MQTTS, and the same code on the board opens it.
Security
How BENTO keeps models secure.
BENTO exists to deliver AI to devices safely. This page sets out what runs in public releases today, what has been demonstrated on the bench and what is still ahead.
Our rules for security claims
Name the board
Every security statement says which board it applies to. A feature that runs on one bench board is not described as shipping.
Measure before publishing
We publish a number only when we have measured it, and we say where and when.
Minimise what travels
Inference runs on the device, and Highlights hold the results without the recordings.
Build on proven silicon
We build on Infineon PSOC™ Edge E84 and its security architecture rather than inventing our own roots of trust.
Today
In public releases now.
These are in the firmware and services people use today.
- Today
Inference on the device, offline: models run on the board's NPU and need no cloud connection.
- Today
Audio is recorded for training only with the speaker's consent on the page. Highlights carry results, not recordings.
- Today
Current firmware releases carry an identity record and a manifest, so the browser installer puts the right build on each board.
- Today
Boards are registered to their owner by chip ID in the Edge AI Store, with release and transfer handled in the Store.
- Today
The Store, the Trainer and this site are served only over HTTPS; card payments, when open, are handled by Stripe and never reach our servers.
- Today
Sealed delivery and encrypted model storage on the BENTO HMI Kit: each package encrypted to that board's own key, with a one-time ticket, over USB or MQTTS.
How BENTO delivers a model
Today
Six steps from the store to the board.
This sealed-delivery chain runs today on the BENTO HMI Kit. Each step closes one way of attacking a model.
- 1
The store signs
Every model carries the store's signature, so a board can say where its AI came from.
An altered model is detected.
- 2
The board draws a ticket
The board itself draws a one-time ticket.
A captured package cannot be replayed, because its ticket has already been spent.
- 3
Sealed to one board
The package is encrypted to the receiving board's own key.
A copied package will not open on any other board.
- 4
USB or MQTTS
The same code on the board opens a package that arrives by either route.
Interception on the wire yields only ciphertext.
- 5
The secure core opens
The package is opened inside the board's secure core, where its key lives.
Goal: the key never leaves the secure core. Signed application images and the console lock, next on the roadmap, will complete this.
- 6
Verify before flash
The store's signature is checked on the board before the model is written.
An unsigned or altered model is not written.
Encrypted and signed with standard, published algorithms. The sealing design itself is not published.
At rest
Ciphertext on the board
Stored on the board in encrypted form, under a key that belongs to that chip alone, so a copied file opens nowhere else. Read back from a BENTO HMI Kit on 27 September 2026, the stored file contained none of the model's 21,817 pieces.
In use
Decrypted only inside the chip
Decrypted only into on-chip memory for the Ethos™-U55 NPU; a changed byte stops the model loading.
TodayRunning on the BENTO HMI Kit: sealed deploys over MQTTS since 21 September 2026, and over USB from the Edge AI Store, stored encrypted, since 27 September 2026. Secure boot and a closed debug port are set on every BENTO device we deliver. Until the console lock ships, code run through a board's own console can still reach a running model.
At delivery, and next
Set on every device we deliver.
- Today
Secure boot: the secure-core image is verified with our OEM key before it starts, on every BENTO device we deliver.
- Today
The production lifecycle state, with the key holder's debug port closed, on every device we deliver.
- Roadmap
Next: signed application and Cortex®-M55 images, and a locked console.
- Today
Signed and sealed models required, on every device we deliver.
The silicon
Infineon PSOC™ Edge E84.
BENTO runs on Infineon's PSOC™ Edge E84: an Arm® Cortex®-M55 with an Arm® Ethos™-U55 NPU, beside an Arm® Cortex®-M33. Its security certifications belong to Infineon's silicon; BENTO builds on them and does not claim them as its own.
Report a vulnerability
Tell us first.
If you believe you have found a security issue in BENTO, the Edge AI Store, the Edge AI Trainer or this website, please tell us privately before you tell anyone else.
- Describe what you found, how to reproduce it and what an attacker could do with it.
- Do not access, change or delete data that is not yours, and do not run tests that degrade the service for others.
- Give us reasonable time to fix it before you disclose it.
We will acknowledge your report, keep you informed, and credit you if you wish.