New CRA & EN 18031 readiness for EU-bound devices →

Connected energy & industrial systems, silicon to cloud.

Firmon is the embedded-to-cloud team for the energy and industrial world. We design the hardware, write the firmware, ship the gateways — and get connected devices ready for the EU Cyber Resilience Act. One team, every layer of the stack, delivered from Da Nang, Vietnam.

Taking projects for [MONTH YEAR]
Start a project with us
Or see what we ship →
L5 — CLOUD
Fleet dashboards & analytics
TS · PG
L4 — API
Telemetry · OTA · Registry
MQTT · REST
L3 — EDGE
Linux gateways · Buffering
i.MX · CM4 · Yocto
L2 — FW
BMS loops · Modbus · Secure boot
STM32 · ESP32
L1 — HW
PCB · Cellular · Sensors
4G · LoRa · CAN
> stack.map Silicon → Cloud

Hardware we design, build, ship.

Three product lines in active development. All embedded-to-cloud, all built for conditions where downtime costs real money. Available as finished product, white-label, or OEM reference designs.

01 — Flow Sensing

FM-C25

Clamp-on ultrasonic flow meter for industrial liquid monitoring. STM32-based with on-device signal processing. Non-invasive installation, no pipe cutting.

02 — Connectivity

GW-5G Gateway

LoRaWAN + 5G cellular gateway for remote monitoring of renewable energy assets, battery storage, EV infrastructure. Linux edge, signed over-the-air updates.

03 — Edge AI

CAM-AI

Edge-AI industrial camera for safety and process monitoring. On-device inference, cellular backhaul, ruggedized for factory environments.

What we actually do.

No consulting fluff. Four layers, one team. We handle each layer in-house with a trusted contractor network for scale.

// 01

Hardware Design

PCB design, schematic review, DFM for low-to-mid volume industrial production. Altium, KiCad.

// 02

Firmware

STM32, ESP32, RP2040, embedded Linux (i.MX, CM4, Jetson, Yocto). Real-time systems, cellular stacks, LoRaWAN.

// 03

Edge-to-Cloud

Telemetry pipelines, device management, OTA updates, dashboards for fleet operations at scale.

// 04

Device Security

Secure boot, key provisioning, signed OTA, TLS/mTLS, SBOM and vulnerability handling for connected fleets.

Selling connected devices into the EU? Get CRA-ready by design.

The EU Cyber Resilience Act and the RED cybersecurity rules (EN 18031) now apply to chargers, battery gateways, inverter monitors and industrial sensors alike. We are engineers, not auditors: we find the gaps in your firmware and fix them — secure boot, signed updates, SBOM, vulnerability handling — and hand you the evidence your conformity file needs.

1 Aug 2025
In force

RED cybersecurity · EN 18031

Internet-connected radio equipment placed on the EU market must meet the RED delegated act. EN 18031-1/-2/-3 is the harmonised route.

11 Sep 2026
In force

CRA vulnerability reporting

Actively exploited vulnerabilities and severe incidents go to ENISA within 24 hours — including products already shipped.

11 Dec 2027

CRA full application

Essential cybersecurity requirements and CE marking apply to every product with digital elements sold in the EU.

How to work with us
Start here

CRA & EN 18031 gap assessment

We review one product — hardware, firmware, update path and backend — against the CRA essential requirements and EN 18031, and tell you exactly what to fix and in what order.

ScopeOne product
Duration2–3 weeks
Price[FIXED PRICE]
  • Threat model and attack-surface map (debug ports, radios, protocols, OTA, cloud API)
  • EN 18031 mechanism-by-mechanism assessment
  • Gap report with a prioritised remediation roadmap
  • Walk-through call with your engineering team
Book a gap assessment

SBOM & vulnerability pipeline Remediation

SBOM generated on every release build (Yocto, ESP-IDF, backend), scheduled CVE scans, and a PSIRT process that meets the 24-hour reporting clock.

Secure boot & signed OTA Remediation

Secure boot, flash encryption, locked debug and signed, rollback-protected updates on ESP32, STM32 and i.MX / Yocto targets.

EN 18031 technical evidence Documentation

Threat model, mechanism mapping, test evidence and user security guidance, structured for your self-declaration or your lab.

Long-term security maintenance Retainer

Patching, kernel and Yocto upgrades for products already in the field, through the support period you declare.

The process
  1. Scoping call

    30 minutes. Your product, markets, radios and timeline. We tell you honestly whether we're the right fit.

  2. Gap assessment

    Fixed scope and price. You get the report and roadmap whether or not you continue with us.

  3. Remediation

    Sprint-based firmware and pipeline work, reviewed with your team, in your repositories.

  4. Hand-over

    Evidence pack, keys and processes handed to you — plus optional maintenance through the support period.

What we are not

Firmon is not a notified body or test lab. We prepare your product and technical evidence; the declaration of conformity and any third-party assessment stay with you and your lab.

Who it's for

Hardware teams of roughly 10–200 people shipping connected devices into the EU — EV charging, battery storage, solar monitoring, industrial sensing — without an in-house embedded security team.

Proof

Our own gateway goes through the same process. Case study: [CASE STUDY URL] · Sample report: [SAMPLE REPORT URL]

10+
Years in embedded
3
Continents deployed
5
Stack layers in-house
24h
First response time

Founded in 2023, shipping since.

Firmon is a boutique hardware and firmware team based in Da Nang, Vietnam — a brand of KITATEK Co., Ltd. We came out of a decade of industrial IoT work — LoRaWAN gateways, embedded Linux, production firmware — and focus on the energy and industrial sector.

One technical lead, trusted contractor network. Firmon is led by Le Minh Tan, embedded systems engineer with 10+ years shipping production firmware and hardware across Vietnam and Australia. Delivery is backed by a vetted network for PCB, firmware, and cloud scale-up.

Why Vietnam. Hardware economics work here. Our contractor network, supply chain, and local manufacturing partnerships give us 2-3× cost advantage over similar shops in SG or AU — without the quality tradeoff. Every product we ship is designed, prototyped, and validated in-house in Da Nang. Our working day overlaps the European morning.

Why AI-native from day one. We use Claude heavily across the stack: firmware code generation, datasheet analysis, protocol reverse engineering, and technical documentation. This isn't a bolt-on — it's how we move faster than hardware shops 10× our headcount.

▸ Milestones
2023

KITATEK Co., Ltd. founded

Da Nang, Vietnam. Focus: industrial IoT hardware for the energy sector.

2024

First production deployments

LoRaWAN gateway deployments across Vietnam and Australia.

2025

Product line expansion

FM-C25 ultrasonic flow meter and edge-AI camera in development.

2026

Firmon brand & CRA readiness

KITATEK rebrands its engineering services as Firmon and launches CRA & EN 18031 readiness for EU-bound devices.

Who we build for.

Industries where a dropped telemetry packet means a missed alert, a failed OTA means a truck roll, and a battery anomaly missed means fire risk.

Renewable Energy
Battery & EV
Industrial Monitoring
OEM Integration
White-label Hardware
EU-bound Devices (CRA)

Have a device that needs to ship — or ship into the EU?

Whether it's a BMS that needs cloud visibility, a renewable site that needs remote management, or a connected product that has to be CRA-ready — let's talk about fit.

tan@firmon.io