IEC 62304 · ISO 14971 · SaMD · SiMD
SOUP is software you didn't develop and can't document. TraceOS removes that condition. Your entire system — operating system, toolchain, and your application code — is built from source you hold, audited in isolation, and documented under your own life-cycle process. If we built it, it isn't SOUP.
Traceability for every line of code — in the image, the toolchain that built it, and your application.
110,000+
source-verified packages to compose your image from
22,950
files hashed and source-mapped in one appliance build
100%
license coverage across the entire image
2×
independent vulnerability scanners on every build
The Pain
The Solution
Every capability below works from the same audited build — one source of truth from kernel flag to regulatory document.
Define your device OS as a controlled blueprint: search 110,000+ source-verified packages, set kernel hardening flags, version every change.
Each build boots in isolation and is examined read-only by a separate audit appliance. The system under test never audits itself.
Every deployed file is SHA-256 hashed and linked to the exact upstream source it came from — tens of thousands of files per image.
Point TraceOS at your product repository. Your application is analyzed into the same V-model as the OS — no separate process for your own code.
Your test results are ingested and linked to the units, requirements, and risks they verify. Each component's own author-written suite is executed in the isolated audit harness and linked the same way. Whatever is still unsupported is flagged, and additional tests are written, executed, and documented — every record naming who wrote the tests and who ran them.
Hazards flow into an FMEA table linked to the requirements that mitigate them and the tests that verify those requirements — exportable as a provenance-stamped risk report.
Two independent scanners match current CVEs against the exact package versions you shipped, ranked by CVSS — continuously, not just at release.
A complete SBOM with CPE/PURL identifiers on every build, plus automated license detection with 100% coverage and explicit pass/fail status.
Why is this package on my device? A navigable runtime dependency tree with measured sizes answers it in two clicks.
User needs, requirements, and unit designs generated from the audited system — every artifact carries its data provenance and passes human review before approval.
The approved record assembles into a Design History File on recognized IEC 62304 documentation structures — exported as a complete release package in one click.
An interactive chain from user need to verified source unit to test evidence — every link navigable, with gap analysis for anything left unproven.
Because TraceOS built the system, it can show its working — for every licence, test, link, and risk.
Every licence in the build is broken down into what it permits, what it demands of a release, and what it withholds — so an obligation such as source disclosure or installation information is visible before you ship, not after.
Your own test results are absorbed first. TraceOS then runs each component's own author-written suite in its isolated audit harness, detects what the two still leave unsupported, and writes, runs, and documents additional tests to close it — every count naming who wrote the tests and who ran them.
Open any edge in the traceability chain and TraceOS says why it exists — how it was placed and when — and flags every requirement whose supporting evidence is still missing.
Each hazardous situation in the ISO 14971 risk report links to the package and source line it arises from, and to the mitigations planned against it — so a risk is never an unanchored spreadsheet row.
Autopilot
Define the image. Point at your repository. TraceOS runs the rest — build, audit, analysis, documentation, and Design History File assembly — with no human action on the critical path. Your reviewers work in parallel, tracked by the system, never blocking the pipeline.
BlueprintBuildAuditAnalysisTestsDocumentsDHF
Continuous Compliance
Compliance evidence is usually write-once — accurate the day it was signed, decaying ever after. In TraceOS the entire process is executable. When deeper analysis or better audit tooling arrives, re-run everything against an existing product with one click — and measure exactly what improved.
See how Continuous Compliance works →The full pipeline — build, audit, analysis, documentation — re-executes on a shipped product without a project restart.
Gap reports and build-over-build deltas show, in numbers, how risk mitigation deepened, traceability extended, and test coverage closed.
Evidence is a standing state, not an annual effort — the record your auditor sees is the record the system maintains every day.
The chain of trust is not tied to one build system — or to Linux.
Yocto can build your device — proving what it built is harder. See where Yocto's traceability leaks, and how TraceOS closes every one of them.
TraceOS for Yocto teams →
Gateways, routers, and companion devices deserve the same evidence as the device itself. Extend the chain of trust to Liminix-built firmware.
TraceOS + Liminix →
Running an RTOS or another kernel entirely? The audit model — source-verified builds, isolated inspection, linked evidence — is not Linux-specific. Talk to us.
See the whole chain on a real device image — from package search to the exported Design History File — in one short demo. Then run it on yours.
Request a Demo