Most security plans for office technology focus on keeping attackers out. A workplace device makes that harder. It sits on an employee’s desk, inside a company network, where people the maker never vetted can touch it.
Deep Care, a German startup that sells its Isa desk coach to businesses and home workers, built the device around a different question: what could an attacker get if they succeeded? Isa gives feedback on posture, hydration, and focus. Co-founder and CEO Milad Geravand said it was designed so a stolen or broken-into unit gives up very little.
This story explains how that thinking shaped Isa, what a 2020 outside review looked at, and what business leaders buying connected devices can take from it.
Planning for the worst day
In 2020, while Isa was still in development, researchers at Fraunhofer IOSB and the FZI Research Center for Information Technology reviewed the planned design through CyberProtect, a program funded by the Baden-Württemberg economics ministry, Geravand said. The review was a workshop with Deep Care’s engineers and a written analysis, finalized in September 2020. The reviewers concluded that the concept met privacy and security requirements, he said.
The review pictured four threats: curious insiders, such as bosses or colleagues; an attacker on the office Wi-Fi who can read or change traffic but cannot break proper encryption; a thief who takes a device and studies it in a lab; and a tampered software update. For insiders, the reviewers’ standard was that the device must never make it easier to monitor someone than what already exists, Geravand said.
The review assumed a stolen device would be taken apart and everything on it, including its settings, would become known. “That cannot be prevented, so the architecture is designed to make it not matter much,” Geravand said.
Takeaway 1: Collect less
“The main safeguard is that there is very little to extract,” Geravand said. Isa uses a depth sensor, which measures distances instead of taking pictures. He said it is a 240 by 320 sensor that cannot see through glasses or beyond 1.5 meters, and that it lacks the hardware an iPhone uses for Face ID. Reviewers judged its resolution unsuitable for identifying anyone, he said.
Employees can also choose to share monthly posture, hydration and focus trends with their company. The data travels as a QR code holding one encrypted paragraph of text, with no personal information or location. “It cannot be connected to a person, even if it was decrypted,” Geravand said. The review also looked at whether company-wide statistics could single out an employee. It called for voluntary, revocable participation and groups large enough that no one stands out, he said.
Takeaway 2: Keep one break-in from spreading
The review called for no secret shared across devices, encrypted saved data, and an operating system with unneeded services switched off, Geravand said. Breaking into one unit does not open other devices or any central service. He said there is no cloud account to breach and no database of users, and that Isa has no ports. Data leaves only through the QR code.
Takeaway 3: Lock down updates and track outside software
Wi-Fi is used only for software updates, and the device sends no user data over it, Geravand said. Updates travel over an encrypted connection, with the Wi-Fi treated as hostile. The device checks each update before installing it, using the operating system’s signed-update system, so a fake or altered update is rejected.
Isa runs on Android, which Deep Care did not write. “Control is a process, not a feature,” Geravand said. The company keeps a list of every software component on the device, watches for newly disclosed flaws, sorts out the serious ones and ships fixes.
What is not known
The review’s findings are in German and contain product roadmap details, so Deep Care cannot share them, Geravand said. That means its conclusions cannot be checked independently. The review also covered the planned design, not the finished device.
Geravand said the review was explicit that the design does not make the device risk-free. He named three remaining risks the company manages: physical theft, flaws in third-party software and the update channel.
Deep Care’s account points to questions any buyer of a workplace device can ask a vendor. What data does it collect? What does one stolen unit reveal? How are updates verified? Who tracks flaws in outside software? What evidence backs the claims?
Disclosure: This article mentions a client of an Espacio portfolio company.
