Hardened by default
Kernel lockdown, mandatory access control, FIPS-validated crypto, encrypted root, zero ports exposed. Lynis scores 100 / 100 from the installer — not after weeks of tuning.
ECHAD OS is a hardened, rebranded Linux distribution audited to international standards — Common Criteria EAL4+, FIPS 140-3, ISO/IEC 27001, NIST CSF 2.0, SLSA L3. We ship it as a managed service in three editions, and the Sovereign tier lets you white-label the entire OS under your own brand.
Kernel lockdown, mandatory access control, FIPS-validated crypto, encrypted root, zero ports exposed. Lynis scores 100 / 100 from the installer — not after weeks of tuning.
Managed signing infrastructure, mirrored binary distribution, attestation logs, and rolling security advisories — all included in your subscription. You consume an OS, not maintain one.
Every artifact signed with cosign, accompanied by an in-toto attestation at SLSA Level 3. Reproducible builds, signed SBOMs and a transparency log — auditors verify what you actually run.
Mirrors in Kinshasa, Libreville, Douala, Nairobi and Cape Town keep traffic and signing on the continent. Builds, signatures and attestations live under your jurisdiction — not someone else's.
Sovereign-tier customers rebrand the entire OS — logo, splash, login manager, repository name, package signatures — from the portal. Download a personalized ISO that boots under your identity.
Stripped systemd unit graph, parallelised early-boot, kernel module pre-loading. Cold boot to login: ~11 s on bare-metal, ~6 s in a VM — measured, not marketed.
ECHAD OS is a proprietary, hardened distribution — not an open-source community project. We deliver it as a service in three commercial editions, each backed by Parousia Group's QTSP signing infrastructure.
Evaluation tier · for piloting and internal labs.
Production-grade managed OS for banks, telcos and platform operators.
White-label, jurisdiction-bound OS — your brand, your mirrors, your QTSP.
All editions are licensed proprietary software · distributed by Parousia Group · Kinshasa, DRC. Source code is escrowed but not redistributable.
Sovereign-edition customers configure their rebrand directly in the admin portal — and Parousia's build farm rolls a personalized ISO, signed by your own keys, distributed through your mirrors. Below is the live preview the portal shows you while you configure.
Every white-label parameter — name, splash, theme, repository host, signing key — is captured in a manifest. Parousia's build farm consumes the manifest, regenerates the OS artifacts in a hermetic sandbox, signs them with your HSM-stored cosign key, and publishes them to your mirror set. You receive an ISO that boots under your identity end-to-end.
Every ECHAD OS release is benchmarked against the public Lynis hardening suite. We ship at 100 / 100 the moment the installer finishes — independently reproducible by your audit team.
| Capability | Ubuntu Pro 24.04 | RHEL 9 | SUSE 15 | Windows Server 2022 | ECHAD OS 1.0 |
|---|---|---|---|---|---|
| Lynis hardening · default install | 84 / 100 | 87 / 100 | 89 / 100 | 71 / 100 | 100 / 100 |
| SLSA supply-chain level | L2 | L2 | L2 | — | L3 · attested |
| FIPS 140-3 validated | paid add-on | ✓ | paid add-on | ✓ | ✓ built-in |
| Common Criteria evaluated | EAL2 | EAL4+ | EAL4+ | EAL4+ | EAL4+ |
| White-label rebrand by customer | — | — | limited OEM | — | ✓ portal-driven |
| Customer-owned signing keys | — | — | via contract | — | ✓ HSM-backed |
| Default LTS window | 10 yrs | 10 yrs | 13 yrs | 10 yrs | 10 + 4 yrs |
| Mirrors on-continent (Africa) | 1 | 0 | 0 | 2 (Azure) | 6 nodes · 5 countries |
| Delivery model | subscription | subscription | subscription | per-core licence | OS as a service · 3 editions |
| Origin · jurisdiction | UK · Canonical | US · Red Hat / IBM | DE · SUSE | US · Microsoft | CD · Parousia Group |
Sources: vendor security guides (Aug 2025), Lynis 3.1.1 default scan, public SLSA self-attestations. Methodology · verify.html.
The first Linux we have been able to point at a sovereignty audit and watch the auditors hand the report back signed. The SLSA L3 attestations changed the conversation entirely.
We rebranded ECHAD OS as our internal "Konaté Cloud OS" on Sovereign. Auditors saw our keys, our mirrors, our jurisdiction — and the build farm stayed Parousia's. Best of both worlds.
Reproducible builds and the transparency log are non-negotiable for us. ECHAD OS is the only distribution that ships them by default — and lets us sign the artifacts with our own HSM.
lockdown=confidentiality, kASLR + FG-KASLR, SLAB hardening, BPF JIT off by default, BTI/PAC on arm64. Modules signed with the Parousia kernel-modules key (rotated every 90 days). Boots from vmlinuz-6.6.32-echad-hardened.ProtectSystem=strict defaults, journal sealed and forwarded to the audit subsystem. SELinux in enforcing from boot. AppArmor profiles available as an optional alternative..deb is signed with cosign in addition to the repository signature. SBOM (CycloneDX) shipped per package and per release. Sovereign-edition customers sign with their own keys.brand.manifest.yaml via the portal — Parousia's build farm regenerates initramfs splash, plymouth theme, GDM3 banner, GNOME wallpaper, apt sources, kernel ID_LIKE, OS-release NAME/HOME_URL/SUPPORT_URL, and re-signs every artifact with the customer's HSM key. Source remains Parousia's.Community ISO is gated behind a 90-day evaluation key. Enterprise & Sovereign run through our procurement workflow. Every artifact is signed SHA-256 + GPG + cosign with SLSA L3 attestation.