Products / Devices & developers

Hoq Devices

Pair a Linux box once, then give it a job and lease its hardware.

Open Hoq DevicesLive15 featuresdevices.hoq.app

What it does

You install the hoq-deviced agent on a Linux box. It shows a six-digit code, you claim it in the Devices console, and it collects its credential once. From then on it reports what hardware it has, and reports again when you plug something in.

You give the box a role: scan documents, play signage, serve printers, stream barcode scans, forward Bluetooth sensors, drive a coffee roaster or show a station screen. The agent fetches that role's software and refuses it unless it carries an ed25519 signature from a key built into the agent. The signing key never sits on the Devices server or on a box.

Each role runs as its own systemd unit with a sandbox the agent writes from what the role declares: the paths it may write, the groups it needs, whether it may show the screen. Apps can lease the display, a scanner, a printer or a serial port separately, so one box serves two apps at once.

The box keeps itself. It installs security updates on its own, caps its log size, and reports free disk, temperature and pending updates. It never reboots on its own; it tells you a reboot is needed.

In numbers

7roles a box can be given

3versions of each role kept on the box for fallback

15 minbefore an unused pairing code expires

200 MBcap on the box's system log

Specifications

Pairing	Six-digit code, valid 15 minutes, 5 tries. The credential is collected once.
Signed software	Every role payload must carry an ed25519 signature from a key compiled into the agent. The download server is not trusted.
Closed role list	intake, screen, print, vision, sensor, roast, station. The server names a role, never a URL or a command.
Closed command list	Printer add, remove, default, pause, resume and probe; screen mode; screenshot; reboot. There is no remote shell.
Sandbox	Each role runs as its own systemd unit with read-only system paths, a private /tmp, a memory cap, and only the paths it declared writable.
Updates	Security updates install on their own; nothing else does. The box reports when a reboot is needed and never reboots by itself.
Rollback	Each role keeps the running version and two earlier ones on the box.
Hardware leases	Display, input, printer, scanner, serial, audio and Bluetooth can each be leased by a different app.
Agent	One Rust binary for Linux with systemd.

Features

15 features, all shipped. Listed from the product's code and documentation; each row shows the day it was last checked.

Enrolment 3
Pair by code	The box shows six digits; you claim it in the console.
One-time credential	The box collects its credential once; a second pickup fails.
Hardware manifest	The box declares its capabilities and ports, and declares again when hardware changes.

Roles 5
Assign a role	Give a box one of seven jobs from the console.
Signed payloads	Unsigned or wrongly signed payloads are refused before unpacking.
Declared permissions	A role gets write paths, groups, network control or the display only if it asks for them.
Reconciled every poll	Units and permissions are rewritten each poll, so a change reaches boxes without a new release.
Reported version	The version shown is read from the running process, not from what the installer intended.

Hardware 3
Capability leases	Apps lease a display, input, printer, scanner, serial port, audio or Bluetooth separately.
Session or permanent	A session lease ends when the app stops renewing; a permanent one ends when released.
One kiosk	The agent owns the box's single kiosk screen and shows whichever role holds the display.

Upkeep 4
Security updates	Security updates only, applied automatically.
Health report	Disk free, temperature, pending and security updates, reboot needed.
Commands	Queue printer, screen mode, screenshot or reboot commands; each is delivered once and acknowledged.
Separate screen user	The screen and console run as their own user with no sudo.

Works with

Hoq ScreenThe screen role installs and runs the signage player.
Hoq VisionThe vision role streams camera and barcode scans to Hoq Vision.
Hoq SensorThe sensor role forwards nearby Bluetooth sensors to Hoq Sensor.
Hoq IntakeThe intake role scans and files documents into Hoq Intake.
Hoq PrintThe print role serves the printers the box can reach.

Your data

Where it is kept	Box records, leases and commands are in Hoq Devices' database. Role data stays on the box in the paths the role declared.
Getting it out	Not documented yet.
If you leave	A box can be revoked; its credential stops working. Account closing is not documented.

APIs and standards

Appliance REST: /v1/appliance/enroll, /pickup, /heartbeat, /manifest
App REST: /v1/appliances, /v1/leases with a Bearer key (scope devices:use)
Claim: POST /v1/claim (scope devices:admin)
Standard: ed25519
Standard: systemd
Standard: IPP
Standard: polkit

Compared

Checked 2026-11-01	Hoq Devices	balenaCloud	Mender
Price	Not published yet	Free for 10 devices; Prototype $159/month for 30 devices¹	Basic $34/month up to 50 devices²
Operating system on the device	Any Linux with systemd	balenaOS required³	Any embedded Linux; Yocto and Debian paths documented⁴
Signed updates	Every payload ed25519-signed, key built into the agent	OS signed on secure-boot devices; app containers not signed⁵	Signed artifacts on all tiers⁶
Rollback	Running version plus two earlier ones kept on the box	Automatic host OS rollback on failed health checks⁷	A/B partitions with automatic rollback²
Remote shell	None by design; fixed command list	Web terminal and SSH³	Paid Troubleshoot add-on²
App packaging	Signed role payloads run as sandboxed systemd units	Docker-compatible containers³	Optional containers through Update Modules²
Self-hosted server	No, hosted only	openBalena, open source¹	Open-source server; on-premise on Enterprise⁴
Per-app hardware leases	Display, scanner, printer, serial and more leased separately	Not published³	Not published⁴