Edge, IoT & Compute · Module
One3 Box Manager
Run One3 on premises or air-gapped, with updates you approve
One3 Box Manager is planned to operate One3 Box appliances over their whole life: signed releases, customer-approved updates, health checks, consented diagnostics and licences that never lock data. It is included with a One3 Box deployment.
Two kinds of box
One3 Box comes in two planned profiles. A sovereign cell box runs a tenant's full One3 cell on premises or air-gapped, with local open-weight models. An edge site box runs site workloads (Vision AI pipelines, IoT edge rules, the Edge Sync relay) for connected tenants. Hardware comes through certified partners; One3 does not manufacture appliances. A One3 Box deployment requires the Enterprise plan's Sovereign isolation tier and a signed licence.
Software you can verify
Platform, Packs, models and edge workloads ship as signed bundles with an SBOM. Signature and SBOM are verified on the box before install, and a failed check blocks the install. Air-gapped sites import through a transfer gateway with malware scanning, checksums and dual approval. A CVE feed is matched against installed SBOMs, with an exposure report per box and patch SLA tracking per contract.
Updates under your control
Every install on a sovereign box needs approval by a customer role with a second factor. Edge boxes can auto-approve patch releases by customer policy. Pre-checks require a fresh backup, capacity and health; installs run in phases with health gates and roll back automatically, preserving data written after the start.
Support without silent access
Diagnostics bundles are generated locally, redacted, previewed by the customer and exported only after approval. One3 support access is requested with purpose and scope, approved by the customer, time-boxed, recorded and revocable. Health uploads from connected boxes carry operational metrics only, never business records or personal data.
Licences that never lock data
The licence file is validated offline. After expiry and grace the box enters read-only mode: data stays viewable and exportable, and security patches still install. A renewal file restores full mode without reinstall. Backups are encrypted with customer-held keys, and restore drills are recorded.
Features
What One3 Box Manager includes
Appliance registry
Profile, hardware spec, serial, partner, site, network mode (connected, intermittent, air-gapped) and contacts.
Provisioning and attestation
Sealed bootstrap bundle bound to one tenant and serial, hardware attestation where supported, first-boot checks.
Signed release bundles
Bundles with SBOM verified before install; offline transfer procedure for air-gapped sites.
Release channels
LTS and standard channels, security-fix fast path, rollout rings and maintenance windows.
Customer-approved updates
Second-factor approval for sovereign boxes; auto-approve policy option for edge-box patches.
Update orchestration with rollback
Pre-checks, expand/contract migrations, health gates and automatic rollback.
Health checks
Disk, memory, GPU, temperature, power, services, replication, backup age and certificate expiry on a local console.
Consented diagnostics
Locally generated, redacted, customer-previewed bundles exported only after approval.
BoxLicense
Signed licence with offline validation; expiry degrades to read-only, never data lockout.
On-prem backup and restore
Scheduled backups to customer storage with customer keys and recorded restore drills.
Local identity and key management
Box identity realm federated to AD, LDAP or SAML; customer HSM/KMS or OpenBao on box with rotation records.
Model bundles
Open-weight models with licence records, evaluation results and hardware fit checks.
Edge fleet management
Groups, configuration templates and workload placement across hundreds of edge boxes.
Remote support, CVE tracking and evidence export
Time-boxed recorded support sessions, CVE exposure per box, and patch, backup and access evidence exported to GRC.
Workflow
Signed update to a sovereign box
- 1
One3 publishes a signed bundle and SBOM
- 2
Connected boxes receive it on the channel; air-gapped sites import through the transfer gateway
- 3
Signature and SBOM verified on the box
- 4
Customer reviews notes and approves
- 5
Pre-checks for backup age, capacity and health
- 6
Phased install with health gates and automatic rollback
- 7
Evidence recorded
Workflow
Consented diagnostics and support
- 1
One3 support requests diagnostics for an incident
- 2
Customer admin generates the bundle on the box
- 3
The bundle is redacted and previewed
- 4
Customer DPO reviews and approves or rejects
- 5
Approved bundle exported with hash and logged
AI
AI skills and Digital Employees
Release impact summary
Summarises CVE delta, migrations, breaking changes and rollback target for the approver; no approval authority.
Health anomaly detection
Works on operational metrics only: disk, thermal, inference latency, backup age, certificate expiry.
Diagnostics redaction assistance
Finds personal data, secrets and business records in a bundle; a missed-redaction finding blocks export.
Patch prioritisation
Maps CVEs to the components a box runs and proposes a patch order with SLA risk.
Local model bundle advisor
Shows which open-weight bundles fit the box's memory and licence position.
Digital Employees that use this module
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
Does One3 sell the hardware?
No. Hardware is sourced through certified partners. Box Manager is included with a One3 Box deployment.
Can One3 push an update without our approval?
Not to a sovereign box. Every install needs customer approval with a second factor. Edge boxes follow your own auto-approve policy for patch releases.
What happens if our licence expires?
The box degrades to read-only. Data stays viewable and exportable and security patches still install. It never deletes or encrypts your data.
Can an AI agent approve box changes?
No. Update approval, diagnostics export, support-session approval and licence changes are human Actions with named customer approvers.
See One3 Box Manager in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.