Where KEMARO Stands: Our Regulatory and Security Position

Connected equipment is now a procurement question, not just an engineering one. Here is our position, in writing.

Over the past several weeks we have been asked the same set of questions by customers, prospects and channel partners across North America. They are fair questions, and they all point in the same direction: what happens to our data, and can we still buy this equipment?

Rather than answer them one conversation at a time, we have put our position in writing. Thomas Oberholzer, CEO of KEMARO Inc., has issued a regulatory and security position letter for customers and channel partners. This page summarizes it. The letter itself is available on request and is written to go straight into a vendor review or security questionnaire.

What changed

On July 28, 2026, the Federal Communications Commission added foreign-produced advanced robotic devices to its Covered List. Press coverage has focused on humanoids and quadrupeds, but the underlying definition is broader and reaches a wide range of connected mobile equipment.

The action applies to new equipment authorizations. It does not withdraw or otherwise affect authorizations granted before that date.

Where the K900 stands

The KEMARO K900 is designed and manufactured in Switzerland and holds FCC equipment authorization. It was authorized prior to the FCC's action and remains eligible for importation, marketing and sale in the United States.

Where your data lives

KEMARO robots store operational data on servers located in Switzerland, governed by Swiss data protection law (FADP/DSG) and operated in alignment with GDPR.

That is a jurisdiction question rather than a hosting question, and the two are often confused. Which cloud provider holds the data matters far less than which legal framework governs access to it.

How the robot connects — and what it does not capture

The robot does not need connectivity to operate. Its default connection is cellular with SIM-based authentication, with WiFi optional. Either way, the connection is used only to report to the KEMARO Sphere platform and receive software updates. It is never required for core operation.

Data in transit is encrypted, using TLS certificates and per-device credentials between the robot and Sphere, and HTTPS between Sphere's frontend and backend.

KEMARO robots navigate using LiDAR and 3D sensors rather than cameras. They do not capture visual records of your facility layout, your products or your people. The most reliable way to protect data is not to collect it in the first place.

Who can reach the robot remotely

Software updates are delivered over the air, two to three times per year, and can be triggered for an individual robot rather than pushed across a fleet. Third-party access is limited to KEMARO-provided remote support through a secure tunnel, and requires the customer's prior approval each time.

Independently audited

KEMARO's information security management system is certified to ISO/IEC 27001:2022, covering software development, IT operations and administration, and the KEMARO Sphere cloud platform. The certificate was issued by an accredited independent certification body and is maintained through annual surveillance audits over a three-year cycle. A copy is available on request.

Certification applies to the management system that governs how information security risk is identified and controlled. It is not a claim that any system is immune to every threat, and it does not replace your own obligations. What it does provide is audited evidence rather than a marketing assertion — something your security team can build their own review around.

What to ask any vendor

We would encourage you to hold every supplier on your shortlist to the same standard, including us. Six questions worth asking before connected equipment goes on your floor:

• Where is the data stored, and under which legal jurisdiction?

• What does the machine actually capture — and does it use cameras?

• Does the equipment still work if it is disconnected from the vendor's cloud?

• Who can reach the machine remotely, and does it require your approval each time?

• Will the vendor put its regulatory position in writing, signed?

• Is any of it independently audited against a published standard?

If a supplier cannot answer all six, that is useful information.
‍

For technical or procurement diligence questions, contact Graham Callaway, or request a copy of the full letter below.

‍