Free e-book: IEEE 802.15.4ab vs IEEE 802.15.4z

The phone is the key. We make it secure enough to ship.

Q: Can needCode implement CCC Digital Key?

Yes - needCode implements CCC Digital Key (Car Connectivity Consortium Release 3.0 and 4.0) as production firmware, combining UWB secure ranging with BLE discovery and pairing for phone- and card-as-key passive entry. We integrate the stack on target silicon such as Qorvo QM33/QM35 and NXP Trimension and own it through certification. As a certified Qorvo partner active in FiRa, we build to the standard rather than around it.

Q: What is Aliro and can needCode build to it?

Aliro is the Connectivity Standards Alliance's standard for access control, backed by major platform and lock vendors, which lets a phone or wearable act as a secure key for doors using BLE, UWB, and NFC. needCode builds Aliro-aligned smart locks and access systems, applying the same secure-ranging depth used for automotive digital keys. It is, in effect, the access-control counterpart to CCC Digital Key for vehicles.

Q: How do you prevent relay attacks on a digital key?

Relay attacks are prevented with distance bounding - confirming the phone is physically close, not merely reachable by radio - using UWB time-of-flight and BLE 6.0 Channel Sounding phase-based ranging. A credential only authorises when the device is genuinely present, which defeats the relay and replay techniques that open signal-strength-only keyless systems. needCode builds this into the ranging layer, including proprietary PBR solvers for ranging accuracy.

Q: Do you need UWB or BLE for a digital key?

A secure digital key uses both: BLE handles low-power discovery, wake-up, and the pairing and key-sharing flow, while UWB provides the centimetre-grade secure ranging that authorises hands-free access and resists relay attacks. BLE 6.0 Channel Sounding can add distance bounding to BLE-only designs where UWB isn't present. needCode designs the combination to match the product's security target and cost.

Q: Can needCode build phone-as-key for smart locks and access control?

Yes - needCode builds phone-as-key systems for residential and commercial smart locks and enterprise access, aligned to the Aliro access-control standard and combining BLE, UWB, and NFC. UWB proximity adds protection against tailgating and relay that a card swipe cannot provide. This builds directly on needCode's existing secure access-control and keyless-entry work.

Q: How is the digital key credential kept secure?

The credential is stored in a secure element and protected with attestation and signed firmware, so it cannot be extracted or cloned by software on the device. needCode designs secure boot and credential handling in from the first generation rather than retrofitting them after a security review. This is the architecture a digital-key certification and a security audit expect.

Q: Does a digital key work across Apple, Google, and Samsung?

A standards-based digital key is designed to interoperate across platforms - CCC Digital Key for vehicles and Aliro for access control are both backed by the major phone vendors precisely to avoid single-platform lock-in. needCode builds to these standards so a key works across ecosystems rather than only one. Platform-specific certification steps are handled as part of productization.

Q: What happens if the phone's battery dies?

Most digital-key standards include an NFC fallback so the phone can still unlock the vehicle or door from its reserve power even when the battery is otherwise dead, and a physical card can serve the same role. needCode implements this fallback path as part of the credential and access layer. It means a dead battery doesn't lock the owner out.

Q: Which chipsets do you support for digital keys?

needCode supports the UWB and BLE silicon used in digital-key systems, including Qorvo QM33 and QM35, NXP Trimension, and legacy Decawave DW1000/DW3000, plus BLE platforms from Nordic, ST, and Infineon. As a certified Qorvo partner with nine hardware-platform bring-ups completed, we start from chipset-level knowledge. We also provide a dedicated UWB protocol sniffer for interop debugging that the silicon vendors do not offer.

Q: Can you take a digital key through certification?

Yes - needCode provides pre-certification testing, lab preparation, and conformity support for CCC, Aliro, FiRa, Bluetooth SIG, and FCC/CE, reducing first-attempt failure rates. Automated test pipelines and standards-body membership are leveraged to shorten the path to certified firmware. Certification is treated as part of productization, not an afterthought.

needCode builds digital key and secure access systems - phone-as-key for vehicles, smart locks, and enterprise access - on UWB secure ranging and BLE 6.0 Channel Sounding. The convenience is easy; the security is the engineering. We build digital keys that resist relay attacks by design, meet CCC and Aliro standards, and survive a security audit. From an EU-based, certified Qorvo partner.

Book a discovery call

How a secure digital key works

We work with Industry Leaders

Anyone can make a phone unlock a door. Making it secure is the hard part.

Replacing a key or a badge with a phone is, on the surface, a solved problem - a BLE connection and a button will open a lock. The difficulty is everything that has to be true for it to ship: that a credential can't be relayed by an attacker standing between the phone and the lock, that it's stored where malware can't reach it, that it works across Apple, Google, and Samsung, and that it meets the standard a programme or a certification body will hold you to.

That's where the engineering lives, and it's a wireless and security problem before it's a product one. needCode builds the secure-ranging layer that makes a digital key trustworthy - UWB time-of-flight and BLE Channel Sounding distance bounding - aligned to CCC for vehicles and Aliro for access control, from a certified Qorvo partner with the UWB depth these systems depend on.

Relay-attack resistant

Distance bounding with UWB and BLE Channel Sounding - a credential only works when the device is actually there.

Standards-aligned

CCC Digital Key for vehicles, Aliro for smart locks and access, built to interoperate across platforms.

Secure by architecture

Secure-element credential storage, attestation, and signed firmware designed in - not bolted on after a pen test.

How a secure digital key works

A production digital key is four layers working together. We build all four - not just the convenient one.

BLE Discovery & Connection

Low-power BLE announces the device, wakes the system, and carries the owner-provisioning and key-sharing flow. The layer that makes a digital key convenient and battery-friendly - and the easy part most demos stop at.

BLE

UWB Secure Ranging

UWB time-of-flight measures the exact distance between phone and lock, authorising hands-free access only when the device is genuinely present. The layer that makes a digital key secure rather than merely convenient.

Ultra-Wideband

Relay-Attack Resistance

Distance bounding with UWB ranging and BLE 6.0 Channel Sounding defeats the relay and replay attacks that open signal-strength-only keyless systems - including the proprietary PBR solvers that make phase-based ranging accurate. The layer that makes a digital key trustworthy.

BLE Channel Sounding

Relay Attack Prevention

Credential Security & Standards

Secure-element credential storage, attestation, and signed firmware, aligned to CCC (vehicles) and Aliro (access), with NFC fallback for dead-battery entry. The layer that makes a digital key shippable and certifiable.

Standards & Certification

Building a digital key or access product?

Book a discovery call with our CEO

Book a discovery call

Where digital keys go

The same secure-ranging foundation powers digital keys across very different products. We've built the wireless depth each one needs.

Vehicle Digital Keys (CCC)

Phone- and card-as-key passive entry and start for vehicles, built to Car Connectivity Consortium Digital Key Release 3.0 and 4.0, with secure hands-free access and remote key sharing.

Automotive & SDV

Smart Locks (Aliro)

Residential and commercial smart locks on the Aliro standard - the Connectivity Standards Alliance's access-control specification combining BLE, UWB, and NFC for secure, convenient entry across platforms.

Smart Locks & Access Control

Enterprise & Building Access

Replace badges with phones and wearables for secure, auditable building access, with UWB proximity that resists tailgating and relay where a card swipe can't.

Smart Locks & Access Control

Asset & Personnel Tracking

Shared Mobility & Fleet

Secure, revocable digital key sharing for car-sharing, rental, and fleet, where credentials must be issued and revoked remotely, at scale, without a physical handover.

Automotive & SDV

Why digital key teams bring in needCode

The secure-ranging depth a digital key depends on

As the largest dedicated UWB team in Central Europe and a certified Qorvo partner, we build the time-of-flight ranging that makes a digital key secure - the hard part, not the BLE button anyone can ship.

Relay-attack resistance in the ranging layer

We implement distance bounding with both UWB and BLE 6.0 Channel Sounding, including proprietary PBR solvers for the integer-ambiguity problem that ranging accuracy depends on - depth NXP, TI, and Infineon don't have internally.

Standards across both worlds

Active in FiRa and the CSA, building to CCC for vehicles and Aliro for access - so your digital key interoperates across Apple, Google, and Samsung rather than locking into one platform.

Secure firmware, audit-ready

ISO/IEC 27001 certified, with secure boot, signed firmware, and secure-element integration designed in - the posture a digital-key security review expects to find.

Four ways to bring needCode in

From a security-architecture study to a standing team. We match the engagement to where the product is.

01 Feasibility & Security Architecture

Duration:
2–4 weeks
Best for:
Validating feasibility and defining the security and standards architecture (CCC/Aliro, threat model) before commitment
Deliverable:
Feasibility assessment, security architecture, threat model, certification path, leadership readout

02 Digital Key Stack Build

Duration:
Phased
Best for:
Building the BLE + UWB + secure-ranging + credential-security stack on target silicon
Deliverable:
A working provisioning system on target silicon

03 Productization & Certification

Duration:
Phased
Best for:
Taking a prototype to production-certified firmware
Deliverable:
Hardened firmware, CCC / Aliro conformity, FiRa / BT SIG / FCC / CE support

04 Embedded Team

Duration:
Multi-year, retainer-based
Best for:
Product companies who want a dedicated secure-wireless squad inside their program
Deliverable:
An embedded team in your cadence - the model behind the 30-FTE Qorvo programme

What we ship on

We pick the silicon and stack that match your product and its security requirements.

Standards

CCC Digital Key 3.0 / 4.0

Aliro (CSA)

FiRa

IEEE 802.15.4z / 4ab

Bluetooth SIG

Ranging & access

UWB time-of-flight (TDOA / TWR)

BLE 6.0 Channel Sounding (PBR)

NFC fallback

Silicon

Qorvo QM33 / QM35

NXP Trimension

Nordic

STMicroelectronics

Infineon

legacy DW1000 / DW3000

Security

Secure element

attestation

secure boot

signed firmware

TF-M

PSA Crypto API

RTOS

Zephyr

FreeRTOS

ThreadX

Case studies

needCode doesn't publish named digital-key programmes. What we can show is the UWB, Channel Sounding, and access-control capability a digital key is built on.

Qorvo: RF Leadership

Context: Rapid scaling for new chipset bring-up.

Scale: Grew from <10 to 30 FTEs.
Output: Supported bring-up of 9 new hardware platforms (SDKs, Drivers, Stacks).
Retention: Zero-churn core team retained for 5+ years.

Dedicated Development Center for RF Solutions

Bluetooth Mesh Smart Lighting Control System

Smart Lighting: Core R&D Extension

Context: Client needed deep, specialized expertise to pivot from proprietary tech to a new global standard.

Service: Deployed a dedicated squad of embedded engineers to function as the client's core R&D team.
Output: Co-authored official Bluetooth SIG protocols and delivered the world’s first certified BLE Mesh stack.
Value: Enabled the client to secure Series A funding and defined the industry standard for smart buildings.

Creative Werks: Innovation rescue

Context: Hardware obsolescence threatened production shutdown.

Action: Full-stack takeover (PCB redesign + Firmware + Mobile App).
ROI: 1230% ($1.6M value generated).
Speed: Payback period of 2–3 months.

NeedCode-case study - IoT Solution for Boat Lift Modernization - cover2s

PowerPollen: AgTech automation

Context: Lack of internal expertise stalled a critical automation project.

Action: Re-architected system using unified MCU and ISOBUS standards.
ROI: 13.8x ($2.9M value generated).
Impact: Enabled $1.9M increase in harvester value.

Strategic Partnership

needCode is an official business partner of Qorvo, bringing over 8 years of proven expertise and trusted service to the technology sector.

Check our performance

Members of the UWB Alliance

In 2025 we became a member of the UWB Alliance. This strategic step reinforces our commitment to pioneering Ultra-Wideband (UWB) technology.

Proudly Certified for Excellence and Security

needCode is officially certified for:
ISO 9001:2015 – Quality Management
ISO/IEC 27001:2022 – Information Security

ISO certifications reflect our focus on delivering reliable IoT solutions, smart product development, and secure technology services.

Testimonials

“I think the key takeaway from needCode is their ability to adapt and understand the customer's requirements. That took away probably a large portion of what could have been a lot of development time and expense for both companies.”

Bob Folkestad

President at Creative Werks

“One aspect that truly sets needCode apart is its profound expertise in firmware development. Their proficiency in various programming languages, embedded systems and hardware architecture is truly impressive. When faced with difficult problems, their strong problem-solving skills and analytical mindset shine through, allowing them to overcome obstacles with remarkable ease.”

Semeh Sarhan

CEO at Xtrava

“I worked with needCode while leading the NWTN-Berlin team in 2018. A big chunk for our FW development has been outsourced to them and they had proven to iterate very quickly, following specs and deliver on time. It was great working with them. I recommend working with needCode’s team on any Embedded SW development.”

Marco Salvioli Mariani

CTO at NWTN Berlin GmbH

“needCode Team proved to be one of the best engineers I have ever met. The part I like the most about the team is the more difficult an obstacle seems to be, the more motivated they were to find a solution and a way forward.”

Szymon Słupik

CTO at Silvair

“needCode is an outstanding partner. Their quick follow-up, scalability, and extensive professional network set them apart. Their expertise in wireless technologies has been valuable, supporting us from low-level drivers to architecture discussions.”

Tim Allemeersch

Director at Qorvo, Inc.

“needCode did a great job improving the firmware of the Vai Kai connected toys and developing new features, surpassing our expectations multiple times. I would definitely recommend hiring Bartek and needCode for the embedded software projects!”

Matas Petrikas

CEO & Co-founder at Vai Kai UG

Insights

Automating Bluetooth Qualification: From Weeks of PTS to an Overnight Job

There is a particular ritual in Bluetooth product development that anyone who has been through it remembers vividly. It is the manual qualification regression: sitting in front of a Windows machine running the Profile Tuning Suite, clicking through hundreds of test cases over the course of a week or two, interpreting results that range from […]

Documentation as a product: how good SDKs treat docs as code

The deliverable customers interact with most often is the one most commonly treated as a secondary artifact. Six document types, six audiences, and one release gate that fixes most of the failure modes. A semiconductor SDK can have an exemplary architecture, a thoughtfully versioned C API, a security framework that maps cleanly to PSA Certified […]

FAQ