How your boxes are set up, and how they keep data safe

What goes in your office, how it connects, and what protects your client data. Written for you and for whoever checks your IT.

No server room needed

The simplest setup
Desktop boxes on a UPS

Your boxes sit on a desk or shelf in your office. A UPS (a battery backup) keeps them running through a short power cut. Unless you choose air-gapped, an encrypted copy goes to the cloud each night.

If you have a rack
Installed in your rack

Already have a server rack? We fit your boxes on a shelf in it.

You choose what touches the internet

Should your team be able to open things from outside the office? Pick one of three options. You can change this later.

Backups: hourly snapshots on the box and a nightly encrypted cloud backup.

Good for: companies whose staff work from home or visit clients a lot.

Backups: hourly snapshots on the box and a nightly encrypted cloud backup.

Good for: most accounting companies. Everyday work from anywhere, sensitive records stay in the office.

Backups: hourly snapshots on the box, plus a backup box in your office (needed when air-gapped, at extra cost).

Good for: the strictest privacy. We can't help remotely, so all our help is on site.

Connected: Use it from anywhere

Works like the online tools you use today. Your team signs in and opens files from the office, from home or on the road. The files stay on your box in the office.

From home or on the road

  • Everyday files
  • E-signing
  • Sensitive records
  • AI box

Staff outside the office sign in and connect over an encrypted link.

Only in the office

  • Nothing. Everything also opens from outside.
Split: Some from anywhere, some office only

You decide what opens from outside and what stays office only. For example: everyday files from anywhere, sensitive records and the AI box only in the office.

From home or on the road

  • Everyday files
  • E-signing

Staff outside the office sign in and connect over an encrypted link.

Only in the office

  • Sensitive records
  • AI box

Just an example. You pick the side for each tool.

Air-gapped: Office only, never online

After setup, your boxes are cut off from the internet. No one outside the office can reach them, and your team uses them only in the office.

Not available

  • E-signing
  • Documents by email
  • Sign-in with an outside login
  • Cloud backup
  • Industry updates

These all need the internet. Updates come on a drive: we bring it if we support you, or you apply them yourself.

Only in the office

  • Everyday files
  • Sensitive records
  • AI box
BackupsYour box keeps two copies: one on the box every hour, and one in the cloud every night, encrypted. Want a third? Add a backup box. Air-gapped boxes skip the cloud: the backup box sits in your office instead.
Privacy lawYour data stays on hardware you own in the US. Only the encrypted backup goes to a data centre in the US. Air-gapped, nothing leaves. That makes state and industry privacy rules simpler to meet.

How your data is protected

Built on proven open source. We set it up and lock it down. Where you have a choice, like how the box connects or where backups go, we do it your way.

On your premises

The box runs on hardware you own, in the US.

Files, records and activity logs stay on the box in your office, not in someone else's cloud. Only the encrypted backup leaves. Air-gapped, nothing leaves.

Your choice of internet

Connected, split or air-gapped.

You decide what staff can open from outside the office. On a split setup, the office-only side can't reach the internet at all. You can change this later.

One login per person

Linked to the work login you already use, or one we set up.

Each person signs in once for every tool on the box. Remove someone once and their access ends everywhere.

Our access, your rules

Logged, and you can switch it off.

If we support you, our team keeps access to look after the box. Every session is logged, and you can switch it off. If not, we remove our access at handover.

Encrypted on disk

If the box is taken, the data can't be read.

The disks are encrypted. The box unlocks itself only in your office, so it restarts without anyone typing a password. Anywhere else, it stays locked.

Tested backups

A restore works when you need it.

Backups run on their own and are encrypted before they leave the box. If we support you, we test a restore every quarter.

Who did what

Who signed in and what they did.

The box records sign-ins and what people opened or changed, for as long as you choose. Useful for your data protection duties, and for "who deleted this file?".

Updates applied and checked

Security updates, checked after each one.

If we support you, we apply security updates and check the box still works after each one. If not, you run them yourself, or call us and pay per fix.

What we handle, and what stays with your company

Personal data stays on hardware you own in the US. Only the encrypted backup goes to a data centre there. The legal duties stay with your company, so check with your lawyer.

What we set up

If we support you after handover, we keep these running.

Encryption, two-step sign-in, access control, updates and tested backups Source (opens in a new tab) ↗
Activity logs of who signed in and what they did Source (opens in a new tab) ↗
Records kept as long as the law asks, then deleted on schedule Source (opens in a new tab) ↗
Evidence for your security program and risk assessment Source (opens in a new tab) ↗
Data stays in your office; only the encrypted backup goes to a US data centre Source (opens in a new tab) ↗

Stays with your company

Your duties under the Privacy law, each linked to the regulator's own guidance.

Write an information security program Source (opens in a new tab) ↗A written plan for how customer information is kept safe.
Name the person who oversees it Source (opens in a new tab) ↗One qualified person in charge of the plan, inside the company or outside.
Assess risks and train staff Source (opens in a new tab) ↗Check what could go wrong, put safeguards in place, and train staff.
Report a breach of 500 or more people to the FTC within 30 days Source (opens in a new tab) ↗If unencrypted data of 500 or more customers is taken, tell the FTC within 30 days.

Plug it in. We do the rest.

  1. Step 1

    Your box is ready

    Ours, from a retailer, or your own machine.

  2. Step 2

    Plug it in

    In your office: power, network, then run our installer.

  3. Step 3

    We set it up remotely

    Software, sign-in and your documents.

  4. Step 4

    We lock it down

    We test the backups and limit our own access.

  5. Step 5

    You own it

    The box and everything on it.

Short videos and clear guides

Staff learn at their own pace. Made for your setup, and updated when it changes.

Warranty

If our setup work has a fault, we fix it free. If the hardware fails, we handle the claim under the maker's warranty. Full terms are in your service agreement.

Just a quick chat

Tell us what you use today and what has to stay private. We'll suggest a setup and tell you what it costs. No obligation.

We're taking early interest now. Assessments start in early 2027.

What do you need? (optional)
Terms and conditions

We only use your details to reply about your assessment. Privacy policy

Straight answers

Anything else, just ask us.

Who can get into the business process box?

Your staff, each with their own sign-in. If we support you, our team keeps access to look after the box. Every session is logged, and you can switch our access off at any time. If not, we remove our access at handover.

Do you see our files?

We don't look at them, and we don't keep a copy. They stay on the box in your office. If we support you, we only sign in to maintain the box. Every session is logged, and you can switch our access off.

What if the machine is stolen?

The business process box is encrypted on disk, so the data can't be read. Your backups are encrypted too.

What if the power goes out?

Boxes we supply come with a UPS (a battery backup), so a short power cut doesn't stop work. If you use your own machine, we recommend one.

Who can see the logs?

Owners. Sign-ins and activity sit in one place you can search, kept for 12 months unless you choose otherwise.

Does this cover our data protection obligations?

Personal data stays on hardware you own in the US. Only the encrypted backup goes to a data centre in the US. We set up the technical safeguards, such as encryption, access control and logging, and look after them if we support you. Rules vary by state and industry. Companies that prepare tax returns are covered by the FTC Safeguards Rule. Check your overall position with your lawyer.