Where your information sits, and who can reach it
Your firm's records, on your firm's premises
A firm evaluating software has to answer two questions for its own clients: where does our information sit, and who else can reach it. This page is written so you can answer both without ringing anybody.
What a firm actually gets
One firm, one installation.
Your firm gets its own installation. Not an account on a service other firms also use — an installation, on a machine you control, holding nothing but your own work.
- Your own server, in your office, your own rack, or with a hosting provider you choose.
- Your own database, holding only your clients and matters.
- Your own copy of every document, on storage that belongs to the firm.
- Your own backups, taken on your schedule and kept where you keep everything else.
- Your own web address and your own security certificates, so it looks and behaves like part of the firm.
Nothing in that list is operated by us, and none of it is shared with another firm.
The practical answer to "where is our data" becomes a room you can point at.
Working without us in the loop
It does not need us to be there.
Which modules your firm may run is carried in a signed file that your installation checks by itself. There is no call to us to authorise your work, no periodic check-in, and nothing of ours that has to be running for your firm to open a matter or raise a bill.
That matters on an ordinary Tuesday when somebody else’s service is having a bad day, and it matters for the firm that keeps its systems entirely inside its own network. Both are supported arrangements.
A module you have not licensed is simply not there — no screens, no menu entries, and nothing running quietly in the background.
Who can see what, and what is remembered
Access, and the record of it.
Getting in
People sign in with an email address and a password, and can be required to confirm with a code from their phone as well. Repeated failed attempts lock an account. An administrator can reset a password; nobody at our end can read one.
Seeing only what you should
Every module carries its own permissions — who may look, who may change, who may approve — and the firm decides which of them each designation gets. A supervisor approving a team’s week, a partner reviewing a matter and an associate seeing only their own entries are three different grants. The rules are enforced by the system itself, not merely hidden from the screen.
The record
Changes are recorded as they happen, with the person and the time against each one, and nothing is ever truly deleted. Sign-ins are recorded alongside. When somebody asks who altered a bill in March, the answer is a search rather than an investigation.
What we do not claim
Document access follows the matter it is filed under, so there is no per-document permission list yet. We hold no third-party security certification today, and we would rather say so than imply one. The full security review is kept with the software and can be shared under NDA during an evaluation.
Bringing a firm live
Four steps.
Provision a machine
A modest server inside your network, or with whichever hosting provider you already use. Everything it needs ships with it, or it uses what your IT people already run.
Install it as yours
One installation run, carrying your licence and your firm’s details — name, logo, address, GSTIN, financial-year convention and timezone. It is ready to use when it finishes.
Put it behind your own front door
Your address, your certificates, your network rules. From the outside it is an internal system belonging to the firm.
Import and go live
Clients, matters, people and rates first, then time and bills where the source data supports it, then one module at a time.
The detail your IT people will want
For your IT team.
Everything above, stated the way an engineer would want it. If you have someone who looks after your systems, this is the part to forward to them.
- Shape
- A single application process (a modular monolith), served from one container behind your own reverse proxy. Not a fleet of services.
- Platform
- .NET 10 and Angular. A Linux host with Docker.
- Database
- PostgreSQL — one database per installation, a separate schema per module, no foreign keys crossing between them.
- Cache & jobs
- Redis for cache, distributed locks, background-job coordination and real-time notifications. This is what lets the application tier scale out later without a rewrite.
- Background jobs run on Hangfire; the dashboard is deny-by-default and permission-gated.
- File storage
- A local volume, or any S3-compatible object store — MinIO on the firm's own hardware is the common arrangement.
- Licensing
- An Ed25519-signed licence file, verified locally against a public key embedded in the build. No activation call, no phone-home.
- Authentication
- JWT bearer with short-lived access tokens and rotating refresh tokens. TOTP two-factor with recovery codes, and lockout on repeated failures. Signing keys are generated per installation by the installer.
- Authorisation
- Permissions are declared by modules and assigned by core; every protected endpoint requires an explicit permission policy. The server is the enforcement point — the SPA's route guards are convenience, not a boundary.
- Audit
- Captured at the data layer via a SaveChanges interceptor plus auth events, with soft deletes and created/updated/deleted-by on every entity. Filterable in-app, exportable as CSV.
- Transport
- TLS terminates at your web tier with your certificates. Security headers and a content-security policy on both the API host and the web tier. The API is versioned at /api/v1 and throttled per client address. Uploads stream to the file store, size-capped at the web tier.
- Health
- /healthz for liveness and /readyz for readiness (database and Redis), so monitoring can tell "starting" from "broken".
- Upgrades
- A new image applied when you choose. Migrations run on boot under a distributed lock, so a restart is sufficient and two instances cannot race.
- Backups
- Scheduled database backups with restore tooling, in the deployment bundle.
What partners ask before signing
Straight answers.
Where exactly does our information sit?
On a machine your firm controls — in your office, in your own rack, or with a hosting provider you choose. Not in a shared service, and not mixed with any other firm’s records.
Can it work with no internet connection?
Yes. Your licence is a signed file the installation checks by itself, so nothing has to be confirmed with us over the internet. A firm running entirely inside its own network is a supported arrangement, not a workaround.
Who at your end can see our matters?
Nobody, unless you give us access for a support session. Nothing is sent to us, there is no shared database, and we have no console on our side that reaches into your installation.
What happens if we stop paying?
Licences carry an expiry. When one lapses, the licensed modules stop working and the installation falls back to the core — which means your records, your people and your history are all still there and still readable. It does not lock you out of your own files.
How do updates reach us?
Only when you choose. Nothing is pushed into your installation, so an upgrade can wait for a Saturday morning if that suits the firm better.
Would you rather not run a server at all?
That can be arranged as a managed installation — still one installation dedicated to your firm alone, on infrastructure you can point at, rather than moving you into a service shared with other firms.
Where to read next
Related
- Module catalogue
What a licence can turn on.
- Pricing
How a licence and support are put together.
- Product overview
What the software does once it is up.
See it against your own matters
A working demo takes about forty minutes. Bring a real fee note and a real timesheet week — we would rather show you the awkward parts than the polished ones.