Bailiwick

Your firm’s files belong in your firm’s office.

Bailiwick is a private workspace for law firms of five to fifty people, on a box in your own office. We run it, and day to day nobody outside the firm logs in.

In development · not yet available

The trouble with a US cloud

Most firms keep their files with Microsoft, Google or Dropbox. All three are American companies, and for a law firm that is a legal fact before it is a technical one.

  1. Where the data sits does not decide who can demand it.

    The US CLOUD Act lets American authorities compel a US provider to hand over data in its possession, custody or control, wherever in the world it is stored.1 A data centre in Frankfurt or Dublin does not change who controls it.

  2. Foreign clients’ data is the explicit target.

    Section 702 of FISA allows US intelligence agencies to require US providers to give access to the communications of people outside the United States, without an individual warrant.2

  3. The legal basis has failed twice, and is in court again.

    The Court of Justice of the EU struck down Safe Harbor in 2015 and Privacy Shield in 2020, both over US surveillance.3 Their successor, the 2023 Data Privacy Framework, rests on a US executive order and is under appeal before the same court.4

    Its oversight is weaker than when it was signed: in June 2026 the US Supreme Court held that the President may remove FTC commissioners at will, and the FTC is one of the bodies the framework relies on.5

For a profession whose first duty is confidentiality, that is a great deal of someone else’s law to rely on.

Why the office

For most of the profession’s history, client files were kept where the lawyer could see them. There is a good reason to go back.

A box in your office answers the question a client, an insurer or the bar can ask, and a cloud contract cannot: where is our data, and who can read it? The data is on your premises, on your own encrypted disk, under your own jurisdiction. Day to day, nobody outside the firm, us included, has a way in; our emergency access needs a hardware key and is logged.

An office has its own risks: theft, fire, water, a failed disk. The box is built for them. Its disk is encrypted, so a stolen box gives up nothing readable. It keeps everything on two mirrored drives. And encrypted backups leave the building on a schedule, so the firm can be rebuilt from them.

What is in the box

Everything a small firm works in, in one place, behind one login. Every component is open source.

  • FilesShared and personal, on every device, with previews and search.
  • Calendars and contactsFor the whole firm, in the apps you already use.
  • Documents, togetherEdit the same contract at the same time.
  • PasswordsA password manager for the firm’s own credentials.
  • The matter vaultFor the most sensitive matters: encrypted in your browser, unreadable even to the box.
  • One loginWith a second factor for everyone, and one place to switch off a leaver.
  • A private networkLaptops and phones reach the box over an encrypted network, in the office or away.

What we do not sell: email, printers, Wi-Fi or general IT support. Bailiwick works alongside the email you already have.

Who can read what

Stated exactly, including what each protection does not cover.

This is how Bailiwick is designed to work. It is in development, and not all of it is built yet.

Your data Where it is What protects it Who can read it What this does not cover
The workspaceFiles, calendars, contacts, documents being edited On the box in your office. An encrypted disk. Every device reaches it over an encrypted private network. Your firm’s people. The box itself reads it, which is what makes search, previews and editing together work. A laptop or phone of someone with access that is itself compromised.
The matter vaultThe matters that must not be readable by anyone else On the same box, kept apart. Encrypted and decrypted in the user’s browser. The box stores only ciphertext. Only the people given the key. Not the box, not us, not anyone who takes the box. No search, no previews, limited sharing. Those limits are the guarantee.
BackupsThe way back after fire, theft or ransomware In your firm’s own storage account with an EU provider. We have no access to it. Encrypted on your box before they leave. Kept in versions, so even a compromised box cannot erase earlier copies. Your firm, with the key on your recovery sheet. The provider and we see only ciphertext. Our software on the box has to use the key, so a malicious update signed by us could read it.
Our serversOne EU server that sends updates and watches health In the EU. Holds nothing worth taking: none of your keys, no files, no passwords. Us, and all we see is whether your box is healthy: system metrics and system logs. We see the email address of anyone we invite on your behalf.

What we never hold

  • Your disk encryption keys or recovery passphrase
  • Your backup keys
  • Your users, their passwords or sessions
  • Any file, document or application log
  • The key that signs the software your box runs
  • Access to your backup storage

Not by policy, but by design: there is nowhere in our systems to put them.

Backups are the way back, not the home

Your data lives in your office. The backups exist so you can get it back.

They are encrypted on the box before they leave, so the storage provider holds only ciphertext. They sit in your firm’s own account with an EU provider, not an American one, and are kept in versions, so ransomware on the box cannot reach back and erase their history. If the box is lost, a replacement is built from the same image and restored from your backups with the key on your recovery sheet, which stays with the firm.

A backup nobody has restored is a hope, not a backup. Every night the box test-restores from its latest backup and checks what it got back, and a monthly report states in writing how recent the newest backup was, how long a full restore takes, and whether everything checked out.

Any professional can get your data back for you without our help. What we do is not magic. How we do it is.

The first question to ask of any managed service is what happens if the provider disappears, or the firm wants to leave. This is our answer.

  1. Your backups are in your own account.

    They live in your firm’s own storage account with an EU provider. Your firm creates the credential and enters it on the box; only the box and your own people hold it. We have no access.

  2. Your keys are made in your office.

    The box creates the recovery secrets at a key ceremony in front of your partners, prints them straight to paper and seals them. We never see them. Two of your partners together hold enough to recover everything; our share alone is useless, and recovering from shares is itself a recorded ceremony announced to your firm’s admins.

  3. Standard software, standard formats.

    Everything we run is standard open source: Nextcloud, Collabora, Keycloak, Vaultwarden, CryptPad, Postgres. The backups come out in those programs’ own formats, with a plain-text manifest of versions and settings, and restore onto standard installations without anything from us.

  4. Your vault stays yours, even then.

    Documents in the matter vault come back readable only to each user, with their own password. Not even the professional restoring your data can read your vault.

What you pay us for

  • The key ceremonySecrets made, printed and sealed in your office, and made again when a partner leaves.
  • Nightly restore drillsEvery night the box restores from its latest backup, checks the result and measures how long it took. You get the figures in a monthly report.
  • Signed upgradesEvery update is signed, and one that fails rolls itself back.
  • Drive replacementNo technician on site: someone in the office slots in a new drive, we approve it remotely, and the box rebuilds onto it.
  • Access from anywhereSecure access from laptops and phones wherever your people are. An office without a fixed address does not touch its router at all.

“Any professional” means a qualified Linux administrator, with your two partners’ share cards and your firm’s own storage credential. This is how Bailiwick is designed to work; it is in development.

How it is run

  1. We cannot send your box a command.

    The box asks us whether anything new is waiting and acts only from a fixed list of actions, each one recorded. There is no “run this command”, and there never will be. Day to day, nobody logs in. Emergency access exists, needs a hardware key, and is logged.

  2. Software is signed where our servers cannot reach.

    Every update is signed with a key our servers do not hold, and the box refuses anything unsigned. A break-in at our end could delay an update; it could not change your box.

  3. A failed update undoes itself.

    Before every update the box takes a snapshot. If it is not healthy afterwards, it rolls itself back without anyone touching it.

  4. If we are offline, your office is not.

    Logins, files and backups do not depend on us. Logins never touch our servers at all.

  5. The hardware is yours, and so is the software.

    The firm owns the box. Everything on it is open source.

What we do not claim

A security promise is only as good as its stated limits. These are ours.

  1. The workspace is not unreadable.

    Your own box reads it. That is the point: it keeps the data inside the firm, not away from it.

  2. Some threats are beyond any server.

    We cannot protect you from a device that is already compromised in the hands of someone with legitimate access, from your own staff, or from someone forced to unlock.

  3. No certifications yet.

    We hold none, and we will not borrow anyone else’s.

  4. Bailiwick is in development.

    Nothing on this page can be bought today.

  5. Our software runs on your box.

    It needs the keys to back up and to unlock, so a malicious update signed by us could read them. We say so rather than claim otherwise.