Bailiwick

Your firm’s files belong in your firm’s office.

Bailiwick is a private workspace for law firms of five to fifty people, on a box in your own office. We run it, and day to day nobody outside the firm logs in.

In development · not yet available

The trouble with a US cloud

Most firms keep their files with Microsoft, Google or Dropbox. All three are American companies, and for a law firm that is a legal fact before it is a technical one.

  1. Where the data sits does not decide who can demand it.

    The US CLOUD Act lets American authorities compel a US provider to hand over data in its possession, custody or control, wherever in the world it is stored.1 A data centre in Frankfurt or Dublin does not change who controls it.

  2. Foreign clients’ data is the explicit target.

    Section 702 of FISA allows US intelligence agencies to require US providers to give access to the communications of people outside the United States, without an individual warrant.2

  3. The legal basis has failed twice, and is in court again.

    The Court of Justice of the EU struck down Safe Harbor in 2015 and Privacy Shield in 2020, both over US surveillance.3 Their successor, the 2023 Data Privacy Framework, rests on a US executive order and is under appeal before the same court.4

    Its oversight is weaker than when it was signed: in June 2026 the US Supreme Court held that the President may remove FTC commissioners at will, and the FTC is one of the bodies the framework relies on.5

For a profession whose first duty is confidentiality, that is a great deal of someone else’s law to rely on.

Why the office

For most of the profession’s history, client files were kept where the lawyer could see them. There is a good reason to go back.

A box in your office answers the question a client, an insurer or the bar can ask, and a cloud contract cannot: where is our data, and who can read it? The data is on your premises, on your own encrypted disk, under your own jurisdiction. Day to day, nobody outside the firm, us included, has a way in; our emergency access needs a hardware key and is logged.

An office has its own risks: theft, fire, water, a failed disk. The box is built for them. Its disk is encrypted, so a stolen box gives up nothing readable. It keeps everything on two mirrored drives. And encrypted backups leave the building on a schedule, so the firm can be rebuilt from them.

What is in the box

Everything a small firm works in, in one place, behind one login. Every component is open source.

  • FilesShared and personal, on every device, with previews and search.
  • Calendars and contactsFor the whole firm, in the apps you already use.
  • Documents, togetherEdit the same contract at the same time.
  • PasswordsA password manager for the firm’s own credentials.
  • The matter vaultFor the most sensitive matters: encrypted in your browser, unreadable even to the box.
  • One loginWith a second factor for everyone, and one place to switch off a leaver.
  • A private networkLaptops and phones reach the box over an encrypted network, in the office or away.

What we do not sell: email, printers, Wi-Fi or general IT support. Bailiwick works alongside the email you already have.

Who can read what

Stated exactly, including what each protection does not cover.

This is how Bailiwick is designed to work. It is in development, and not all of it is built yet.

Your data Where it is What protects it Who can read it What this does not cover
The workspaceFiles, calendars, contacts, documents being edited On the box in your office. An encrypted disk. Every device reaches it over an encrypted private network. Your firm’s people. The box itself reads it, which is what makes search, previews and editing together work. A laptop or phone of someone with access that is itself compromised.
The matter vaultThe matters that must not be readable by anyone else On the same box, kept apart. Encrypted and decrypted in the user’s browser. The box stores only ciphertext. Only the people given the key. Not the box, not us, not anyone who takes the box. No search, no previews, limited sharing. Those limits are the guarantee.
BackupsThe way back after fire, theft or ransomware With an EU-owned storage provider, in Germany, Finland or France. Encrypted on your box before they leave. Locked so that even a compromised box cannot delete them. Your firm, with the key on your recovery sheet. The provider and we see only ciphertext. Unless you opt out in writing, a copy of the key is held in escrow, split between us and two of your partners. Neither side can use it alone.
Our serversOne EU server that sends updates and watches health In the EU. Holds nothing worth taking: none of your keys, no files, no passwords. Us, and all we see is whether your box is healthy: system metrics and system logs. We see the email address of anyone we invite on your behalf.

What we never hold

  • Your disk encryption keys or recovery passphrase
  • Your backup keys
  • Your users, their passwords or sessions
  • Any file, document or application log
  • The key that signs the software your box runs

Not by policy, but by design: there is nowhere in our systems to put them.

Backups are the way back, not the home

Your data lives in your office. The backups exist so you can get it back.

They are encrypted on the box before they leave, so the storage provider holds only ciphertext. They are kept with an EU-owned provider rather than an American one, and locked so that ransomware on the box cannot reach back and destroy them. If the box is lost, a replacement is built from the same image and restored from your backups with the key on your recovery sheet, which stays with the firm.

A backup nobody has restored is a hope, not a backup. The box test-restores itself on a schedule and reports the result in writing: how recent the newest backup was, how long a full restore took, and whether everything checked out.

How it is run

  1. We cannot send your box a command.

    The box asks us whether anything new is waiting and acts only from a fixed list of actions, each one recorded. There is no “run this command”, and there never will be. Day to day, nobody logs in. Emergency access exists, needs a hardware key, and is logged.

  2. Software is signed where our servers cannot reach.

    Every update is signed with a key our servers do not hold, and the box refuses anything unsigned. A break-in at our end could delay an update; it could not change your box.

  3. A failed update undoes itself.

    Before every update the box takes a snapshot. If it is not healthy afterwards, it rolls itself back without anyone touching it.

  4. If we are offline, your office is not.

    Logins, files and backups do not depend on us. Logins never touch our servers at all.

  5. The hardware is yours, and so is the software.

    The firm owns the box. Everything on it is open source.

What we do not claim

A security promise is only as good as its stated limits. These are ours.

  1. The workspace is not unreadable.

    Your own box reads it. That is the point: it keeps the data inside the firm, not away from it.

  2. Some threats are beyond any server.

    We cannot protect you from a device that is already compromised in the hands of someone with legitimate access, from your own staff, or from someone forced to unlock.

  3. No certifications yet.

    We hold none, and we will not borrow anyone else’s.

  4. Bailiwick is in development.

    Nothing on this page can be bought today.