Where your data lives, and how the software reaches you
Two ways to install bxFlow, the same software in both cases. This page describes the second one end to end — the one you will be asked to justify in committee.
Hosted by us
You open a browser, and that is all.
We install, monitor, update and back up. Your teams sign in on an address that belongs to you, carrying your brand. Live within a day.
To start quickly, when external hosting raises no regulatory difficulty.
Installed on your premises
The software runs behind your firewall.
Your data never leaves your network. No internet connection is required, neither to install nor to run afterwards. Encryption keys are generated on your machine.
For institutions whose data cannot leave their own infrastructure.
The same software, not a stripped-down edition
There is a single codebase. What you see in a demonstration is what gets installed: same screens, same processes, same controls. And changing your mind later does not mean starting over — your processes export to a file and import elsewhere.
How to choose
The eight questions that come up in committee, answered for each option.
Where the data lives
On our infrastructure, in a space separated per client
On your servers, inside your network
Who runs it day to day
We do
Your teams, with our documentation
Updates
Applied by us, with nothing to do on your side
You choose when; we ship the version
Backups
Automatic and encrypted, with a copy held elsewhere
Automatic and encrypted — you hold the keys and the copies
Internet access required
Yes, it is an online service
None, neither to install nor afterwards
Time to go live
One day
Two to three working days, once the prerequisites are met
Who holds the encryption keys
We do
You do, and they are never passed to us
What the vendor can see
Nothing without your request, and every action is logged
Nothing: we have no access to the instance
An on-premise deployment, step by step
What actually happens, in order, with what we expect from you at each stage. Nothing implicit: this is the document your IT department can read before committing.
What you end up with, once installed
- 1
Scoping
One meeting, you and usWe hand you the list of what is needed: a machine, an address, a certificate. You tell us what is available. Nothing starts until that list is green — which is what keeps installations from stalling.
Technical detailA Linux server with Docker. Four cores, 8 GB of memory and 40 GB of disk are enough to start; eight cores and 16 GB for sustained use. A single port to open towards your users, no outbound traffic required.
- 2
Preparing the delivery
Us, on our sideWe build your package from the exact version that passed every automated test. It carries the software, your licence file, the operations documentation, and the fingerprints that let you verify nothing was altered on the way.
Technical detailThe documentation ships WITH the package, never after: a restore procedure is read on the day of an incident, often with access to nothing else.
- 3
Delivery
Through the channel you chooseEncrypted media, secure drop, hand delivery: your policy decides. We never ask you to open access towards our servers, nor to create an account with us.
Technical detailThis is the point many vendors gloss over: requiring outbound access to an image registry cancels the benefit of an isolated installation. We do not ask for it, and the installation does not need it.
- 4
Installation
Your operator, with us alongsideTwo commands: load, start. The database upgrades itself on first start. An administrator account is created — yours — and you change its password before we leave the room.
Technical detailThe database and the cache are reachable only from inside the application; a single component listens on the network. The public technical documentation of the programming interface is closed.
- 5
Networking and transport encryption
Your network teambxFlow sits behind your proxy and your certificate. A file provided for the purpose teaches it to trust that proxy, so that address-based protections see the user’s real address rather than the proxy’s.
Technical detailWithout that setting, rate limiting stops working: everyone would share one address. The mistake is common and invisible — hence a file shipped in advance rather than a line to find on your own.
- 6
Acceptance
Together, list in handA checklist is ticked point by point: services running, sign-in working, quotas matching the contract, a clean task log, one connector tested end to end. We do not leave before everything is green.
Technical detailThe list also verifies the instance is running in offline mode — that is what distinguishes an on-premise delivery from an image meant for the online service, and nothing else on screen shows it.
- 7
Backups, and a restore actually tested
You, with our guideThe product backs itself up: an encrypted archive of the whole instance, at the time and frequency you set from the screen, with a copy dropped elsewhere. And we test a restore together before we leave.
Technical detailA backup never restored is not a backup. The application cannot delete the off-site copy: that is deliberate, and it is what protects it from ransomware reaching the machine.
- 8
Updates
When you decideWe ship a version with a note saying what it changes. You load, you switch over, you verify. Rolling back stays possible.
Technical detailAn update touches neither your configuration, nor your data, nor your licence: the licence lives in a separate file and crosses versions untouched.
- 9
Follow-up
UsYour licence expiry is announced inside the application thirty days ahead. We come back to you before it, not after.
The limits we impose on ourselves, and why they protect you
An installation on your premises only means something if the vendor does not keep the keys. Here is what that means in practice — including what it costs you.
No remote access
No maintenance tunnel, no telemetry, no call back to our servers. An instance installed on your premises runs indefinitely without ever reaching us. In return, any intervention on our part requires you to open access, temporarily and under your control.
We cannot read your data
Encryption keys are produced on your machine at installation and never passed to us. We can therefore neither open an archive nor restore a backup on your behalf. That is the accepted cost of control: custody of the keys is yours, and it has to be prepared for.
No vendor account on your instance
The installation creates your administrator, and only that. The platform administration screens are not even present. This is what matters under audit: nobody on our side can assume one of your staff members’ identity, so the approvals recorded in your cases keep their evidential value.
Hosting with us, in practice
If external hosting is acceptable to you, going live is measured in hours rather than days. Nothing else changes.
What runs on our side
Your address, your brand
Your staff sign in on an address that belongs to you, showing your logo and your colours before the password is even typed. Adding a client requires no restart.
Separation between clients, continuously tested
Each client lives in a distinct space. That separation is not merely asserted: it is verified automatically on every change to the software, data family by data family, and an uncovered family fails the release.
Backups and an off-site copy
Encrypted, scheduled, dropped to a second location that the software cannot erase anything from. Their freshness is visible from inside the application.
Sign-in through your directory
Single sign-on via SAML or OpenID Connect, and automatic account provisioning from your directory. Joiners and leavers propagate without double entry.
Reversibility
Your processes and your cases export to files you keep. Ask for it before signing rather than after an incident — and replay it once, to check the file would really be enough.
A technical dossier for your IT department?
Detailed prerequisites, network flow diagram, restore procedure, authorisation matrix: we hand over the full dossier on request, before any commercial discussion.