Skip to the content

Works offline. Your formulas never reach us.

Everything the software knows is a file on your own disk. There is no account to make and nothing is sent anywhere on its own; the only connections it ever opens are ones you press a button to open. Share a workshop and the shared copy runs on a machine you own, on your own network.

The short version

Your formulas are in a file on your own disk. Orris Bench opens no connection unless you press something that obviously needs one, there is no account to create, and nothing about your work is sent to us at any point, because there is nowhere on our side for it to arrive. Pull the network cable out and the software carries on: weighing, formulating, compliance, labels, batches, documents.

If several people share a workshop, the shared copy runs on a machine you own, on your own network, reached over an encrypted connection whose certificate your benches check by hand the first time and refuse ever after if it changes. That is the whole architecture. The rest of this page is the detail, drawn.

Your computer orris.db every formula and batch documents/ safety sheets, artwork backups/ whole copies, where you say Runs with no internet at all No account. No sign-up. No sync. Only while you press it PubChem a compound you looked up The EU register a check you asked for A name lookup is this name taken The AI model you chose can be one on this machine Your own company sign-in your provider, if you turn it on Orris Bench no route exists
Everything the software knows sits in the box on the left. The five connections on the right open while you are pressing the thing that needs them and close again afterwards, and the last of them goes to a provider your own company runs. The sixth is not a policy or a promise: there is no address for us in the software, no account, and nothing that runs on a timer.

Where your work actually lives

One file, called orris.db, in the application data folder on your own machine. It is a SQLite database, which is the most widely installed database format there is: the format is published, it is in every phone and every browser, and it can be opened by Python, R, LibreOffice, DB Browser and a hundred other things that have nothing to do with us. You can copy it to a memory stick. You can read it without us and after us.

Beside it sit the documents you have filed against materials and formulas, and the backups, which go wherever you point them: another disk, a network share, a drive you keep in a drawer. A backup is taken by SQLite itself rather than by copying the file, which matters more than it sounds, because a database is written in a way that spreads recent changes across more than one file and a backup that grabs only the obvious one is a backup missing your last afternoon.

What reaches the network, and exactly when

This is the whole list. It was made by going through the source for every place that can open an HTTP connection and reading what each one does, which is the only way such a list is worth printing.

Every connection Orris Bench can open, where it goes, and what starts it.
What Where it goes What starts it
Looking a compound up PubChem, run by the US National Institutes of Health You press it You are asking for a CAS number, a structure or a hazard classification, and it goes out with the identifier you typed.
Checking the EU ingredient register The European Commission's own public search API You press it Never scheduled and never at startup, on purpose: software that quietly rewrote what you believe about the law while you were making a batch would be worse than software that never checked.
Clearing a name A plain DNS lookup for the name you typed You press it Only the name you are considering leaves, and only to ask whether anything answers on it.
The AI helper The endpoint you chose in settings, and one of the choices is a model running on your own machine You ask, and consent You are shown what would be sent and to where, and you agree to it once or for as long as the application stays open. There is deliberately no "always": consent that outlives the session is a default, and a default is not consent.
A shared workshop Your own server, on your own network, and nowhere else While you are signed in Sign out and every screen is back on this machine's own file, which heard nothing.
Signing in with your company account Your own identity provider, at the address your own administrator typed, and nowhere else You press it Off until an administrator turns it on. Your own browser opens at your company's sign-in page, so Orris Bench never sees your password, and there is no account with us to make: we run no identity service and no sign-in page of our own, which is why nothing about who you are passes through anything of ours.

What is not on that list is the point of it. There is no telemetry and no usage reporting. There is no analytics. There is no crash reporter. There is no update check phoning home to see who is running what. Unlocking your license is a signature checked on your own machine, so even that opens no connection, and it keeps working on a bench that has never been on the internet in its life.

Why we could not read your formulas even if we wanted to

A promise not to look is worth exactly as much as the person making it. The reason this one is worth more is that the machinery for looking was never built, and here is the whole of what would have to exist first.

  • No account You never make one, so there is no record of you to attach anything to.
  • No servers of ours We run no storage your work could be copied into, so there is nothing on our side to breach, subpoena or leave running after we stop.
  • No telemetry No usage statistics, no feature counters, no crash reports, no analytics of any kind.
  • No license server Your key is verified by mathematics on your own machine. Nothing is asked of us to let you work.
  • No keys of ours in the software Where a credential is needed, for an AI endpoint, it is yours, held on your machine, for a service you chose.
  • No background anything Nothing syncs, nothing uploads overnight, and no timer anywhere reaches the network.
Six things a subscription product needs and this one does not have. Each is the sort of claim you can hold somebody to: they are absences in a program you are running on your own hardware, on a network you can watch.

Working with other people, without a cloud

The moment two people need the same materials, the same stock and the same formulas, something has to hold the shared copy. Everywhere else in this market that something belongs to the vendor. Here it belongs to you: a machine in your own building, running a small server that holds the shared workspace and answers the benches.

It does not need to be much. Anything that is switched on while the workshop is: a NAS that can run .NET, a spare desktop, a small server in a cupboard. No cloud account, no hosting bill, and nothing leaving the premises.

Your premises, your network Bench 1 Bench 2 Bench 3 encrypted, and pinned by each bench Your server a NAS or a spare PC in your own building workspace.db the shared copy
A bench never holds a database password and never speaks to the database. It speaks to the server, and the server runs the work against its own files. A workstation that is stolen or compromised reaches only what that person was allowed to do, rather than the whole of everything.

How a bench knows it is talking to your server

The connection is encrypted, which every product says. The part worth reading is what stops something else pretending to be your server. A certificate from a public authority cannot be issued for a machine name inside your own building, and requiring one would mean requiring the internet, which is the thing this is trying to avoid. So the server makes its own certificate and prints its fingerprint, and each bench is told that fingerprint by a person, once.

  1. 1 The server prints its fingerprint On its very first start, on the machine itself, where you are standing. 3A:91:F2:0C:8D:44:B7:1E:…
  2. 2 You compare it, character for character The bench shows you the fingerprint that was offered to it. If the two do not match, something is between you and your server, and the answer is to stop rather than to continue.
  3. 3 The bench pins it Kept on that machine with the address and the account name. No password and no session token is ever written to disk.
  4. If it ever changes, the bench refuses Not a warning you can click through. It stops, and it keeps stopping until a person clears the pin deliberately, because the one time this matters is the one time somebody would rather you did not read the message.
The fingerprint above is an example. Yours is printed by your own server, on your own machine, at the one moment it is known to be itself.

What setting the server up actually involves

One command, and then three things in the first five minutes. The machine needs the .NET 9 runtime, which is a free download from Microsoft for Windows, macOS and Linux, and it needs to be switched on when the workshop is.

dotnet Orris.Server.dll
That is the installation. The first run creates everything beside itself and tells you what it made.
Orris Server
  data folder:  C:\ProgramData\OrrisServer
  workspace:    C:\ProgramData\OrrisServer\workspace.db
  listening on: https://0.0.0.0:5741
  certificate:  3A:91:...:C4   <- the clients pin this
  First run: the administrator account is "admin" with no password yet.
  The first sign-in sets it. Do that now, before anything else can.
The first start, printed. There is no configuration to write before this: the settings file, the workspace, the account store and the certificate are all created with sensible defaults, and every one of them can be changed afterwards.
  1. 1 Write the fingerprint down Every bench compares it before trusting the server.
  2. 2 Sign in as admin and set the password The first sign-in sets it, so do it before anything else can. Twelve characters at least.
  3. 3 Make an account for each person Their own first sign-in sets their own password, the same way. Give them a role, or leave them as a member of the whole workshop.
Then, on each bench, the Team screen: type the address, compare the fingerprint, pin it, sign in. One port to allow through the machine's firewall, and it is running.

What the server checks on every single call

Not on sign-in. On every call, which is the difference between a login screen and a permission model.

The encryption, against the certificate this bench pinned The session, both the idle limit and the hard ceiling What this person is allowed to do, named in the refusal Separation of duties, so nobody signs off their own work Writes queue, so two people cannot weigh from one bottle at once
And then the sixth, which is not a check but a consequence: everything the server writes goes onto a ledger under the name of the person who did it. Nobody, administrators included, releases or approves a record their own name is already on.

Passwords are stored hashed with PBKDF2-SHA256 at 600,000 iterations, in a versioned format so a stronger algorithm can replace it later without invalidating anybody. The account store is a separate file from the workspace, deliberately, so that password hashes never travel inside a workspace backup. Five failed sign-ins for one name from one address and that combination waits five minutes. An account can be given an expiry date, for an assessor or a contractor, and on the day it stops working without anybody having to remember.

A history that shows when it has been tampered with

Every entry the server writes carries a summary of the entry before it. Change an old entry, or delete one, and every summary after it stops agreeing. You do not have to trust that nobody edited the history: you can walk it and see.

Entry 41 stock moved Entry 42 batch released Entry 43 formula edited Entry 44 today each stamped with a summary of the one before
The server can walk the whole chain on request and say plainly whether it holds. It also reconciles every bottle's recorded quantity against the sum of its movements, and compares the database against the shape the software expects. Three checks, run when you want proof rather than trust.

Backups that are checked, not just written

A backup nobody has ever opened is a hope. The server takes one nightly, at an hour you set, and then proves it: the archive is reopened, re-hashed and re-counted, and one that disagrees with itself is deleted rather than kept, because a bad archive sitting in a folder looking like a good one is worse than no archive at all.

Nightly, at your hour or whenever you ask Opened and counted does it agree with itself Kept, newest first the oldest is pruned Deleted, not kept and it says so on the trail
How many archives are kept is yours to set. Backing the server machine up means the data folder and those archives, and nothing else: there is no state anywhere but on the disk you can see.

And if we stop

Nobody running a business out of a single workshop can honestly promise support forever, and a page that promised it would be worth less than this one. What can be promised is that the software cannot hold your work hostage, ours or anybody else's. It is one published-format file on your own disk, with a whole-database backup and a spreadsheet export beside it. If everything here went quiet tomorrow, you would still have every formula, every batch and every document, in a format a dozen other programs can open, on hardware you own.

Told when it is ready, and nothing else

Orris Bench is not on sale yet. One message, on the day it is released.

If you write a question or a note, it is kept with your address so we can answer it, and it is deleted whenever your address is.

One message. Not a newsletter, and never passed to anybody else. The address is kept on this server, along with the date you gave it and the wording you agreed to, which is the record that you agreed. Ask and it is deleted outright.