How it works
Five things happen to everything you keep.
Beyond document management and digital asset management: email and whole mailboxes, recordings, archives and disk images too, with the integrity of an evidence system. Each step is done by the archive itself, wherever it runs, and each leaves a record.
1 · Bring it in
Every way in leaves the same record.
Upload or paste; a web address; a scanner on the network or the camera on a phone; a folder you watch, a shared drive, an SFTP account; a mailbox read over IMAP; an FTP inbox; a printer you print to. The legal modules add load files and forensic images. Whatever the way in, the archive records the arrival — its filename, its path, its own times, who brought it — and never changes the original.
arrival recorded per file · dedupe per workspace · the same bytes met again are related, not stored twice
Every file is identified by its signature and its PRONOM registry entry, not by its extension. What the archive cannot identify it still keeps, checksummed, and says so.
73 formats in 9 families
Each family has its own reading, its own archival copy and its own way of being searched.
| Family | For example | What the archive makes of it |
|---|---|---|
| Documents | PDF, Word, spreadsheets, presentations, OpenDocument | Text recognised or extracted, a reading copy, an archival PDF/A-2b copy verified against the standard |
| Pictures | JPEG, PNG, TIFF, HEIC | Text recognised where there is any, an optional machine description, exact and perceptual duplicates found |
| Camera RAW | DNG and the makers' formats | Identified and catalogued; a viewable copy made; the original never touched |
| Audio | MP3, WAV, FLAC, M4A | Transcribed on your own hardware, searchable to the second; an archival FLAC copy proven by decoding |
| Video | MP4, MOV, MKV | Transcribed; keyframes described if you ask; an archival FFV1/Matroska copy proven by decoding |
| EML, MSG, mbox | Rendered with its attachments as documents of their own, threads linked, an EA-PDF archival copy self-checked (no independent validator exists yet) | |
| Mail stores | PST, OST | Read in place in batches: every message a document with its folder path and its properties beside it |
| Archives | ZIP, tar, 7z | Expanded into documents that know which archive they came from; limits guard against the pathological |
| Text and everything else | Markdown, plain text, and whatever remains | Kept, checksummed and searchable by name; text formats read as they are |
2 · Understand it
Read, transcribed, described — and labelled as such.
Text is recognised or extracted from every page; recordings are transcribed on your own hardware; pictures can be described by a local model if you switch that on, and the description is labelled as a machine's and never becomes a record. Reading copies are made for the browser; archival copies are made to the standards and verified against them.
OCR · transcripts · descriptions opt-in · PDF/A-2b verified by veraPDF · FFV1/Matroska and FLAC proven by decoding
The engine that made a piece of text is named beside it. Nothing a model produced is mistaken for what a person wrote.
3 · Find and connect it
By words, by meaning, by appearance — and by question.
Search in 29 stemmed languages plus Chinese, Japanese and Korean by character pairs; by meaning, through embeddings computed where the archive runs; by appearance, through late-interaction vectors over the page images, behind a numerics gate no model passes lightly. Ask a question and get an answer that cites its pages, under a grounding contract and a verification pass, from a model that runs where the archive runs.
lexical · semantic · visual · Ask with numbered citations, or research in passes · connections as a list and a graph · versions and notes
Connections are drawn for you — the attachments of a message, the members of an archive, the documents a page refers to, the versions of a note — and shown as a list or a graph.
4 · Keep it trustworthy
Originals never change. Everything else proves it.
Every file is checksummed four ways as it arrives and read back on a schedule; a mismatch is a notification, an audit event and a fact on the file's page. Every act — every opening, every change, every setting — goes on an append-only audit chain, anchored on a schedule and verifiable offline with a tool you keep. Retention runs to a human queue, holds freeze what must not change, and a disposition leaves a certificate.
BLAKE3, SHA-256, SHA-1, MD5 · fixity read-back · audit chain anchored · retention, holds, dispositions
Backups go to seven kinds of destination as one snapshot each: the database, the files, a plain catalogue of every document and a readable tree of the originals, with a manifest signed by a key you keep. The repository is checked on a schedule, and any copy opens with stock tools — restic, a text editor, PostgreSQL, openssl — with the software never needed; a verifier of ours proves a restored copy to the last byte when you want that too.
5 · Use it with confidence
Twenty modules. The operator has the final say on every one.
Everything but the core is a module you can switch off or on for the instance, and allow per workspace. Sixteen come with the licence: capture, ingestion sources, processing, archival copies, search, the local AI runtime, semantic and visual search, transcripts, picture descriptions, Ask, hosted AI with the keychain, connections, records, notes, export and import, enterprise identity. Four are sold by the year for demanding work: Provenance, Court bundles, Legal discovery, Legal forensics. Three regulated features stay off until a named administrator accepts a signed responsibility notice.
workspaces, barriers, emergency access · row-level security · sandboxed processing · a licence that never stops what runs
Where it runs is your choice.
VX Drive is installed as one appliance: one command on a Linux machine (Debian 13, Ubuntu 26.04, Fedora, RHEL 10 or its rebuilds, Arch) — physical or virtual, on your network, in your data centre or in a cloud you control. The people who use it do so from a browser; nothing is installed on their computers. The installer sets up the database, the two services, a certificate for your network (a private authority, your own certificate, a Tailscale name or a public domain with automatic certificates), backups and updates, and writes a recovery kit you keep off the machine.
Releases are published to our registry, signed with a key held in a hardware security module. Your appliance follows a channel within a window you set, with a hold you can apply; every image is verified before it runs; a backup precedes every update; a failed update rolls back. Your licence is a signed file the appliance verifies with a key built into the software; it refreshes daily from the portal when it can reach it, and works without ever reaching it.
The two services are compiled, memory-safe programs with no virtual machine and no garbage collector between them and the machine; the renderers and recognisers they borrow from others run in a sandbox with no network and a budget of their own. Built the way the guarantees demand.
Nothing of yours leaves the archive unless you say so. What leaves, exactly, and what we never see.
Try it in an afternoon
Thirty days with every module, no card, wherever you choose to run it.