Your disk
The database, the photographs and every signed PDF live in a folder you choose, on a machine you own, inside your own access control.
On your premises
Nothing leaves the building.
Some sites cannot put a visitor's name, their employer and their citizenship answer into somebody else's cloud — not because they distrust the vendor, but because the policy they are audited against says so. That is not a reason to go back to a paper book.
What it is
The product, not a cut-down copy of it.
The same kiosk, the same console, the same screening, the same hash-chained record. One installer, one machine in reception, and the tablets on your own network.
Your backups, checked
A consistent snapshot at one in the morning, then a copy of it and of every file tree to the share you name. The copy is verified by hash rather than by file size — a truncated copy over a flaky share has a plausible size — and if 36 hours pass without a verified one, the server raises it as urgent.
Your network
The kiosk talks to the machine in reception. With the internet unplugged, check-in, screening, signing, badge printing and the roll call all carry on — the go-live checklist has you test it that way. Email, text and chat messages are the exception: they retry for a few minutes and then give up, and the log says they failed.
What it costs you
The honest trade.
Running it yourself means the parts we would otherwise do are yours: the machine and its patches, the backup you already run, and the upgrade when a new version lands. The upgrade is a script, and it refuses to go ahead rather than leaving you half-migrated — but somebody there has to run it.
In exchange, nothing about your visitors is anywhere but your building, and the answer to "where is this data" is a room you can point at.
- Installed by a script that checks the machine first and says what it is about to change.
- Upgraded in place, with the database migrated in one transaction: it either moves or it does not.
- Checked on both databases. The same verification suites run against the on-premises database and the hosted one, so the tier you chose is not the one nobody tests.
Setup · on a machine in reception
Which one
How sites actually choose.
| Hosted | On your premises | |
|---|---|---|
| Where visitor data sits | Our database, in your own schema and file store | Your machine, in a folder you choose |
| Who patches and upgrades | We do | You run the upgrade script |
| Who backs it up | We do, nightly, off the machine | Your existing backup, over your folder |
| If the internet is down | The kiosk cannot reach us | The front desk carries on; only the messages out fail |
| Best for | Sites that want it working this week with nothing to run | Sites whose policy or contract says the data stays in the building |
Tell us which one your policy allows.
If you are not sure, that conversation is usually short, and we have had it before.