Your data stays on your disk. Even if we disappeared tomorrow. A single SQLite file you can copy, back up and open without our software.
Most finance software rents you access to your own numbers. Cancel, and the access is gone. PilotOS works the other way round.
German law applies. This page explains the German rules in English so you can judge whether PilotOS fits. The legally binding version of every page, price and term is the German one.
What “local-first” means here, concretely
- One file. Your books live in a SQLite database on your own drive. You can copy it, archive it, or open it with any database tool — with or without PilotOS.
- No vendor server. There is no place where your accounting, customer or wealth data is stored by us. We could not read it if we wanted to.
- Internet only when you ask. A connection is used for two things: filing the VAT return via ELSTER, and fetching bank transactions via FinTS. Everything else works offline.
- The export never depends on payment. If you stop paying, you still get your data out. Locking someone out of their own books is not a business model we accept.
Encryption is your operating system's job — and we say so
The database is protected by BitLocker on Windows, FileVault on macOS, or LUKS on Linux. We do not claim end-to-end encryption we do not perform: the honest sentence is that your disk encryption protects the file, and your backups need a protected target too.
What this costs you
Being local-first is not free of duties. You are responsible for backups. There is no web login from a hotel computer. If your hard drive dies and you have no backup, the data is gone — that is the trade for not handing it to a third party. We consider it a fair trade, but it is a trade.
GDPR without a processor agreement
If no third party processes your data, there is no data processing agreement to sign, no sub-processor list to review, and no transfer to a non-EU region to justify. That is not a marketing claim but a consequence of the architecture: there is no server to contract with.
Where the limits are
Local-first means no real-time collaboration across locations, no browser access to a shared instance, and no automatic sync between two computers. Multiple workstations on one database are possible in a local network; a distributed team across three cities is not the use case this was built for.
Questions about data sovereignty
What happens if my laptop is stolen?
The database file is protected by the operating system's disk encryption (BitLocker, FileVault, LUKS). If that is active, a stolen device does not hand over your books. It is worth checking that it is actually switched on — many installations never turn it on.
Can I use it on two computers?
In a local network, several workstations can use the same database. There is no automatic sync across locations: that is the trade for having no server. Two machines in two cities mean copying the database, not syncing it.
Do I still need backups?
Yes, and that responsibility is yours. The program has a one-click backup and restore, but it cannot guarantee that you use it. A backup on the same drive is not a backup — keep one copy somewhere else.
Is there really no vendor access?
None. There is no server that stores your accounting or wealth data, so there is nothing to access. Support can only help with what you send us voluntarily.
What local-first does to the question of trust
Most software asks you to trust a promise: we encrypt, we do not sell, we delete on request. Local-first replaces the promise with a fact. There is no server holding your books, so there is nothing to encrypt, nothing to sell and nothing to delete. The guarantee is architectural, not contractual.
That also changes what a privacy policy has to say: no sub-processors, no transfer to a third country, no data processing agreement to negotiate. The document becomes short because the setup is simple.
The price is the one already named: you are the operator. Backups are yours, the machine is yours, and the responsibility is yours. Anyone who sells local-first as free of duties is selling something else.