Toronto, Ontario · Locked. Running. Quietly smarter.

Your office. Locked, running, and quietly smarter.

Enterprise-grade managed IT, zero-trust cybersecurity, and sovereign on-premises AI for regulated professional offices across Canada. Based in Toronto with a next-business-day engineer SLA—and client files that never leave your building.

Schedule 20-minute architecture review Explore 5-ring specification

Response SLA Next Business Day Direct senior engineer response; same-day escalation for critical outages

Data Residency 100% On-Premises Client files and AI prompts stay inside your office perimeter

Regulatory Alignment PIPEDA · PHIPA · LSO Immutable access logs, hardware MFA, and verified off-site backups

LIVE INFRASTRUCTURE TELEMETRY NETDATA · 60S POLL

Watching — systems All checks green

Read directly from our production monitoring stack every 60 seconds. We deploy the exact same guardian across client offices.

Capability Specification

Five concentric rings. One accountable team.

As you scroll through each operational layer below, its corresponding ring on the rotor aligns with the 12 o'clock keyway.

01 Managed 02 Zero-Trust 03 Sovereign 04 Custom 05 Managed

RING-01

Next-Business-Day SLA

Managed IT & Endpoint Operations

Continuous endpoint telemetry, automated OS and third-party patching, verified backups, and a senior engineer who answers next business day.

Included Deliverables

24/7 fleet & server health monitoring with automated alerting
Staged OS & application patch rings with zero-downtime windows
Encrypted 3-2-1 backups with monthly restore verification reports

RING-02

Zero-Trust Baseline

Zero-Trust Cybersecurity

Identity, email, endpoints, and network perimeters hardened against phishing, ransomware, and unauthorized access.

Included Deliverables

Phishing-resistant MFA, conditional access, and SSO enforcement
DMARC/DKIM/SPF lockdown and inbound mail threat quarantine
Full-disk encryption, EDR telemetry, and least-privilege file shares

RING-03

100% Local Inference

Sovereign On-Premises AI

Search matter files, draft correspondence in your firm's voice, and triage shared inboxes on dedicated local hardware inside your office.

Included Deliverables

Dedicated local AI appliance installed on your office network
Private RAG document search across PDFs, Word files, and case folders
Zero external API training or third-party cloud retention

RING-04

Fixed-Scope Delivery

Custom Workflow Automation

Eliminate repetitive manual intake, document assembly, and billing handoffs with custom internal tools quoted upfront.

Included Deliverables

Automated client intake, KYB/KYC checklists, and PDF generation
Secure bridges between your practice management, CRM, and accounting tools
Written fixed-price specification before a single line of code is billed

RING-05

99.9% Uptime Target

Managed Infrastructure & DevOps

Your client portals, web properties, and internal databases kept online, hardened, backed up, and recoverable.

Included Deliverables

Containerized Linux server management, TLS automation, and WAF rules
Minute-by-minute Netdata telemetry and automated container recovery
Documented disaster recovery runbooks and annual failover drills

Data Custody & Sovereign Architecture

Client files never leave the building.

Law Society of Ontario guidance, PIPEDA, and PHIPA all require strict custody over where regulated records travel. With CipherKit, document indexing and AI drafting execute on a dedicated appliance inside your office perimeter.

LSO & PRIVILEGE

Zero external API retention or model training on privileged matter files and correspondence.

PHIPA & PIPEDA

Patient and client records stay on encrypted local storage with role-based access and immutable logs.

OPTIONAL CLOUD GATE

External frontier models remain hardware-blocked by default and only open per workflow when explicitly authorized.

PERIMETER TOPOLOGY · ON-PREM NODE AIR-GAPPED BY DEFAULT

Local inference runs on dedicated office hardware. Outbound telemetry and third-party LLM calls are blocked at the gateway unless enabled for a non-sensitive task.

Engagement Models

Transparent scope. Written quote before work begins.

Every office has a different mix of seats, legacy software, and compliance obligations. Tell us your headcount and bottlenecks—we deliver a written, fixed-scope proposal within one business day.

TIER-01

Managed Office Foundation

2–25 seat professional offices

Complete managed IT and zero-trust security baseline under a predictable monthly retainer.

Endpoint & server monitoring (24/7)
Automated patching & antivirus/EDR
Identity, email & MFA lockdown
Encrypted backups + monthly restore test
Next-business-day engineer support

Request Foundation Quote

TIER-02 MOST SELECTED

Sovereign AI + Managed Suite

Document-heavy regulated practices

Everything in Foundation plus an on-premises AI node wired to your internal document vault.

All Managed Office Foundation inclusions
Dedicated local AI hardware in your office
Private document Q&A and letter drafting
Shared inbox triage & intake extraction
Role-based access controls & audit trail

Scope Sovereign AI Suite

TIER-03

Fixed-Scope Engineering

Single workflow or infrastructure project

Standalone security hardening, custom software automation, or server migration with a fixed deliverable.

Written architecture & fixed-price quote
Custom workflow or portal development
Cloud-to-local or Linux server migration
Compliance gap remediation (PHIPA / PIPEDA)
Full source, runbook & handoff training

Scope a Fixed Project

Regulated Verticals

Built for offices where client files are the business.

Standard MSPs push everything to public cloud tenants. We engineer around Canadian professional privilege, health privacy, and financial custody requirements.

LSO By-Law & Solicitor-Client Privilege

Law Firms (2–20 Counsel)

Operational Risk

Privilege is the product, and Law Society guidance now requires knowing every server a client document touches.

CipherKit Standard

Matter files are indexed on-premises; associates search precedents and draft letters without a byte crossing a public cloud API.

PHIPA Custody & Control

Medical & Dental Clinics

Operational Risk

PHIPA makes pasting patient notes into public cloud AI a reportable breach, while front desks drown in forms and referrals.

CipherKit Standard

Local intake extraction and clinical correspondence drafting run entirely inside the clinic firewall with full audit logs.

PIPEDA & CRA Safeguards

Accounting & Tax Practices

Operational Risk

Tax season peaks on shared drives and email attachments, often backed by an external drive nobody has ever test-restored.

CipherKit Standard

Hardware-key MFA, encrypted client vaults, automated working-paper organization, and verified monthly recovery drills.

CICC Confidentiality Standards

Immigration Consultants (RCIC)

Operational Risk

Hundreds of passport scans, deadlines, and multi-staff shared inboxes where a single compromised password exposes every file.

CipherKit Standard

Zero-trust mailbox isolation, automated document completeness checks, and tamper-evident off-site backups.

Operational Proof

We run what we sell in production.

Instead of slideware, inspect our live public security tooling and real-time server telemetry.

PRODUCTION SECURITY

RookVPN Security Suite

11 public security, privacy, and diagnostic tools built, hardened, and operated on our own infrastructure.

LIVE INFRASTRUCTURE

Live Sovereign Stack Telemetry

This site and the AI assistant below run on the exact containerized Linux + AIG stack we deploy for clients. Check the live status strip above.

Live On-Premises AI Demo

Talk to the appliance we install in your office.

This interactive assistant runs on our own hardware in an isolated, zero-retention workspace. Test how it answers operational, compliance, and onboarding questions before booking a review.

INFERENCE LOCATION Dedicated CipherKit Self-Hosted Node

CONVERSATION STORAGE Disabled (`store_conversation = false`)

CLIENT DEPLOYMENT Air-gapped LAN appliance wired to your folders

SOVEREIGN AI CONSOLE · WORKSPACE: CIPHERKITZERO RETENTION

Select a prompt below or ask anything about securing a small office, PHIPA/PIPEDA data custody, or how on-prem AI works. Nothing you type here is stored.

Questions offices ask first

Straight answers before the call.

How does sovereign on-premises AI work for Canadian law firms and clinics?

CipherKit installs a dedicated appliance on your office network. Document search, letter drafting, and inbox triage run on that hardware. Client files and prompts stay inside the building unless you explicitly enable a cloud model for a non-sensitive workflow.

Is CipherKit aligned with PHIPA, PIPEDA, and Law Society of Ontario guidance?

The architecture is built so regulated records stay on encrypted local storage with role-based access and immutable logs. CipherKit does not certify your practice; the 20-minute review maps your current systems against those obligations and writes a remediation list.

What is the managed IT response SLA in Toronto?

The published retainer includes next-business-day response from a senior engineer, with same-day escalation for critical outages. It is not a 24/7 desk. On-site work is available in Toronto; the rest of Canada is served remotely.

Architecture Review & Intake

Twenty minutes. Your screen, your data.

Every consultation is led by a senior systems engineer—never an account rep. You leave with a written quote, a deployment date, and a concrete remediation checklist even if we are not a fit.

01
Current-State Audit (20 mins)
We review your endpoints, mail security, backup posture, and document workflow Bottlenecks.
02
Written Fixed-Scope Proposal (Within 24h)
Clear monthly retainer or fixed project quote with hardware specs and SLA commitments.
03
Zero-Disruption Cutover
Staged after-hours deployment in Toronto & across Canada with full staff onboarding.

DIRECT DESK [email protected]

SERVICE AREA Toronto, Ontario (On-Site) & Canada-Wide