21 Jul 2026 · The CivitasOPS team

Why your documents stay on your machine

A land surveyor's working documents are not like most business documents. They name the people who own a property, describe exactly where it is, and often carry a signature and a notary's seal. They are somebody else's private record, handed to you because you need them to do a job.

So the first decision we made was not a feature. It was a constraint: the document stays on the surveyor's machine, and the software that reads it runs there too.

What that ruled out

A great deal of convenient architecture, most of it cheaper to build than what we did instead.

We could not put a document pipeline in the cloud, because a document pipeline in the cloud has your client's document in it. We could not run a hosted index, because the index is built out of the words on the page. We could not quietly send a page image away to be looked at, because "quietly" is the part that would have been wrong.

What is left is a desktop application that does its own reading, on the machine a surveyor already owns, and that has to be good enough there. That is a harder engineering problem and a much easier conversation with a client.

The test we hold ourselves to

The promise is not "we do not look at your files". It is that there is no point in the product where an original document is sent to us at all. A promise about intent depends on our good behaviour tomorrow; a promise about capability does not, and it is the one worth making.

When a firm wants to share

Team working is off until a firm switches it on, and it is a firm-level decision, not a per-person one. Switched on, colleagues on the same job share what they need in order to work together — and the documents themselves stay where they were read. What is shared goes to infrastructure the firm controls, and none of it comes to us.

We are plain about that being a real trade. Sharing something derived from a client's document is not the same as sharing nothing, which is why it is a deliberate choice a firm makes once, with its own name on it, rather than a default we chose for you.

That is the whole design. Most of the rest of the product follows from it.