Why Cloud-Based Tools Are Unacceptable for Your Firm

Client contracts and compliance requirements demand better

Cloud HR Platforms

Client data potentially exposed in shared database
Third-party access to employee information
Cannot meet air-gapped requirements
Vendor security breaches affect your firm
Unknown subprocessors and data locations
Contractual prohibition on cloud services

Blik Air-Gapped

Deploy behind your firewall, no external access
Zero third-party data sharing by design
Fully functional without internet connection
Your infrastructure, your security controls
No subprocessors, no external dependencies
Meets strictest client requirements

Security Architecture for Professional Services

Designed for firms with the highest confidentiality requirements

Complete Data Isolation

Deploy on your internal network with no external connectivity. All data stays within your security perimeter. No cloud services, no external APIs, no internet access required. Perfect for law firms, healthcare providers, and financial advisors.

Zero Third-Party Access

No vendor access to your deployment. No support backdoors. No telemetry or analytics sent anywhere. Your IT team has complete control. Audit the open source code yourself to verify security claims.

Client Audit Ready

Demonstrate technical controls to demanding clients. Architecture diagrams included. Data flow documentation provided. Open source allows client security teams to review code. Passes third-party security questionnaires.

Reporting Confidentiality

Token-based access and category-aggregated reports support confidentiality. Responses retain a token reference that may link to an invitation email. Invitation method, permissions, thresholds, and feedback content affect confidentiality; it is not a guarantee against identification by database administrators.

Compliance Assessment

Open source code lets your team inspect the implementation. Export and deletion tools support GDPR obligations; your organization must assess requirements, configure controls, and maintain its own compliance processes.

Internal SMTP Only

Configure with your internal mail server. No external email services required. All email stays within your network. Support for Exchange, Office 365 on-premises, or any SMTP server you control.

Secure, Professional Interface

Hover to toggle theme

Token-based invitation links provide reviewer access; emailed invitations may associate a token with an email address

Anonymous Feedback Reports - Light Theme

Hover to toggle theme

Professional reports with anonymity protection built-in

Built for Your Industry

Built for teams of 30-200 employees that need control over feedback data

Law Firms

Assess Your Requirements: Attorney-client privilege, professional ethics, and client confidentiality depend on your firm's policies and deployment controls; self-hosting alone does not establish compliance.

Typical Setup: Air-gapped deployment behind firm firewall. Internal SMTP only. Managed by firm IT. Review cycles for attorneys, paralegals, support staff.

Healthcare & Life Sciences

Assess Your Requirements: Review healthcare privacy obligations with your compliance team. Self-hosting is not a HIPAA certification or a guarantee of patient data separation.

Deployment Considerations: Limit feedback to relevant staff competencies, instruct reviewers not to include patient data, and configure access and retention for your setting.

Financial Services

Assess Your Requirements: Evaluate regulatory, confidentiality, access, and recordkeeping obligations before using feedback software in your firm.

Deployment Considerations: Have your compliance team assess network placement, permissions, retention, and recordkeeping requirements.

Management Consulting

Assess Your Requirements: Your organization must manage client confidentiality agreements, conflicts of interest, access boundaries, and retention.

Typical Setup: Project-based review cycles. Partner and consultant assessments. Integration with resource management. Protected behind VPN.

Accounting & Tax

Assess Your Requirements: Your organization is responsible for professional standards, client privilege, quality controls, and review documentation.

Typical Setup: Separate staff and partner reviews, technical competency assessments, and annual review cycles aligned with promotion timelines. Maintain your own supporting documentation.

Government Contractors

Assess Your Requirements: Self-hosting does not establish ITAR/EAR compliance, FedRAMP authorization, or suitability for classified information.

Deployment Review: Obtain approval from your security and compliance teams before selecting a network or handling sensitive information.

Deployment Options for Maximum Security

Three deployment modes to match your security requirements

Air-Gapped (Highest Security)

Setup: Internal server, no internet access, manual report generation

Best For: Law firms, defense contractors, highly regulated industries

Features: Complete isolation, no external dependencies, passes strictest client audits

Firewall-Protected (High Security)

Setup: Internal server with restricted outbound access for email

Best For: Healthcare, financial services, mid-size professional firms

Features: Controlled external access, email invitations work

Private VPN (Moderate Security)

Setup: Cloud server accessible only via firm VPN

Best For: Consulting firms, accounting firms with remote teams

Features: Remote access for distributed teams, still fully isolated from public internet

All Deployment Modes Share Core Benefits

Self-hosted infrastructure • Open source auditability • Your deployment controls • Your compliance assessment

Compliance Framework Support

Self-hosting does not confer certification or automatic compliance. Your organization must assess applicable requirements and implement appropriate controls.

Compliance Standard	Blik Support	Organization Responsibilities
ISO 27001	Source code available for assessment	Define and maintain your information security management system
SOC 2	Source code available for assessment	Assess controls and obtain independent assurance where required
GDPR	Export and deletion tools	Lawful processing, access controls, retention, processor agreements, and data subject request handling
HIPAA	Deployment must be assessed	Determine suitability, required safeguards, and contractual obligations before use
FedRAMP	No authorization implied by self-hosting	Assess applicable authorization and security requirements independently
PCI DSS	Deployment must be assessed	Do not put payment card data in review content; assess scope and required controls

Compliance Resources

Essential compliance framework documentation:

ISO 27001 - Information security management
SOC 2 - Service organization controls
HIPAA - Healthcare privacy regulations
FedRAMP - Federal risk and authorization management

Cost Comparison for Professional Services

Why spend 50,000+ EUR per year on cloud tools you cannot use?

Cloud Tools You Cannot Use

Lattice: 8-12 EUR/user/month
Culture Amp: 10-15 EUR/user/month
15Five: 6-10 EUR/user/month

Problem: Cannot meet your client confidentiality requirements

Manual Spreadsheet Process

Cost: Partner time, admin overhead
Time: 20-40 hours per review cycle
Issues: Error-prone, not anonymous, hard to aggregate

Problem: Unprofessional and time-consuming

Blik Self-Hosted

Licensing: 0 EUR (open source)
Server: a small EU VPS (≈€10-50/month)
Time: 2 hours setup, 1 hour per cycle

Self-hosted feedback with control over deployment

25-Person Firm Calculation

Commercial Tool: 3,000 EUR/year | Manual Process: 8,000 EUR (partner time) | Blik: 1,200 EUR/year (server only) | Savings: 2,000-7,000 EUR annually

Technical Questions from IT and Compliance Teams

Can this run completely offline without any internet access?

Yes. For air-gapped deployment: 1) Use internal SMTP server for emails, 2) Deploy on internal Linux server. No external connectivity required. System is fully functional offline. Perfect for classified environments or firms with zero-trust policies.

What are the infrastructure requirements?

Minimum: 4GB RAM, 2 vCPU, 40GB storage for up to 100 employees.

Recommended: 8GB RAM, 4 vCPU, 100GB storage for 200+ employees with historical data.

OS: Ubuntu 22.04+ or RHEL 8+.

Database: PostgreSQL 15+ (included in Docker setup). Scales vertically as needed.

How do we meet client security audit requirements?

Use the public source code to assess implementation details. Your organization must document its deployment, data flows, access controls, processors, and operating procedures against client requirements. Self-hosting does not itself satisfy an audit or provide certification.

Can we integrate with our Active Directory or LDAP?

LDAP integration is on the roadmap but not currently implemented. For now, admins use Django's built-in authentication. Since reviewers never log in (token-based access), only admin accounts need management. For firms requiring LDAP, you can modify the authentication backend in the open source code or wait for the next major release.

How does reviewer confidentiality work?

Reviewers use token-based links, and reports aggregate feedback by category with configurable thresholds. Responses retain a token reference, which may link to an invitation email. Confidentiality depends on invitation method, permissions, thresholds, and feedback content; it is not guaranteed against administrators with database access.

What backup and disaster recovery options exist?

PostgreSQL backup strategies: 1) pg_dump for point-in-time backups, 2) WAL archiving for continuous backup, 3) Streaming replication for high availability. Store backups on your SAN, tape, or segregated network. All backup data remains in your control. Restoration tested and documented. RTO typically under 1 hour.

How do we handle GDPR right to erasure requests?

Blik provides self-service deletion tools to support GDPR requests. Your organization must assess each request, handle related records and backups under its retention policy, and document the process. The tools do not automatically establish compliance.

Implementation Process for Professional Services

Typical deployment timeline for firms

Week 1: Planning

Activities: IT reviews documentation, Security approves architecture, Compliance maps to requirements, Partner sponsors identified

Deliverables: Deployment plan, security assessment, compliance checklist

Week 2: Deployment

Activities: Provision internal server, Deploy Docker containers, Configure SMTP and settings, Import employee list

Deliverables: Running system, admin access, initial testing complete

Week 3: Pilot

Activities: Run pilot review cycle with one department, Gather feedback, Adjust anonymity thresholds, Train administrators

Deliverables: Pilot report, user feedback, configuration refinements

Week 4: Rollout

Activities: Announce to full firm, Create review cycles, Send invitations, Generate reports

Deliverables: Firm-wide review complete, Reports delivered, Process documented

Most Firms Complete Deployment in 2-3 Weeks

Includes security review, compliance approval, and pilot testing. Much faster than 8-12 week implementations for commercial tools.

360 Feedback That Protects Client Confidentiality