Controlled capture, not secret surveillance.
Your records stay in your office.
AIOA is built to be understandable on day one, with clear privacy boundaries from the start. Here is exactly how we handle your office records.
What AIOA does NOT do.
Start here. These are the things people quietly worry about when they hear the words “AI in the office.” Every one of them is off by design.
AIOA has no hooks into your phone system. Calls are not captured, stored, or transcribed unless your office types or uploads a note from the call by choice.
There is no microphone running in the background. AIOA never turns on a listening device, and it is not designed to capture conversations around the desk.
AIOA does not process payments, move money, or connect to your bank or merchant accounts. It only tracks what your office tells it about a deposit or balance.
Your records live on the local Mac Studio appliance installed in the office. Nothing is shipped to an outside cloud service by default.
Managers still read every suggestion and decide what happens. AIOA does not email, text, or call a client on its own.
What AIOA does — with permission.
These are the five ways information gets into the office book. Every one of them is something your office chose to put there.
Staff can type a short note after a phone call or a walk-in. AIOA organizes it against the right client and event so it does not get lost.
Contracts, floor plans, menus, and signed forms can be dropped in. AIOA pulls out the important details and links them to the right entry.
Old notebooks and folders can be scanned in when your office chooses. The paper originals stay with you — the office book just gets a searchable copy.
If a long-time manager wants to capture how the business really runs, they can sit down for a recorded interview. Only if they agree.
Meetings or walkthroughs can be transcribed when everyone in the room says yes. Nothing is captured silently or without consent.
Local-first architecture.
The office book is not a website we host. It is a local Mac Studio appliance installed in the office.
AIOA runs on a local Mac Studio appliance installed in the office. Core records can run locally. Remote support, software updates, optional backups, and outside sharing are explicit and owner-approved.
The office book does not depend on a remote service to function. If your internet goes down, the office keeps working.
Managers can read, add, and approve entries on the local network alone. Internet is only needed when you decide to send something out.
Human approval, always.
Nothing is sent to a customer, changed in the office book, or shared externally without a manager reading it first. Here is the full path, step by step.
- 1Note arrives
A phone note, form, email, or uploaded document is captured by the office.
- 2AIOA suggests next step
The office book drafts a reminder, follow-up, or task — but does not act on it.
- 3Manager reads the suggestion
A real person reads what AIOA proposed in the approval queue.
- 4Manager approves / edits / rejects
The manager approves as-is, edits the wording, or rejects it entirely. This is the gate.
The gate — nothing passes without a yes - 5Action happens (or doesn’t)
Only after approval does an actual reminder, message, or task go out to a person.
Source traceability.
Every suggestion AIOA makes links back to the original record it came from. A reminder to call a client points back to the phone note that triggered it. A task about a deposit points back to the contract where the number lives.
This matters because a manager should never have to trust AIOA blindly. The office book always tells you where a suggestion came from, who entered it, and when — so anything can be checked at the source in seconds.
Deposit of $2,500 requested on Jun 3 has not been received. Event is in 4 days. Suggest a courtesy call today.
Your records. Your choice.
Four rights that apply to every record in the office book, at any time, for any reason.
Every record in the office book can be pulled out as a portable file. You are never locked in.
Any entry, client, or document can be removed on request. Deletions are permanent when you choose.
Every read, edit, and approval is logged. You can see which manager touched which record and when.
If you ever want to stop, power down the appliance and uninstall it. No subscription holds your data hostage.
What we tell your attorney.
A short fact sheet for the family lawyer or the bookkeeper. Hand it over as-is.
- Data residency: your office only. No replication to outside servers by default.
- Retention: your office decides how long records are kept. Default is indefinite, changeable at any time.
- Deletion: permanent on request. Removed records are not recoverable once confirmed.
- Audit log: included. Every read, edit, approval, and export is recorded with user and timestamp.
- Incident response: confirmed security incidents are communicated under the written pilot or support agreement.
- Access: you control every login. Adding or removing a manager is a manager-only action.
- No third-party sharing by default. Outbound integrations are off until you turn them on.
- Encrypted at rest on the office appliance.
- Exportable on request. Full copy of your records delivered in a portable format.
- Diagnostic data is off by default and requires owner consent to enable.
Want to walk your bookkeeper through this?
We’ll sit down with the people who keep your records honest — the lawyer, the bookkeeper, the long-time manager — and answer every question before a single thing gets installed.