Ask where an investigation actually lives and most software gives an uncomfortable answer: on someone else's servers. The subject's name, the images, the working hypotheses and the half-formed suspicions all end up in a vendor's infrastructure, retained under a policy the investigator never wrote.
Engramite takes the opposite position. Your machine is the platform. Collection, models and the case file run there, and nothing leaves unless you send it.
What device zero actually covers
Device zero is not a storage setting. It is the whole working surface:
- Collection happens from your machine, not from a shared cloud worker.
- Analysis runs locally, including the models available to your installation.
- The case file — sources, documents, downloads, findings, reports — is stored on the device.
- Outbound traffic is something you initiate, not a background sync you inherit.
Why it matters for investigative work
Subjects are real people. An investigation touches names, faces and addresses of people who have not consented to being processed by a third-party platform. Keeping the material on the analyst's device keeps the legal basis with the organisation doing the work.
Confidentiality is the product. In due diligence, corporate security and legal work, the existence of the investigation is often more sensitive than its findings. A subject's name in a vendor's logs is a leak waiting to be requested.
Retention becomes a decision, not a default. When the case file is yours, deleting it means it is gone — not gone from a dashboard while copies persist somewhere upstream.
What this does not mean
Local-first does not mean disconnected. Investigations reach the open internet, and the workspace is built to do that carefully rather than to pretend otherwise. It means the default is local: outbound connections serve a task you asked for, not a business model.
It also does not mean lonely. Teams share what they choose to share. The distinction is between sharing an artefact deliberately and a platform holding everything by default.
How it changes the day-to-day
Analysts notice three things quickly. Material opens instantly because it is already there. Sensitive cases stop requiring an exception process, because there is no third party to approve. And when a client or a regulator asks where the data sits, the answer is one sentence long.
Frequently asked questions
Does everything have to run offline? No. The point is control over what goes out, not the absence of a network.
Can a team still collaborate? Yes — by sharing selected artefacts rather than by default residency in someone else's cloud.
What happens to a case when it ends? It is removed from the device it lived on. See provenance and retention.
Read next: what Engramite is.