NERV is a desktop application. When it starts, a local coordinator brings up everything the workspace needs — storage, application services, analysis, the policy layer, privacy services and a few restricted endpoints — and the interface shares one identity, one active investigation, one set of permissions and one stream of events across all of them.
Start-up sequence
- Check the licence, make sure only one instance is running and unlock the encrypted volume where one is used.
- Prepare the local database and its initial data.
- Start local state services, keeping privacy state apart from everything else.
- Start the application services, the interface, analysis and background workers.
- Activate the policy layer.
- Start collection services and, when configured, the anonymity network and private search.
- Open the restricted endpoints, warm up and report that the workspace is ready.
The ready state is only reported once every step has finished, so a workspace that says it is ready is actually able to work.
What is exposed, and what is not
- A single local entry point receives all traffic from the interface.
- The few endpoints that must be reachable from outside publish only what they need, never the whole workspace.
- The Terminal exists only on the local desktop.
- In anonymous mode, private search goes through Tor and fails closed: if the anonymity network is not available, nothing is sent instead of being sent in the clear.
Why local
Your machine is the whole platform. Collection, models and the case file live on it, and nothing leaves unless you send it. That keeps sensitive investigations under your control and removes a whole class of exposure that comes with shared cloud infrastructure.