IATRT OS · for business
A highly secure business operating system that isn't Microsoft, Apple or Google.
Sign in on any IATRT machine and your work is there. Encrypted, backed up, remote support built in. Your files stay on hardware we own in Darwin.
- Built on Ubuntu 26.04 LTS
- Your account, not a cloud giant's
- Light on RAM, kind to older PCs
- Supported from Winnellie, by the people who built it
Watch the intro.
Nine minutes on IATRT OS 1.4: set up a new computer, sync it, and use two computers on one IATRT Cloud account. Captioned.
Security without compromise means eight layers, not one promise.
Safety engineers call this the Swiss cheese model. No single layer is perfect. Each one has holes. You stack enough of them, with the holes in different places, and nothing gets all the way through. Here is every slice in IATRT OS and exactly what it does.
-
The network is private by default
Your computer talks to IATRT over its own encrypted tunnel, not over an open port on the internet. Nothing on your PC is reachable from outside unless you are on that tunnel.
WireGuard tunnel to IATRT's own hub in Darwin. No inbound ports. Remote support only works through the tunnel.
-
Support asks every single time
When IATRT needs to see your screen, a calm window appears on your PC and nothing happens until you click Allow. You can end the session at any moment. The icon turns red while anyone is connected, and every visit is logged with who connected and when.
No timed access. No "always allow". The per-connection prompt is enforced on the PC, not on our server, so a stolen staff login still cannot see your screen.
-
Your account belongs to you, not to a cloud giant
You sign in with your email and a code we send you. There is no Microsoft, Apple or Google account anywhere in the system, so there is no third-party account to be phished, locked or sold to.
Each PC gets its own device secret at setup. A lost PC is removed with one click and its secret stops working everywhere. Up to 10 PCs per account.
-
Only signed software from two places
Everything on the machine comes from Ubuntu's archive or from IATRT's own signed repository. That includes the browser: IATRT ships its own fork of Brave, pushed from the IATRT repository. Security fixes install themselves. There is no app store that can push you something you did not ask for.
Ubuntu 26.04 LTS packages plus IATRT's
.debpackages, signed with a key that lives on one desk in Winnellie. Snap and every other browser are pinned out. Unattended upgrades on. -
The boot path is locked
The machine only starts code that is signed. The boot menu needs a password to be changed. A recovery partition lets IATRT reissue the PC to a new person without the old person's data ever being readable.
Secure Boot shim plus signed GRUB. Boot menu password. Recovery partition with the installer, never a pre-encrypted copy of anyone's system.
-
The whole disk is encrypted, every machine with its own key
If the laptop walks, the thief gets a brick. The key is made fresh on each PC at setup, so no two IATRT machines share key material. Your passphrase opens it day to day. The only other way in is the sealed recovery in layer 8, with you in the shop.
LUKS2 full-disk encryption, forced, not optional. Owner details are not written into the disk header. The recovery key is held sealed by IATRT, never shown on screen or paper.
-
Your files are encrypted before they leave your computer, and kept with history
Documents and Desktop sync to IATRT Cloud, on hardware we own in Darwin, encrypted on your PC with a key only your disk passphrase or recovery key can open. A copy of every day is kept for 30 days, so a file you deleted or a folder a virus mangled on Tuesday is back on Wednesday. Deleted accounts sit in a trash for 14 days before anything is destroyed.
Your files and their names are encrypted on your own computer before they leave it, so IATRT's server never holds a readable copy. Nobody at IATRT can read them from the server: no staff tool can list, open or download them. The one way we can open them is the offline recovery tool in layer 8, at your request, with you present. Per-device logins, server-side quota, nightly snapshots of the encrypted bytes, multiple failsafes.
-
Lost everything? There is still a way back
Forgot the passphrase? PC dead? IATRT keeps an offline recovery tool that can open your disk and your cloud files. It lives on one computer in the shop that never goes online, it is used only when you ask, and only with you there in person, ID in hand. Every use is recorded. We cannot reset your passphrase. What we can do is recover your files, delete the old cloud account, let you set up a fresh one with a new passphrase, and put the files back.
Sealed escrow, encrypted with age to a key held offline. Opened on request, in person, audited, never from the server.
What IATRT can see, and what we can't.
Most vendors never answer this. Here is the honest list.
| About your computer | Can IATRT see it? |
|---|---|
| Your screen | Only after you click Allow, and only while the icon is red. |
| Your name, email, mobile, the PC's model and serial | Yes. Collected at setup so we know whose machine we are supporting. Listed in the agreement. |
| That the PC is on and up to date | Yes. It checks in every half hour with its hostname, version and sync state. |
| Your files in IATRT Cloud | Not from the server. They are encrypted on your own computer before they leave it, names included, so the server holds only ciphertext. No staff tool can list, open or download them. The only way IATRT can open them is the offline recovery tool, in person, at your request. Nightly copies of the encrypted bytes are kept for 30 days. |
| Your saved passwords, Wi-Fi keys, browser logins | No. Never copied, never synced, never backed up by us. |
| What you browse, type or open | No. There is no telemetry agent in IATRT OS. Ubuntu's own reporting is off. |
| Your disk's recovery key | Not from the server. A sealed copy can be opened only on one offline computer in the shop, by the director, with you present, and the use is logged. |
It runs cool on the hardware you already own.
Most of what makes a modern PC feel slow is not the hardware. It is the antivirus scanning, the telemetry, the search indexer, the app store updater and the cloud sync agent all fighting over the same disk. IATRT OS ships none of that, so the machine does your work instead of its own.
Less resource hungry than the systems it replaces, and built to self-clean: updates install themselves, old file versions and trash expire on their own.
Background agents you did not ask for. No telemetry, no antivirus service, no store updater, no ad delivery.
Of security updates on the Ubuntu LTS base, ten with Ubuntu Pro. Hardware from the last decade stays useful instead of becoming e-waste on a vendor's schedule.
Measured figures for idle memory and boot time on the shop's own machines are being added. Ask us to boot one in front of you.
What's in the box.
A curated set that covers a working day. Nothing you have to uninstall on day one.
Brave
IATRT's own fork. Fast browser with tracking blocked out of the box. Your bookmarks and open tabs follow you to any IATRT PC you sign in on.
Thunderbird
Mail, calendar and contacts. Works with your existing mail, or with mail IATRT hosts for you. Your accounts, address books, calendars and filters are saved to your IATRT account once a day; a new PC picks them up and asks for your mail password once.
LibreOffice
Documents, spreadsheets, presentations. Opens and saves Microsoft formats. Right-click in a folder to make a new one.
IATRT Cloud
Documents and Desktop synced, an on-demand folder for the big stuff, 30 days of previous versions, reachable from any browser with your email, a code and your disk passphrase. Decrypted in the browser, never on the server.
IATRT Support
The menu at the top right: ask for help, see who is connected, turn remote support off or on, check your cloud space.
The everyday bits
VLC, a PDF reader, camera, printing straight from the file manager with no dialog. Settings, printers and your desktop layout are saved once a day and move with you to a new PC. The fine print is in the next section.
What moves with you, and when.
Your files sync all day. Your settings move as a daily snapshot. Here is exactly what that means, so a new PC never surprises you.
| On a new PC you sign in to | What actually happens |
|---|---|
| Documents and Desktop | Live. Synced as you work, on every PC on the account, with 30 days of previous versions. Downloads is not synced unless you add it from the IATRT Support menu. |
| Brave bookmarks and open tabs | Live. Bookmarks are merged across your PCs as they change. Open tabs move to whichever PC you open Brave on next. |
| Thunderbird accounts, address books, calendars, filters, local mail | Daily snapshot. Saved at 8 pm each evening, and once after a new PC finishes its first sync. A mail account you set up this afternoon is not on the other PC until tonight's snapshot, or until the settings are saved by hand (iatrt-cloud snapshot in a terminal, or ask us). If Thunderbird is open when the snapshot arrives, it is placed at your next login. |
| Desktop settings, Files bookmarks, printers, time zone, the list of installed apps | Daily snapshot. Same timing as above. Printers and apps are restored by the system layer, which may take a minute after first sign-in. |
| Saved passwords, Wi-Fi keys, browser logins, mail passwords | Never. Nothing that holds a password or a key is copied, by design. You type each one once more on the new PC. Thunderbird will ask for your mail password the first time it opens. |
| Which PC's settings a new one takes | Only a fresh PC takes them. A new PC that has never saved or restored settings itself takes the newest snapshot from your other PCs, without asking. A PC you have already been using does not pull another PC's settings on its own; ask IATRT and we restore them for you. |
| Files over 2 GB | Stay on the PC. Unless you move them into the IATRT Cloud on-demand folder. |
| How many PCs | Up to 10 per account. A lost PC is removed with one click and its device secret stops working everywhere. Your files stay in the account. |
For customers on our network support and monitoring plans. Storage is sized per customer. The computer itself is yours under normal purchase terms.
See it on a real machine, with your own files on it, before you decide anything.
Ask us for a demo