NDEVR OWL · Server
Your data,
stored your way.
The OWL Server is a secure, high-performance backend for collaborative 3D workflows, resource management and encrypted file sharing. In client-side decryption (CSD) with client-held decryption keys, resource and chat payloads stay end-to-end encrypted and the server receives no usable content key. Server-side decryption (SSD) is an explicit operator-trust mode; account recovery uses a recovery key held by the user, and private file metadata and folder structure are encrypted too. Run it on your own hardware, Docker, a NAS or ARM — including fully offline on an air-gapped intranet.
Choose the trust boundary
Files use envelope encryption — AES for content and EC-based key wrapping. With client-held decryption keys, the server cannot decrypt covered CSD payloads; SSD gives the operator delivery access; recovery stores only an envelope encrypted under a user-held recovery key.
Air-gapped capable
Runs fully offline on an isolated intranet with no outbound connection required. CSD payloads with client-held keys retain the same end-to-end content-encryption boundary.
Runs on anything
Windows, Linux, macOS, a Docker container, a NAS or an ARM box. One lightweight installer, no heavyweight dependencies.
★ 2026 Edition
Run your own OWL server — on anything
OWL isn't tied to our cloud. Keep every byte inside your network, even on an air-gapped intranet, with no outbound connection required. CSD with client-held keys keeps the same end-to-end payload boundary; SSD remains an operator-trust mode; user-held recovery preserves client-held keys.
$ ./owl-server --data /srv/owl --bind 0.0.0.0:8443 ▸ generating server keys… done ▸ network: air-gapped (no outbound) ✓ ▸ storage: 4.0 TB encrypted-at-rest ✓ OWL server up → https://owl.intranet.local $ ▋
Stand it up in one command
Point it at a data directory, bind a port, and it generates its own server keys on first run. There's nothing to phone home to — perfect for regulated, offline or sovereign-data environments.
Every file is stored encrypted at rest. Clients choose which servers to connect to, and the server enforces permissions, versioning and real-time sync. With CSD and client-held decryption keys, it receives no usable content key; SSD is an explicit operator-trust mode; user-held recovery does not grant the operator access.
Under the hood
A backend built for secure collaboration
Everything needed to power encrypted 3D workflows, resource management and team accounts.
Encrypted file storage
Envelope encryption combines AES for file content with EC-based access control. Files are stored as ciphertext, always.
Permission-based access
Granular sharing controls per file and per user, so people see exactly what you grant — and nothing more.
Real-time sync
WebSocket support keeps viewers, comments and selections live across remote collaborators.
Resource versioning
Every object carries full version history and traceability — switch, compare and roll back with confidence.
User identity & auth
Deterministic key generation ties identity to cryptography, with email verification built in.
Notifications & recovery
Message and version-update notifications across desktop, web and mobile, plus opt-in encrypted password recovery.
The request loop
How the server works
A simple, secure loop: the client asks, the server authenticates and serves ciphertext, the client renders, and changes sync back.
Client request
A client opens a work link and requests a resource by its address and key reference.
Server authenticates
The server validates permissions and returns only the encrypted data the client is authorized to receive.
Client renders
The browser decrypts on-device and renders the 3D scene, media or document with the granted permissions.
Sync back
Comments, markup and new versions are encrypted and synced back over secure, real-time channels.
Light footprint
Server requirements
OWL Server is deliberately lean — it'll run comfortably on hardware you already have.
Linux, Windows, macOS, Docker, NAS or ARM.
For the server itself, plus room for your files.
Minimum RAM to run; scales with load.
Speed varies by needs — or none at all when air-gapped.
Where OWL excels
How does OWL compare?
Built for security-first, self-hosted and regulated workflows — where owning your data and your backend matters.
| Feature | NDEVR OWL | Autodesk Viewer / Forge | Trimble Connect / SketchUp | Unity Reflect / Pixyz |
|---|---|---|---|---|
| Hosting control | Self-hosted or NDEVR cloud | Fully cloud-managed by Autodesk | Cloud-managed only | Hybrid (cloud + local sync) |
| Security model | CSD with client-held keys: zero-knowledge; SSD: operator trust; recovery: user-held key | 3rd-party OAuth 2.0 standard auth | User-based permission only | Project-based access |
| Data ownership | Full ownership, local or user infrastructure | Hosted on Autodesk servers | Hosted on Trimble servers | Mostly cloud-managed |
| Backend / API | Full backend extensibility in C++ / SQL | REST APIs; limited customization | Minimal customization | Unity SDK and scripting |
| Offline / edge | Yes — air-gapped capable | No | No | Partial (Unity runtime) |
| License / cost | Per-server, no per-user fees | Pay-per-usage API pricing | Per-seat licensing | Per-seat + runtime royalties |
Stand up your own OWL server.
Keep your data on your hardware, on your network, under your keys — with the convenience of a modern, encrypted 3D collaboration platform.