For your IT

For your IT

Firnkern is software for your company network, not a cloud service: a server with a browser interface on a Windows computer or a Linux server (Docker, see Linux). Nothing is installed on the workstations; employees open an address in the browser. This page sums up what your IT needs to know. The same as a sheet to pass on: IT fact sheet (PDF).

System requirements

• The computer runs during working hours and is on the company network.
• The installer is about 430 MB and brings its own Python runtime; Python does not have to be installed separately.
• Install as administrator if you want start at boot and the firewall rule.
• The computer values come from IT guide 2.7. To be honest: installing it as a web app on the computer has so far only been checked in a simulated browser environment, not yet on a real computer on a company network.

Network and ports

• The installer creates the firewall rule «Firnkern Server» if you choose that option. In service mode no Windows dialog appears; otherwise: netsh advfirewall firewall add rule name="Firnkern Server" dir=in action=allow protocol=TCP localport=8780
• Firnkern listens on the company network; it cannot be reached from the internet unless IT opens a port.

Running as a service and autostart

• At boot, without sign-in: option in the installer, or Dienst-einrichten.bat as administrator. This creates the task «Firnkern Server (Dienst)» in Task Scheduler under the LOCAL SERVICE account, without administrator rights. Rights: read and execute in the program folder, change only in the data folder %ProgramData%\Firnkern-Server\daten. No time limit, restart on crash (3 times, after 1 minute each).
• If LOCAL SERVICE cannot be set up, the program falls back to SYSTEM and says so clearly. Please tell us.
• At user sign-in: Autostart-einrichten.bat; the data is then in %LOCALAPPDATA%\Firnkern-Server\daten.
• The data folder can be moved with FIRNKERN_DATEN. Sign-in lasts 12 hours on a sliding basis, 24 hours at most.
• The page protection rule (Content Security Policy) only allows scripts from the server itself.

HTTPS on the company network

The browser only releases microphone, camera and offline mode over https (exception: the same computer, localhost). The web app on the computer can also only be installed with https and a trusted certificate, or on the server computer itself. Zertifikat-erstellen.bat <computer name> <IP> creates cert.pem, key.pem and firnkern-ca.crt in the data folder. There are three options:

1. Option A, recommended: a certificate from your company CA. Issue it for computer name, FQDN and IP (SAN), put it in the data folder as cert.pem and key.pem (PEM, key without password), restart the server. No warning page. Renew the certificate in time; Firnkern does not warn before it expires.
2. Option B: register firnkern-ca.crt on the workstations (one by one or by group policy under «Trusted Root Certification Authorities»; on phones by setting or MDM). This small CA is valid only for the names of this server; its private key is discarded after signing.
3. Option C: accept the warning page, for tests only. The connection is encrypted; in operation, employees should not get used to clicking warnings away.

Firnkern does not change certificate stores on workstations. Admin › «Check technology» shows the state under «Certificate (HTTPS)». In detail: the guide “HTTPS on the company network” (part of the software).

Backup and restore

• The server backs up automatically every day (database plus recordings, documents, AI settings and certificate as a ZIP) and renews the daily backup every six hours. 14 daily backups are kept.
• The admin can at any time start a backup under «Employees» › «Backup», download the data folder as a ZIP and restore a backup. To restore, the admin types the confirmation word WIEDERHERSTELLEN; a backup of the current state is made first and all sessions are ended.
• IT's task: include the data folder in the company backup every day. While the server is running, use the files in sicherungen\, not the open firnkern.db.
• The downloaded backup contains the cloud key (ki_schluessel.txt) in plain text, plus geheimnis.key; without that file the two-factor secrets can no longer be read after a restore. Keep backups as protected as the database.

Updates

• The admin installs updates; nothing is installed automatically. During the term you are entitled to all new versions (Terms B4).
• Back up first: stop the server, copy the data folder, then install the new version. The data folder lies outside the program folder and stays. Before a schema extension the server automatically creates a backup vor-update-…db.
• The update check is an option, off until the admin switches it on under reporting and updates. It fetches a signed list daily; Firnkern receives the IP address and the version.
• Firnkern supports the current and the previous major version (Terms B4).

What the software sends to the internet

Nothing without your admin's action. The software sends nothing to Firnkern unless the admin switches it on; dossier content is never sent (Terms 10.1, F4). What you can switch on, or what happens once:

• IT can permanently forbid cloud AI with the environment variable FIRNKERN_CLOUD_KI_AUS=1.
• When installing from the program folder (IT guide 2.7), setup needs access to pypi.org and files.pythonhosted.org once.
• There is no telemetry. Basis: privacy notice 2.5 to 2.7.

Linux server with Docker

Instead of Windows, Firnkern also runs on a Linux server of your company, in a Docker container in your own company network. It is the same software with the same licence (in the pilot phase with a voucher); the data stays on your server.

The Linux package 1.7 will be available for download here once Firnkern 1.7 is released after the final test. As a pilot company you receive the link on request: Become a pilot company.

sha256sum -c SHA256SUMS-Linux-<version>.txt
tar xzf Firnkern-Linux-<version>.tar.gz && cd Firnkern-Linux-<version>
./firnkern.sh start                       # shows the address
./firnkern.sh code                        # setup code for the first setup in the browser
./firnkern.sh zertifikat server.firma.local 192.168.1.20   # HTTPS in the company network
./firnkern.sh sicherung /srv/backup/firnkern               # e.g. daily via cron

More commands: status, stopp, wiederherstellen (restore), update, protokoll (log). The full guide (DE/EN) is in the package: LIES-MICH-Linux.txt.

Installer: unsigned, SmartScreen, checksum

The SHA-256 checksum comes with the download of Firnkern 1.7 on the page Try Firnkern; each installer also comes with a file SHA256SUMS.txt. Calculate the value in PowerShell:

Get-FileHash -Algorithm SHA256 .\Firnkern-Setup-<version>.exe

If the value does not match: do not run it and tell us. The measures come from an internal security test; an external penetration test has not been carried out.

Support period for security updates

Firnkern provides security updates free of charge for each major version for at least five years from its market launch, also after the end of the licence term in read-only mode (Terms B4). The end date (month and year) is not yet fixed; it follows with the start of sales. Please report vulnerabilities via Report a vulnerability (security@firnkern.com).

Fact sheet and contact

IT fact sheet (PDF)

Questions about installation: info@firnkern.ch or the enquiry form. Help for users is in the help centre.

As of 3 November 2026, without warranty. Firnkern GmbH i. Gr., Bosenhaldenweg 26, 4125 Riehen, Switzerland.