Skip to content
LGM-OS Enterprise
Home Business
Sign in Buy
EN
What's new · 4.0.0 Editions · Licences · Support See what's in it →
LGM-OS · Business edition

Your company's data, in its own office.

Folders with permissions, verified backups, ransomware protection and access control, on the hardware the company chooses and managed from the browser.

See the plans Download the installer See everything it does

Free installer · 60-day trial

Try it right here

It is the real panel, whole, with the data of a sample NAS. Open the apps, go into the folders, look at the disks, switch the theme: nothing you touch exists.

LGM-OS · sample data Live demo Open full screen

Loading the panel…

The console and the cameras' live video are the only things that do not work here: they need a NAS and a camera. Everything else is the product as it is.

39hardening checks
10years of immutable retention, at most
0 €per user
7languages

What is underneath

Four layers, none of them hidden.

  1. The panelThe whole NAS from the browser, and from your phone as an app.
  2. Docker and virtual machines1058 apps prepared and tested by us, and Windows or Linux on KVM.
  3. StorageBtrfs or ZFS, with snapshots and integrity checks.
  4. The base: DebianA normal Debian underneath, stable and with its updates.

What the Business edition adds

Ransomware protection, continuity, identity, compliance, storage, virtualisation, multiple devices and video surveillance, on the same foundation as the Home edition.

Data and ransomware protection

Independent layers so that an attack or a mistake takes neither the data nor its backups.

  • WORM
  • Veeam
  • ClamAV
See the 7 details
  • Immutable folders (WORM). What is stored in them cannot be changed, renamed or deleted until the set date, up to ten years away, not even from the panel, SMB, NFS, SFTP or the apps.
  • Held snapshots. On ZFS volumes, a held snapshot cannot be released before its date, up to a year away, not even with the administrator password.
  • Hardened target for Veeam. An XFS repository with block cloning and immutability, a service account that closes itself and ports open only to the Veeam server.
  • Ransomware inside the backups. Each backup is compared with the previous ones. With several signs of mass encryption, retention stops and the last clean backup is marked.
  • Scanned restore. When restoring, ClamAV scans what is returned and leaves out infected files.
  • On-write antivirus. ClamAV scans the files in the chosen folders as they are written.
  • Secure disk erase. Erasure by the disk itself when it supports it, checked afterwards. The Business edition issues a printable certificate.

Continuity and backups

Backups off the NAS, replication to a second server and a rehearsed procedure to take over.

  • Microsoft 365
  • Google Workspace
  • S3
See the 4 details
  • Microsoft 365 and Google Workspace. Backup of each person's mail, calendars, contacts and files —OneDrive, SharePoint and Teams, or Drive—, with versions and restore to the original account.
  • Own S3 storage. An S3-compatible server with versioning, lifecycle and object lock in governance or compliance mode. It works as a target for Veeam and other backup software.
  • Replication with bandwidth and schedule. Replication to another NAS caps its speed and only sends during the chosen time window.
  • Guided failover and drill. A wizard for the second NAS to take over without ever having two primaries, and a drill that measures data loss (RPO) and recovery time (RTO).

Identity and access

Who signs in, with which account and with which permissions.

  • OpenID Connect
  • Samba AD
  • Roles
See the 5 details
  • Company account (OpenID Connect). Sign-in with the company's identity provider; its groups can assign the roles.
  • Own domain controller. Samba AD as the domain for the office's Windows computers, with DNS, Kerberos and signed time, or as an LDAP directory.
  • Roles. Auditor, Storage administration and Support, each with a permission ceiling that cannot be exceeded.
  • Two-administrator approval. Deleting a volume, a folder, an account or a snapshot needs another administrator's approval.
  • Password expiry and rotation. A warning before they expire, a history that prevents reuse and SMB and SFTP access cut off when they expire.

Security and compliance

Reviewable configuration, logs out of the NAS's reach and a report for the audit.

  • CIS
  • SHA-256
  • Trivy
See the 8 details
  • CIS-style hardening. 39 checks based on the CIS Debian Linux Benchmark, each with a fix and a way back. SSH and firewall changes are applied on trial.
  • Compliance report. Exportable as HTML or CSV, with the security status, the audit comparison and the hardening result.
  • Audit log off the NAS. The audit log, chained with SHA-256, is sent to an external server and compared with that copy to detect tampering.
  • Recorded terminal. Panel terminal sessions are recorded and can be played back; what is typed without echo, such as a password, is not recorded.
  • Modern encryption only. TLS 1.3, SMB 3.1.1 with mandatory encryption and SSH with post-quantum key exchange. Applied on trial and rolled back if not confirmed.
  • App vulnerabilities. Trivy checks the images of installed apps every week and lists their known vulnerabilities.
  • File rules per folder. Blocks saving specific file types, such as executables, over SMB, WebDAV and the panel.
  • File report. Per folder: the largest files, what nobody has opened for months and how much each owner uses.

Storage and network

Network disks, namespaces, encryption and space management.

  • NVMe-oF
  • DFS
  • KMIP
See the 9 details
  • NVMe-oF. NVMe over TCP network disks, in addition to iSCSI.
  • Single DFS path. A DFS namespace brings folders from several servers together under a single path.
  • NFS with Kerberos. NFS folders with domain Kerberos authentication.
  • Automatic tiering. What has not changed for a while moves to slower disks and returns to the fast tier when it is modified.
  • Department quotas. Usage per department, alerts at 80, 95 and 100 % and a monthly CSV report to allocate the cost.
  • Tang unlock and KMIP keys. Encrypted volumes unlock on their own with a Tang server on the network or with the key held on a KMIP server.
  • Self-encrypting drives (SED). Locking and unlocking Opal drives from the panel.
  • Bay light. Turns on a disk bay's indicator to locate it in the chassis.
  • Jumbo frames. MTU 9000 on the storage network's interfaces, checked beforehand.

Virtualisation

Virtual machines on the NAS itself and storage for the company's hypervisors.

  • Proxmox VE
  • VMware ESXi
  • Hyper-V
See the 7 details
  • Hypervisor wizard. Prepares the disk or folder for Proxmox VE, VMware ESXi or Hyper-V and gives the exact commands to connect it.
  • Snapshots with memory. They also save the running machine's state, to return to exactly that moment.
  • Instant clone. A new machine from another in seconds, sharing its base disk.
  • Live disk move. Moves a machine's disk to another volume without shutting it down.
  • Templates. Several identical machines at once, each with its own name and, with cloud-init, its own account and SSH key.
  • Firewall and internal networks. Inbound and outbound rules per machine, and networks only the chosen machines can see.
  • Boot from backup. A machine boots directly from its backup and is then made permanent or discarded.

Managing several devices

Several sites or several NAS units, managed from one place.

  • Fleet console
  • Limited-access keys
  • LGM Connect
See the 3 details
  • Fleet console. The status of every NAS in the company on one screen, and group updates, one after another, stopping at the first failure.
  • Limited-access keys. The console uses read-only or read-and-update keys, bound to each NAS's certificate: it cannot administer them.
  • LGM Connect. A single app for every device, which recognises each NAS's edition when it connects.

Video surveillance

Cameras recorded on the NAS, without the manufacturer's cloud.

  • Floor plan
  • ONVIF
  • Hikvision
See the 3 details
  • Floor plan. Up to eight plans with each camera's position, direction and field of view.
  • Backup of protected recordings. Protected recordings are copied to another destination and checked.
  • Talk through the camera. Two-way audio on ONVIF and Hikvision cameras that have a speaker.

And everything in the Home edition

The Business edition includes every feature of the Home edition, with the same updates.

Storage

The disks form a volume with the redundancy you choose. Before creating it, the wizard shows the usable space each option leaves.

  • Btrfs and ZFS
  • Snapshots
  • SMART and scrub
See the 7 details
  • Btrfs by default, or ZFS: RAID 0, 1 and 10 with Btrfs; mirror and parity (RAID 5/6) with ZFS
  • Scheduled snapshots, kept by hours, days, weeks and months
  • SMART and scrub with real progress and a notice when they finish
  • Swap a disk while it runs, without shutting the machine down
  • Instant detection when you plug in a new one
  • Space report: which folders take the room, per-user quota and duplicates
  • Secure erase before retiring a disk, using the disk's own erase when it supports it

Files

A file explorer in the browser: drag, rename and compress. The same folders open in Windows, macOS and on the phone, with the same permissions.

  • SMB, NFS and WebDAV
  • Recycle bin
  • Share links
See the 9 details
  • SMB, NFS and WebDAV on the same folder, without setting it up three times
  • The NAS shows up on its own in Windows Network and in the Finder
  • A recycle bin per folder, which you can turn off on the ones you do not want it
  • Share links with an expiry date and a password
  • Zip and unzip without downloading anything
  • Search by name and inside the contents of the files
  • Permissions per user and per group, folder by folder
  • Notepad: change a .txt or a .conf right there, without downloading it
  • Previous Versions in Windows File Explorer, taken from the snapshots

Gallery

The photos and videos in your folders, sorted by month, with a map and search by phrase. It also opens on the phone.

  • Timeline
  • Map
  • HEIC and RAW
See the 10 details
  • A timeline by month, built on its own in the background
  • Map of where each photo was taken, with streets if you turn them on
  • Search by phrase (“dog on the beach”) with the local AI, without leaving the NAS
  • Videos too, streamed in pieces: a 3 GB one is not downloaded whole
  • iPhone HEIC, RAW and ProRAW from your camera: shown without converting anything
  • Live Photos: one photo that moves, not a photo and a video twice over
  • Real albums, without moving a single file on the disk
  • Favourites, rotate, zoom, full screen and download from the viewer itself
  • Duplicates: it groups what is repeated and never lets you delete the last copy
  • Upload from the app, and whatever you delete goes to the NAS recycle bin

Your clouds, as just another folder

Connect your Drive, your Nextcloud, Dropbox or an S3 bucket and they show up in the explorer as a NAS folder. Copying from the cloud to the disk is a drag and drop. And they show up from Windows too, because to the system they are an ordinary folder.

  • Browse them from Files
  • Source for a backup
See the 4 details
  • Google Drive, OneDrive, Dropbox, Nextcloud, S3, Backblaze B2 and more
  • Your personal cloud, separate from where your backups live
  • You browse them from Files, over the network and from the search box
  • They can be used as the source of a backup

Package centre

1058 third-party apps prepared and tested for LGM-OS, such as Jellyfin, Nextcloud, Home Assistant, Vaultwarden, Pi-hole or Immich. They install in one click, with a link on the desktop and their data on the volume.

  • Our own catalogue
  • Visual editor
  • docker-compose
See the 5 details
  • Our own catalogue, searchable and by category
  • A visual editor for ports and folders, without touching YAML
  • A docker-compose editor for the advanced bits, if you want it
  • Containers you created by hand: they also show up as an app with their own link
  • Everything lives in your volume, not on the system disk

Virtual machines

Windows, Linux or whatever you need, on KVM, with the screen inside the panel. No client to install, no ports to open and no leaving the browser.

  • Graphical console
  • Boot from ISO
  • On your phone too
See the 6 details
  • A built-in graphical console, from your phone as well
  • Boot from an ISO and have it ejected on its own when the install finishes
  • Processor, memory and disks all set from the panel
  • Their disks live in the volume, with whatever redundancy you gave it
  • Import machines from VMware, Hyper-V and VirtualBox (OVA, OVF, VMDK, VHD, VHDX and VDI)
  • Scheduled backups with a boot test: after each backup, the machine is started without network to check it

Cameras

Video surveillance with the cameras at home and without the manufacturer's cloud: the NAS records, on its own disks.

  • ONVIF and RTSP
  • Video wall
  • Motion detection
See the 7 details
  • Any ONVIF or RTSP camera, and they are found on the network on their own
  • A configurable wall and full screen
  • Continuous recording in chunks, with retention by days and by size
  • Motion detection so you jump straight to what happened
  • A thumbnail for every recording and a filter by date and time of day
  • The recordings are just another folder: reachable from Files and over the network
  • Talk through the camera on those with a speaker (ONVIF and Hikvision)

Backups

Automatic backups to another disk, to another NAS over SSH or to the cloud, with versions you can go back to.

  • Local, SSH or cloud
  • Incremental versions
  • Restore from the panel
See the 8 details
  • A local, SSH or cloud destination (any provider)
  • Incremental versions: each one restores in full and only takes up what changed
  • Tiered retention: hours, days, weeks and months
  • Air-gapped USB backup: the disk is only mounted while copying
  • Backup of the computers at home with LGM Connect, with versions
  • Real progress while it copies, and a check that what is over there matches what is here
  • Object Lock on S3 and B2: not even you can delete a backup before its time
  • Restore from the panel, the whole thing or just what you pick

Access from outside

Get into your NAS from anywhere with LGM Tunnel: an address of your own on lgm-os.com, with no ports to open. Or, if you prefer, a WireGuard VPN in three clicks, with a QR code for your phone.

  • LGM Tunnel
  • WireGuard VPN
  • Dynamic DNS
See the 6 details
  • LGM Tunnel: your NAS at yourname.lgm-os.com, with the padlock and no ports to open
  • A WireGuard VPN with clients by QR code and configurable routes
  • Dynamic DNS so you get there by name even when your IP changes
  • Let's Encrypt certificates, with DNS validation that does not need open ports
  • A reverse proxy to publish one app with its own domain
  • Local DNS and DHCP, static routes and network card bonding

Security

Security measures are on out of the box, without having to look for them in the settings.

  • Two-factor sign-in
  • Automatic blocking
  • Audit log
See the 7 details
  • Two-factor and a configurable password policy
  • Automatic blocking of whoever keeps trying, on the panel or over SSH
  • A firewall that opens the port only when you turn the service on
  • Anti-ransomware: snapshots not even the administrator can delete
  • Jailed SFTP, with no access to the rest of the system
  • An audit log of everything that gets touched, downloadable
  • Logs sent encrypted with TLS to another server

Control panel

All administration from the browser, no terminal. For those who need it, the terminal is in the panel, with re-authentication.

  • Users and groups
  • Notifications
  • UPS
See the 7 details
  • Users and groups, with per-service permissions on each
  • Join an existing Active Directory / LDAP
  • Alerts over Telegram, Discord, ntfy or email, with a delayed digest
  • UPS: an orderly shutdown when the power goes
  • Kiosk mode: the panel full screen on the machine's own monitor
  • Four themes —Obsidian Pro, Cyber-Glass, Terminal NOC and Daylight Clean— and an accent colour
  • Update cache for the computers at home: Debian and Ubuntu, Docker Hub and Windows Update

Monitor

The device's status in real time and its history, without installing anything else.

  • With history
  • Alerts
  • Who is connected
See the 4 details
  • Processor, memory, network and the temperature of every disk, with history
  • Threshold alerts before it becomes a problem
  • Who is connected, from where and since when
  • Network diagnostics from the panel: ping, traceroute, ports and iperf3

LGM Connect

The LGM-OS app for computer and phone: it opens the panel, reaches the NAS from outside through LGM Tunnel and backs up computer folders to the NAS, with versions. A single app for every device in the company.

The home screen on a phone The home screen on a phone (dark)
An app full screen on a phone An app full screen on a phone (dark)

Your own server versus a per-user cloud

A per-user cloud

  • A fee per user, every month
  • The data, on third-party servers
  • No connection, no access to the files
  • Space set by the plan

LGM-OS

  • One licence per server, no per-user fee
  • The data, on the company's disks
  • On the local network, work goes on even if the internet goes down
  • As much space as the hardware allows

Getting started

Three steps. No Linux knowledge, no commands to type.

  1. Write the ISO to a USB stick

    It downloads free and comes in under a gigabyte. Any 2 GB stick will do, and the program to write it is the same one you would use for Windows or Ubuntu.

  2. Boot the machine from that stick

    It asks you four things — what it will be called, the network, your user and which disk the system goes on — and does the rest by itself. Disks are listed with their model and size, so there is no way to pick the wrong one.

  3. Hand out the folders

    From any computer in the office, using the address shown on screen: create the administrator, join the server to the domain if there is one, and give each group its folders.

The full steps, with screenshots →

Business licence
29 €
a month · or 290 € a year · or 870 € in a single payment
  • Everything in the Home edition
  • The features of the eight business areas
  • Monthly, annual or one-off payment
  • The annual plan includes one month of support per year; the lifetime plan, three months
See the plans

Secure payment with Polar · taxes included · your card never passes through here

Editions and pricing

Both editions are the same system and get the same updates; the licence decides which one is active.

Home edition: 39 € in one payment, with one year of updates, or 200 € with unlimited updates.

Technical support for any licence: 29 € a month.

See the Home edition Download Documentation

Frequently asked questions

What does the Business edition include?

Every feature of the Home edition plus those of the eight business areas on this page. Both editions are the same system: the licence decides which one is active.

What happens when the subscription ends?

Data and services keep working. The NAS moves to the Home edition and what is exclusive to Business stops being available; the Microsoft 365 and Google backup can still be browsed and downloaded.

Can it join an Active Directory domain?

Yes. The server joins an existing Active Directory or LDAP, and folders are shared with the same users and groups you already have.

What happens if the server breaks?

With mirrored disks, a failed disk stops nobody: you swap it without shutting down. If the whole machine dies, the backups and the replica on a second server let you recover everything, settings included.

What hardware is needed?

A 64-bit x86 machine with at least 4 GB of memory and disks for the data. Virtual machines and vulnerability scanning need more memory and free space.

Is there technical support?

Yes, as a separate service for any licence, for 29 € a month. The annual Business plan includes one month of support per paid year and the lifetime plan, three months.

Do I get an invoice?

Yes. Payment goes through Polar, which issues the invoice with your country's taxes included in the price.

Your company's data, on its own server.

Free installer and a 60-day trial.

See the plans Download and try it

A coffee