Ownware OS + Own Your AI

Why this suite

Two things a business rents today that it could own: its software and its AI. Ownware OS is the first — every app in this catalog plus the control plane, bought once. Own Your AI is the second — an assistant and agent that runs on a model you own, counts every outside connection, and drives every one of those apps through their /mcp. Together they are the whole argument in one purchase: the shelf, and the pair of hands that works it, neither of them billed per seat, neither of them able to change terms on you.

Bought separately: $499 + $249. Together: $699 — the AI at a discount because it is the reason the shelf becomes a system.

Honest limitations — the whole suite

Each product's own limits apply unchanged when it arrives as part of the suite.

Own Your AI (OYA) — a sovereign AI assistant and agent that runs on your machine

• Not a model: you bring the model server (llama.cpp, Ollama, LM Studio, vLLM); the setup recommends and downloads one, verified
• Linux and macOS are the execution hosts; Windows users run it under WSL (the isolation verdict is self-verifying there)
• No desktop app, editor plugin, image generation, speech, browser automation or messenger bridges in the core — those are pieces, or not at all
• The public showcase at oya.ownware.io replays recorded runs; there is no model on that box — OYA runs on yours
• Mail is IMAP/SMTP over TLS with app passwords; OAuth-only mailboxes are not supported

SaaS Kit — Multi-Tenant Control Plane for PHP Apps

• Not for $3 shared hosting — per-tenant databases need CREATE DATABASE privileges, so a VPS or a host where you control MySQL is required
• You need wildcard DNS (*.yourapp.com) pointed at your server — no wildcard record, no tenant subdomains
• Billing is bring-your-own-Stripe; this is not a payment processor and takes no cut
• Isolation is at the PHP/database level, not container level — not Docker/VM-per-tenant infrastructure isolation
• Not the end business — if you're one company wanting one instance, buy the underlying product itself, not this kit

Invora — Invoicing & Billing System (PHP + MySQL, Self-Hosted)

• Invora never processes cards. Bring your own payment link (Stripe Payment Link, PayPal.me, your bank's page); payments are recorded here when they land.
• Not double-entry accounting, a general ledger or an ERP — it exports clean CSV/JSON for whatever keeps your books.
• Single-tenant: one business per installation.
• Email goes through your own SMTP server; there is no relay and no sending service.
• Nothing is emailed automatically — every client email is a button a person presses.

Slotly — Appointment & Booking System (PHP + MySQL, Self-Hosted)

• No online card processing at booking. Deposits are quoted and tracked; your own payment link (a Stripe or PayPal page) is shown to the customer beside the amount due, and Slotly never touches the card.
• Calendar feeds are one-way (Slotly → your calendar) via token-guarded .ics; external calendars are not read back.
• On the autumn DST change the repeated wall-clock hour is offered once, not twice — only relevant if you take bookings between 2 and 3 a.m.
• Not built for a multi-vendor marketplace.
• Single business per install.

Vendra — POS & Inventory System (PHP + MySQL, Self-Hosted)

• One shop per installation (single stock ledger, single drawer).
• Vendra records card tender; it does not process cards.
• No e-commerce or website stock sync.
• Emailed receipts and the day-close email need your own SMTP details, and both ship switched off; without SMTP the receipt is still printable and viewable on screen.
• Barcode hardware: keyboard-wedge USB scanners work as typed input; no driver-level integration.

Gymora

• Not a public booking site: no online timetable, reservations or membership purchase. The one member-facing screen is the self-check-in kiosk.
• Single location, single-tenant: one installation per gym.
• No built-in card processing — payments are recorded, not taken. Nothing the product sends asks a member to pay, because it cannot receive the money.
• Email goes through your own SMTP server, and every message — to you or to a member — is off until you switch it on. There is no SMS.
• Expiry notices need a scheduler: cron/expiring.php must run daily — the app runs no background jobs by itself.

Rentara

• Single-operator, single-tenant install: one portfolio per installation.
• Not for finding or marketing to new tenants; not a general ledger.
• No online rent payment processing. Payments are recorded, not taken — and nothing Rentara sends a tenant asks them to pay.
• The tenant portal is a per-lease magic link: no accounts, no passwords, no payment page.
• Email goes through your own SMTP server. Messages to a tenant are off until you switch them on.
• No background jobs: arrears are computed when you look, and tenant notices fire on an event, not a schedule.
• Very large portfolios (hundreds of units) want a custom setup.

Consigna — Self-Hosted Consignment & Resale-Shop Manager

• No barcode scanner, label printer or cash-drawer hardware integration.
• No payment processing — payouts are recorded, not transmitted.
• One shop per installation; your team shares it with roles.
• The consignor portal is read-only by construction — it resolves a hashed token and renders; there is no write route behind it.

Approva

• Not an accounting system or ERP; it does not post to a general ledger.
• It does not process payments — Approva approves requests and issues POs; it never moves money or pays vendors.
• No 3-way matching (PO ↔ goods receipt ↔ invoice), no inventory, no budgeting or encumbrance accounting.
• No punchout catalogues or supplier portals — a request describes the purchase in your own words.
• One currency per installation (pick any at install — EUR, GBP, AUD, CAD, CHF and more are formatted natively).
• Single-tenant: one organisation per installation.

Cashora — Petty-Cash Ledger (PHP + MySQL, Self-Hosted)

• Cashora records cash movements; it never processes, moves or holds money.
• One business per installation (many cash boxes inside it).
• Receipts are attached files and text references — there is no OCR reading them for you.
• Counts record what was found; Cashora never invents an entry to make a difference disappear.

Commissa — Sales-Commission Calculator (PHP + MySQL, Self-Hosted)

• Commissa computes commission; it pays nobody and moves no money.
• No live CRM connection — CRM deal exports import as files, matched to reps by name.
• One currency and one company per installation.
• Reps have no logins: statements are emailed to them, never self-served.
• Nothing is emailed on a schedule — a statement email is a button a person presses.

Privara — Self-Hosted GDPR DSAR Management Portal

• No automated data-discovery across systems — it tracks requests, it does not scan your databases for personal data
• Not a full GRC suite: no policies, DPIAs, breach management, or staff training records
• Not built for multi-tenant SaaS platforms needing isolated per-customer workspaces
• Using Privara doesn't itself make you GDPR-compliant — legal sufficiency of your responses is your responsibility

Confida – Self-Hosted Whistleblowing Portal

• Single organisation per install (not multi-tenant).
• No supervisory-authority e-filing and no e-discovery platform.
• Handler email notifications deliberately carry no report content, and attachments never leave the server by email, webhook or calendar feed.
• Attachments are photos only (JPEG/PNG, metadata stripped, encrypted at rest); documents are refused because their author metadata cannot be reliably removed.
• Anonymity is an application guarantee, not a network or hosting guarantee — HTTPS and sane server logging are on you.
• Aligns with the EU Whistleblowing Directive's timers and workflow; it is not legal advice.

Complia

• Single-tenant: one organisation per installation (your team shares it, with viewer / member / admin roles and invite links).
• Email goes through your own SMTP server, never ours — and there is no automatic "deadline approaching" reminder: a date passing is not an event Complia observes, and watching for it would need a background job this product does not run.
• Not a case-management suite: no assignments, no SLA escalation ladder, no billing. Attachments and an append-only investigation log are in; work allocation is not.
• English-language UI.
• A records aid, not legal advice; buying it does not make you compliant.

Packora — EPR Packaging Producer Register & Report Builder

• US-state scope; no EU/Canada programme logic and no PRO API integration.
• Fee figures are estimates from the rates you entered — no eco-modulation, minimums or mid-year schedule changes.
• You maintain the reference data (materials, deadlines, rates); verify with your PRO each cycle.
• One company per installation; your team shares it with roles.
• Annual granularity, matching the annual-report cadence.
• Reminders reach people, not portals: Packora never files, submits or logs in for you.

Nexura

• Monitors thresholds only — it does not calculate, prepare, or file returns.
• Threshold data is a convenience starting point and must be verified with a professional; every threshold is operator-editable, with the change audited before/after.
• Trigger-date estimates are simple run-rate projections from your own averages — for planning, not advice.
• You decide which sales to enter per state (marketplace-facilitated vs. direct, exempt sales, sourcing) — that judgment belongs with your accountant.
• Single-tenant: one admin account per installation.

Safora

• Single-tenant: one business per installation (staff share the one instance, with roles).
• Safora documents your records; it does not connect to fridge probes or IoT sensors — staff enter readings, and a sensor posting to the REST API raises the same alerts a person would.
• It does not submit anything to any authority; it produces records you keep and present.
• Not legal advice, and not a certificate of compliance. The thresholds are HACCP-aligned defaults you can change; the bank-holiday list is England & Wales — one-off royal holidays, Scotland and Northern Ireland differ.
• Email goes through your own SMTP server; the open-breach chase is off until you switch it on.

Waiverly — Digital Waiver & E-Signature Kiosk (PHP + MySQL, Self-Hosted)

• No government-ID identity verification, notarization, or eIDAS advanced/qualified signatures — Waiverly proves what text was signed and that it has not changed, not who the signer legally is.
• No online payment collection: signatures, not money.
• Email goes through your own SMTP server — Waiverly ships no mail service and opens no account for you.
• A record-keeping tool, not legal advice — whether your wording protects you is a question for your lawyer.

Secreta

• Text secrets only — no file sharing: a file carries metadata about whoever made it, and a product whose whole claim is that the server learns nothing should not store documents it cannot read but can still leak.
• HTTPS is required in production — the encryption happens in the browser, and browsers only expose Web Crypto on a secure origin.
• Opening a link spends a view even if a passphrase attempt is wrong: the server cannot tell whether decryption succeeded — recipients are warned before revealing.
• A lost passphrase cannot be recovered. There is no reset, because the key never reached this server.
• Secreta sends no email at all: invitations and share links are handed over, never posted.

Certora — Bulk Certificate Generator + Verifier (PHP + MySQL, Self-Hosted)

• Not a PKI/digital-signature system — verification is a database lookup on your server: the code resolves to the record you issued, or it does not. Provenance, not cryptography.
• Email goes through your own SMTP; certificates are delivered as a private link, never as an attachment, and delivery is off until you switch it on.
• A seal or logo on the certificate must be a JPEG or a plain 8-bit PNG (no transparency, interlacing or palette) — the PDF is written without an imaging library on purpose.
• Single-tenant: one issuing organisation per installation.

Extracta — Self-Hosted AI Invoice & Receipt Data Extractor (BYO Key)

• No API connection to accounting software — named CSV presets (QuickBooks, Xero) you upload yourself: nothing to authorise, no vendor that can cut you off.
• Single-tenant: one admin account per installation.
• No OCR built in — the vision model you configure does the reading; every extracted figure is shown for a human to approve before it counts.
• Scanned PDFs (images embedded in a PDF) may extract less accurately than native text-layer PDFs.
• Extraction accuracy is not guaranteed for any specific format, language, or jurisdiction — which is why the review screen exists.

Expensa

• No API connection to accounting software — named CSV presets (QuickBooks, Xero) you upload yourself.
• Not accounting software: it turns receipts into a reviewed, exportable expense report — no ledger, no filing.
• No OCR of our own: bring your own vision model; every figure is human-approved before it counts.
• Single-tenant: one business per installation — run one per client if you are a bookkeeper.
• Email (yours and the claimant's) goes through your own SMTP; claimant email ships off until you enable it.

Specta

• No direct storefront API integration — export CSV/JSON and import it yourself. The import-header check tells you whether that file will land cleanly in your store before you try.
• Confidence scores are heuristic, computed offline from parse quality — a review-priority signal, not a probability of correctness.
• Batches process one file per request (deliberate, for shared hosting): a 20-file batch is 20 model calls at your own provider cost, and the auto-advance page must stay open.
• BYO key: an OpenAI or Anthropic key, or a local Ollama with a vision model. Multi-page PDFs are best with Anthropic; other providers are best-effort.
• One row = one product (flat catalog): size × colour variants export as separate rows your store then groups.
• Single-tenant: one admin account per installation. No OCR built in; the model you choose does the reading.

Cargora

• No ERP or accounting API integration — Cargora writes importable files (documented columns) and you import them. No vendor API is spoken, no credentials held.
• PDF extraction works best with text-layer PDFs; scanned pages depend on the model you configure.
• One-user install (single-tenant): one admin account per installation.
• Reconciliation matches by SKU (case- and spacing-insensitive, punctuation significant); lines without a SKU are reported rather than matched.
• No OCR built in; the model you choose does the reading.

Ledgira

• No bank feed / Open Banking: Ledgira reads statement files you already have.
• No API connection to accounting software — named CSV presets (QuickBooks, Xero) you upload yourself.
• Not the book of record; it reconciles and hands off.
• No OCR of our own: bring your own model; every figure is human-approved.
• Single-tenant: one business per installation.

Menura

• No POS API integration — Menura writes files (POS CSV / nested CSV / JSON, columns documented in the README and pinned by tests) and you import them. No till vendor's API is spoken, no credentials held.
• PDF extraction works best with text-layer PDFs; a scanned or photographed menu is the model's job, and models vary.
• One-user install (single-tenant): one restaurant, one admin per installation.
• No OCR built in; the vision model you configure does the reading.
• Extraction accuracy is not guaranteed for any given menu layout or language — which is why the review screen and the POS import preview exist.

Fixora — Self-Hosted CMMS: Usage-Based PM, Parts Inventory, Work Orders

• One site per installation; your team shares it with roles.
• No native mobile app — responsive web, installable as a PWA. No app-store build to keep alive.
• Meter readings are entered manually — no IoT or telematics ingest.
• No purchasing or purchase-order module — stock is adjusted by hand or consumed by a work order.
• QR tags need a phone camera and network access to your install.
• The PM calendar feed is read-only: changes are made in Fixora, not in your calendar client.

Lendra

• Single-tenant: one organization per installation.
• Not a full IT asset-lifecycle suite — no depreciation, purchase orders, helpdesk/ticketing, and no barcode label printing. The desk reads tags from any keyboard-wedge scanner; it does not make the labels.
• Not an accounting or rental-billing tool — no pricing, invoices or payments.
• Email goes through your own SMTP server. Messages to a borrower are off until you switch them on, and the same person is never written to twice in a day.
• Lendra runs no background job of its own: overdue reminders go out when you press the button, or when something runs cron/overdue.php on a schedule.

Restock

• Forecasts are transparent moving-average estimates from your own sales history — the math is shown, not a black box, and never a guarantee.
• One company per installation; your team shares it with roles.
• No supplier or POS API integrations — the hand-off is a file (supplier / QuickBooks / generic CSV presets, or a PDF).
• Restock plans the buying; it does not pay for it (no invoices, payments or ledger).

Revup — Self-Hosted Review-Request Automation

• Single-tenant: one business per installation (staff get their own accounts, roles and 2FA).
• Email is plain-text by design — a plain message from your own SMTP lands where a templated HTML one often does not.
• Scheduling is a send window plus one follow-up, not a branching drip campaign — a second ask reads as pestering, which costs more reviews than it wins.
• The unattended schedule needs a cron entry you install yourself (one line, printed in the app, which also shows when the runner last ran).
• Twilio is the only built-in SMS provider; manual mode works with any channel you already use.
• No direct Google/Yelp API integration — the gate links to your public review URL, and review-platform policy compliance stays your responsibility.

Permora — Permit & Inspection Tracker for Trades (PHP + MySQL, Self-Hosted)

• One company per installation; your team shares it with roles.
• Permora records what staff enter — no AHJ portal, e-permitting, filing or payment integration. That is exactly why there is no filing, payment or e-signature surface on your server to secure.
• Fee totals are single-currency by design; cross-currency sums are never shown.
• Attachments are PNG, JPEG or PDF up to 10 MB, checked by content, served only to a signed-in user through a controller.
• Calendar feeds are read-only and per-feed revocable; changes are made in Permora.
• Not legal advice: whether a permit is still valid is a question for the authority that issued it.

Supplia — Supplier Register & Contract-Renewal Tracker (PHP + MySQL, Self-Hosted)

• Single-tenant: one company per installation.
• Not a contract-lifecycle suite: no redlining, versioning, approval routing, clause library or e-signature. It files the signed thing and watches the dates around it.
• No accounting or payment integration; values and payment terms are recorded text and numbers.
• Cross-currency contract values are never summed — the value currency is one business-wide display setting.
• Uploaded documents live on your own server: type decided by the file's bytes, generated filename, 10 MB cap, served only through a permission-checked route.
• The calendar feed's URL is its credential: stored hashed, revocable, carrying no contact details and no contract values.

Leavora — Staff Leave & PTO Tracker (PHP + MySQL, Self-Hosted)

• Single-tenant: one business per installation.
• Records leave only — no payroll, no wage calculation, no HRIS integration.
• Approving is always an administrator's act; self-service employees request but never decide — including their own request.
• Carryover is a single cap per leave type; tenure tiers, negative balances and part-time proration by hours are out of scope by design.
• Monthly accrual credits a month only when the employee was employed at its start (no partial-month pro-rating), so balances imported from a pro-rating system can read slightly higher.
• Email sends through your own SMTP server; every employee email is off until you turn it on.

Assetora — Fixed-Asset & Depreciation Register (PHP + MySQL, Self-Hosted)

• Assetora is a register, not accounting advice: it does the arithmetic, you confirm the policy.
• Not a general ledger — it exports the journal a ledger imports.
• No API connection to accounting software: a file you upload, by design.
• Moves no money; connects to no bank or gateway.
• Single-tenant: one business per installation.

Rostera — Staff Shift Scheduler & Rota (PHP + MySQL, Self-Hosted)

• Not a time clock: it plans and publishes shifts; it does not capture attendance.
• No pay rates, ever — hours and coverage, not wages.
• Swap requests exist; approving a swap is always a human act — there is no automated swap engine.
• Email goes through your own SMTP server; telling staff about a published rota is off until you switch it on.
• Single-tenant: one business per installation.

Clockora — Staff Timesheet & Time Tracker (PHP + MySQL, Self-Hosted)

• Single-tenant: one business per installation.
• Hours only — no invoicing, pricing, rates, wages or payroll. No email can contain a pay figure because the product stores none.
• Overlap detection applies to clock entries (start + end); manual-duration entries have no position on the clock, so a per-employee-per-day 24-hour ceiling refuses the impossible day instead.
• Email sends through your own SMTP server; every staff-facing message is off until you turn it on.
• Reminders need a scheduler: cron/reminders.php must run daily — the app does not run background jobs by itself.

Votera — Self-Hosted Feedback Board, Roadmap & Changelog (PHP + MySQL)

• Voter identity is an anonymous per-browser cookie key by default (one vote per browser); the email gate and verified voting are the opt-in escalations.
• Voters can opt in per idea to one ship notification; there is still no marketing list and no bulk mail.
• Single sign-on hand-off to your own app is on the roadmap.
• Team members are managed in the app: roles and single-use invite links.
• HTTPS recommended in production (standard for any login-bearing app).

Tokora — Queue & Token Display System (PHP + MySQL, Self-Hosted)

• The display board is a web page you open on a screen you already own — no signage hardware, ticket printer or audio caller is included, and none is driven.
• Announcements are visual: there is no audio chime or voice caller.
• Optional text alerts need your own Twilio account — Tokora ships no messaging account, and there is no email, push or WhatsApp.
• A live walk-in queue, not an appointment book: nothing here reserves a future slot.
• Single-tenant: one organisation per installation (staff get their own accounts, roles and 2FA).

Deliora — Self-Hosted Digital Product Store, Delivery & License Keys

• Payments run through a merchant-of-record or Stripe redirect — there is no on-box card processing, by design.
• Discount codes are created at your payment provider and auto-applied at checkout; prepaid redeem codes ship built-in. Deliora itself never reprices — the price a buyer sees is always the price charged.
• License signing and payment-webhook signature verification ship as demo-mode modules; real providers activate once the production signature module and keys are configured.
• No marketplace or multi-vendor features, no affiliate tracking.
• No recurring-subscription billing engine — one-time purchases with license tiers.
• Single admin login (buyers use passwordless magic links).