Will this still be working in ten years?

If this project stopped existing tomorrow, every Multilarm device in every building would carry on doing exactly what it does today — schedules, announcements, speech, music, zones, relays, the emergency button and the dashboard on its own network. The only thing that would stop is the optional Cloud Relay, because that is the only part hosted by us. That is not a promise about our intentions; it is a consequence of the software being offline-first and perpetually licensed, and you can verify it this afternoon by unplugging the network cable.

What keeps working with no vendor and no internet

The schedule: Every scheduled event, bell, announcement, prayer time, shift signal and volume rule. This is the whole product and it is computed on the device from a local file.
On-device speech: Typed text spoken by the neural voice that ships with the software. The model is on the disk in the building. It does not call anything.
All audio playback: Alarms, background music, ambience, quotes, ducking, crossfade, zones, multi-room sync, DSP.
Hardware: Relay outputs, the bell, the GPIO emergency button, zone muting, serial and MQTT triggers.
The LAN web remote: The dashboard and the whole REST API on the device’s own port, from any browser in the building.
The Config Generator: It is a single HTML file that runs entirely in your browser. Save it and it works with no site, no network and no us.
Your data: The configuration is plain XML you can read and edit in Notepad. Audio is ordinary MP3, WAV, FLAC and OGG files in ordinary folders. Logs are text. Nothing is in a proprietary database and nothing is encrypted against you.

What would stop, stated plainly

The Cloud Relay: Remote control from outside the building, the hosted dashboard, phone and desktop alerts routed through us, and the e-mail alerts our server sends. This is the part that is hosted, and it is the part that would stop. It is also the only part billed monthly, and the device is designed to run without it — turn it off today and the building carries on unchanged.
Signed automatic updates: There would be no new releases to fetch. The installed version keeps running; the updater simply finds nothing.
Us: Support, commissioning, new features, bug fixes.

The licence

Institutional licences are bought once and do not renew — there is no expiry, no reactivation, no seat count and no phone-home check. Personal, non-commercial use is free permanently, with every feature present. The only recurring charge on the price list is the optional Cloud Relay, which the device does not require. Pricing and terms →

Updates, and how a bad one is survived

Updates are opt-in and off by default. When enabled, the device checks about once a day, verifies a SHA-256 hash and a signature over the manifest, keeps the previous binary, and rolls back automatically if the new build does not come back online. A failed build is not retried for 48 hours, so a bad release cannot loop. On Debian and Raspberry Pi OS you can skip all of that and let apt upgrade do it with the rest of the machine.

Release history

Dated, and limited to changes a customer would notice.

Date	Version	What changed
2026-09-07	`1.2026.907`	Published installers are now named from the installer itself rather than the build stamp, so a versioned download URL can never hand you a different build than its name says. Current published build.
2026-09-03	`1.2026.903`	Endpoint supervision: a silent nightly self-test of relays, rooms, devices, files and the speech engine, and a weekly printable PA Health Report. One-command Linux installer.
2026-08-31	`1.2026.831`	Incident workflow with drills and escalation, desktop alert client, per-output DSP (EQ, delay, limiter), talkback, Node-RED nodes, and a Slack / Teams / Discord alert channel.
2026-08-30	`1.2026.830`	Multi-room synchronised playback, measured on real hardware.
2026-08-24	`1.2026.824`	General-purpose release: the scheduler stops assuming one kind of building.
2026-08-22	`1.2026.822`	Multilarm Network monitor ships and auto-starts on all four install shapes; alert delivery armed and proven end to end.
2026-08-17	`1.2026.817`	Disk-bloat fix: old self-contained bundles are pruned automatically. A long-running Pi had accumulated 19 GB of them.
2026-08-15	`1.2026.815`	Signed apt repository for Debian and Raspberry Pi OS (arm64 and armhf), so updates ride the machine’s ordinary apt upgrade.
2026-05-15	`1.2026.515`	Neural on-device speech (Kokoro 82M) replaces the previous pipeline end to end. Runs offline on a Raspberry Pi; no cloud speech service, no GPL code.

The current published build and its hashes are in /multilarm/latest.json, signed, with a matching SHA256SUMS beside the binaries.

Security reporting

Report privately to hello@multilarm.com with “security” in the subject. Please allow time for a fix before publishing. Nothing will be pursued against anyone who reports in good faith. Devices hold no customer data beyond the site’s own configuration and audio; cloud accounts hold e-mail addresses, device tokens and command history.

What we deliberately do not promise

There is no public status page.: The cloud relay does not currently publish an uptime dashboard. What exists instead is on the device: it tells you locally when it cannot reach the relay, and a nightly self-test reports the health of the things in the building. If a published status page matters to your procurement, say so — it is a fair thing to want and it is not built yet.
There is no numeric response-time SLA.: Support is included in every licence tier and escalates with the tier, and the pricing page states what each tier gets. What it does not state is a contractual "four working hours" number, because a number that cannot be honoured every time is worse than no number. If you need a contractual response time, ask, and it will be agreed in writing or declined honestly.
This is a small operation.: Said plainly because you would find out anyway. The mitigation is not a promise about staffing; it is the architecture — offline-first, plain-text configuration, a perpetual licence, and a device that needs nothing from us to keep doing its job. Judge that rather than the headcount.
It is not fire-alarm equipment.: The emergency voice alerts sit alongside a certified fire detection and alarm system. They never replace one, and no future release will change that sentence.
It is not certified to a life-safety standard.: No EN 54, no UL 2572, no NFPA 72 listing, and none is claimed anywhere on this site. Where a standard is a requirement, buy equipment that carries it.

Check this rather than trusting it

/features.json — every feature marked shipped, partial, absent or declined, with the file that implements it.
/benchmarks.json and /data/ — measured figures with device, method, date and the command that reproduces them.
/compare/ — comparisons that name what the other product does better.
Unplug the device’s network cable and watch the schedule keep firing. That test takes a minute and settles the main question on this page.

Questions

What actually happens to my installation if you disappear tomorrow?

Nothing, on the day, and nothing on any day after it — except that remote control from outside the building stops when the hosted relay stops. The device computes its own schedule from a local file, speaks with a local voice model, and drives its own hardware. It does not check a licence server, it does not need our site to boot, and it has no expiry date to reach. That is a property of how it was built rather than a promise about how long we intend to be here.

Does the licence expire, or convert to a subscription?

No. The institutional licence is bought once and does not renew. Personal, non-commercial use is free permanently. The only recurring charge is the optional Cloud Relay, and cancelling it does not disable anything on the device.

Can I keep using it with no internet at all?

Yes, indefinitely, and a number of sites do. Scheduling, speech, playback, hardware and the LAN dashboard are all local. The only things that need the internet are remote control, an internet radio stream if you have configured one, and fetching updates.

If I stop paying for the Cloud Relay, what do I lose?

Remote control from outside the building, the hosted dashboard, and the alerts our server sends on the device’s behalf. You keep the LAN dashboard, the REST API, webhooks and MQTT, so a site with its own VPN or monitoring can replace most of it without us.

Is my configuration locked into a format only you can read?

No. The configuration is XML with named elements you can read without documentation, the audio is ordinary files in ordinary folders, and the logs are plain text. If you replaced Multilarm with something else tomorrow, everything describing your building would still be readable.

How do I report a security problem?

By e-mail to hello@multilarm.com, with "security" in the subject. The repository’s SECURITY.md carries the same address and the disclosure expectations: report privately, allow time for a fix, and no action will be taken against anyone who reports in good faith.