How it works
Working as a team, each on your own computer
When several people at the label work on contracts, reports and statements, each of them works on their own computer. Here is how they join the label, how work passes from one to another, and why our servers read none of it.
The idea
No account with us, just computers
Labelmate is a desktop app for Mac and Windows. Each person at the label installs it on their own computer, and each computer keeps its own copy of the label's work in an encrypted database. That database's key is stored in the system's secure keychain, the protected place where Mac and Windows keep secrets.
There is no account and no password with us. Each computer has its own keys, and what joins the label is a computer, not an email address. So one person can add their laptop alongside their office computer.
The app works even offline. To get from one computer to another, work goes through our relay, the service that keeps a label's computers in sync, and that needs the internet: whatever you do offline waits on your computer, then goes out with the next sync.
Joining the label
Adding a computer, in twelve words
You need a computer that is already in the label, the new computer, and the internet on both.
- 1
Create the invitation
On a computer already in the label, open Settings, then the Computers section. Say who the new computer is for (a first name is enough) and pick its role, then choose "Add a computer". Labelmate shows twelve words.
- 2
Read the twelve words aloud
Read them to the person at the new computer, who types them into Labelmate. They work only once, and never pass through our servers in readable form.
- 3
Compare the code
The new computer asks to join the label, and a code appears on both screens. Check that it matches: then it really is the computer you expect knocking at the door.
- 4
Let it in
Confirm on the first computer with "Let it in". The new computer receives the label's keys, then fills up with its work: contracts, reports, statements, files included.
Why twelve words
A secret passed on by voice, not through us
Labelmate has no account to break into: no password is kept with us. The secret that lets a new computer in passes from one person to another, out loud.
Our relay carries the new computer's request and the label's answer, but it doesn't know the twelve words. So it can neither let in a computer of its own choosing, nor trap the new computer in a fake label.
Every arrival is written into the label's list of computers, which is a signed chain: each link is signed by a computer that was already in it, and every computer reads the chain again from its very first link.
Roles
Every computer has a role
The role is chosen when the computer joins the label, and written into the signed chain of computers. An owner or an admin changes it in Settings; only an owner makes or removes an owner or an admin, and the last owner keeps the role. The first name given to the computer stays in the label: our servers cannot read it.
Owner
Everything, including making or removing owners and admins.
Admin
All the label's work, adding and removing computers.
Staff
All the label's work: contracts, reports, statements.
Read-only
Sees everything, changes nothing. For the accountant or the business manager: the app refuses every change, and the other computers set aside anything it might send.
Staying in step
Work passes from one computer to another, sealed
When someone files a contract, imports a report or records a cost, the change is sealed on their computer before it leaves: encrypted with the label's keys, which our servers don't have. Our relay keeps these sealed copies in the European Union and passes them on to the label's other computers, files included.
Every request sent to the relay is signed by the computer sending it, time-stamped and single-use: an old, replayed or wrongly signed request is refused. On arrival, each computer checks what it receives, and stops rather than apply anything that doesn't add up. Better behind than wrong.
The relay, for its part, sees the technical identifiers of the label's workspace and computers, their public keys (the ones made to be shown), the size and date of the sealed copies, and the IP address of requests. Never a name, an amount or a line of a contract.
Example
A day at Example Records, as the relay sees it
Three people, three computers, and a fourth one arriving. Here is what they do, and what our relay sees of it.
| What happens | What the relay carries | What it sees |
|---|---|---|
| Camille files a contract received by email | Sealed copies, file included | Their size and date |
| Samir imports the distributor's report | Sealed copies, file included | Their size and date |
| Inès records a recoupable cost | A sealed copy | Its size and date |
| A laptop joins the label | Its request, then the label's answer | The computers' identifiers and public keys |
Example: the label and its three people are made up. For every request, the relay also sees the IP address it comes from.
The action log
Every action is written down, and signed
In Labelmate, nothing changes without leaving a trace: every change goes through a log, the same on all the label's computers. In Settings, Change history shows it.
One entry per action
Importing a report, filing a contract, recording a cost: each action a person takes becomes an entry in the log, which says what was done, by whom, from which computer and when.
Signed by its computer
Each entry carries the signature of the computer that made it. An entry forged elsewhere, or altered on the way, fails the check.
Chained to the one before
Each entry points to the one before it. Nobody can take one out, or slip a fake one into the middle, without breaking the chain.
Whole, or not at all
An action always travels in one piece: the other computers receive everything it changes, or nothing. Nobody ever sees an action half done.
When someone leaves
Removing a computer changes the label's keys
Someone leaves the label, a computer is lost or replaced: the computer in question is removed from the label. The removal is written into the signed chain of computers, and from then on our relay refuses that computer's requests.
At the same time, Labelmate changes the label's keys and hands the new ones to every computer that remains. Everything written afterwards is sealed with a key the removed computer never had, and anything it might still send is never applied.
One limit, true of any software: what that computer had already received stays on its disk. Removing a computer protects what comes next, not the past.
Backups
An encrypted backup that stays with you
Having the label on several computers doesn't replace a backup. Labelmate saves a copy of the label's database in the computer's Documents folder, encrypted with a fresh key for each file. In Settings, you see the date of the last one, and can make one at any time.
To open a backup on a new computer, choose "Restore from a backup" when Labelmate first opens, then type the label's recovery kit: twenty-four words, shown once when the label was created, to write down on paper. We don't have them and cannot recover them. Mailbox passwords are not in a backup: they are entered again in the settings. After a restore, syncing and Labelmate's AI wait for an invitation from a computer still in the label (Settings, Computers); if none remains, write to us.
Keep your backups and your kit somewhere safe. If the label lost all its computers and the means to restore its backups, nobody, not even us, could recover its data.
How Labelmate protects teamwork
Can you read what our team exchanges?
No. Everything that goes through our relay is sealed on the computer that sends it, with keys that never leave the label's computers. We only see technical information: identifiers, public keys, the size and date of copies, IP addresses.
Where is our data?
On the label's computers, in an encrypted database. The sealed copies are also kept on our relay, in the European Union, while the label uses Labelmate, and deleted no later than one month after it asks us to close its workspace.
Can our accountant see everything without changing anything?
Yes. Give their computer the Read-only role: it sees the whole label, and the app refuses every change. A read-only computer still keeps an encrypted copy of the label: give it to someone you trust.
Does the mailbox password travel from one computer to another?
No. It stays in the secure keychain of the computer where it was typed, and is never sent to us.
What if a computer is lost or stolen?
Its database is encrypted, with a key kept in the system's secure keychain. Removing it from the label changes the label's keys: it receives nothing written after that.
Read next
All resources
LabelmateAI in Labelmate
What it reads, what it never does, what is masked and where the text goes.
Read
The lawRoyalty statements in the US
What record contracts usually ask, and California's audit law.
Read
The lawArticle L. 212-15, explained
What French law asks of labels: account for the calculation every six months, explicitly and transparently, and give the supporting documents to the artist's accountant.
Read
Your next statements, without spreadsheets.
50% off year one for the first 10 labels, with no risk: you pay nothing until your last statements are rebuilt to the cent.
Apply for accessPhotos Thirdman, Pixabay, Nathan Thomas, Zulfugar Karimov on Pexels.