You Contract-Brew for Four Other Labels. Their Recipes Cannot Leave the Building — and Now They Don't Have To

"We can't use any of that. We contract-brew for four other labels and their agreements say the recipe doesn't leave our building."

That objection is correct, it is not paranoia, and until recently it was a full stop. If your co-packing agreement contains a confidentiality clause — and it does, because the brand owner's whole business is that recipe — then pasting their grain bill, their yeast strain, their hop schedule and their finished-beer spec into a service that runs somewhere in Virginia is a breach, whether or not anyone ever finds out. Most owners in this position simply opted out and kept doing everything by hand.

What changed in 2026 is that opting out is no longer the only way to stay compliant.

Name the data that cannot leave

Before you shop for anything, write down what is actually restricted. In a brewery or distillery that takes contract work, the list is usually short and specific:

• Contract brewing and co-packing recipes. Grain bill, hop schedule, yeast, water profile, fermentation curve, and the finished spec you are held to. Often covered by a signed non-disclosure that predates the brewing agreement.
• Your customers' formula approvals and label files. If you hold TTB formula approvals on behalf of a brand you brew for, those documents are theirs, not yours.
• Chain-account cost and pricing sheets. The grocery buyer's planogram, the deal calendar, the case cost by market. Grocery supplier agreements routinely restrict how that is stored and shared.
• Distributor depletion and account-level data under whatever your distributor's data agreement says.
• Employee files and your OSHA log — the ammonia system, the CO2 incidents, the injury reports. Nothing legally forces those off-site, but nothing recommends putting them there either.

Notice what is not on that list: your own recipes, your own tasting notes, your own tap list. Owners often lump everything together and freeze. The restricted set is usually a quarter of your paperwork, and the rest can go anywhere you like.

What matured, on two fronts

The first front is on-premises: a machine that lives in your own building, running a model you downloaded, with nothing crossing the property line. That has been technically possible for a while and is now genuinely practical, and it is the direction large organisations are moving too — Cisco has been explicit about the on-premises emphasis as it rolls a personal AI agent out to roughly 90,000 employees, precisely for control and data protection.

The second front is on-device: Qualcomm's Dragonwing-class processors put real capability into the tablets and rugged handhelds you would actually put on a packaging line or a tank deck. That means the thing running in the cellar does not need to reach the internet at all, which solves a second problem every brewery has — the far corner of the warehouse where the signal dies.

Running locally means the material never leaves your premises: the question, the recipe and the answer all stay on a machine you own, in a building you lock, which is the thing a co-packing confidentiality clause is actually asking for.

flowchart TD
  A["Brand owner emails recipe and finished spec"] --> B["Lands on the brewery's own server, stays on site"]
  B --> C["Brew sheet built for the cellar crew"]
  C --> D["Cellar logs readings on the line tablet, no signal needed"]
  D --> E["Nightly check against that brand's spec"]
  E --> F{"Out of spec?"}
  F -->|"Yes"| C
  F -->|"No"| G["Monthly packet released to that brand only"]

What running locally actually opens up on the floor

The gain is not privacy for its own sake. Privacy is what lets you use the tool at all on the work that generates most of your paperwork. Once the restricted material is usable, three things change.

The monthly customer packet stops being a manual assembly job. If you brew for four labels, each of them wants the same thing every month: barrels produced, packaged units by SKU and lot, yield against spec, gravity and dissolved oxygen results, any deviation and what you did about it, and their share of the raw materials you bought on their behalf. Today your production manager builds four of those by hand out of Ekos exports, the cellar logs and the lab book.

Deviation catching moves from monthly to nightly. A brand's spec says finished at 1.011, plus or minus two points. Batch 4471 finished at 1.016. Right now that gets noticed when somebody builds the packet on the fourth of next month, which is three weeks after the beer went into cans. Checked nightly against the spec sheet, the cellar lead sees it the next morning and the brand owner gets a call while there is still something to be done.

And the floor gets an answer. A packaging tech on a tablet, in a dead spot behind the depalletizer, can ask which lot code goes on this run, what the fill target is for this brand, whether this SKU is the one with the different date-code format. Those questions currently get answered by walking to find the packaging lead.

The hours, and the contract behind them

Assume four contract brands, one production manager, and monthly packets. Illustrative — substitute your own contract count and rates.

Call it $700 a month against a one-time machine and setup somewhere in the range of $12,000 to $16,000 including a contractor to stand it up. That is a two-year payback on labor alone, which is respectable but not thrilling.

The real number is the contract. Contract volume at, say, 3,000 barrels a year and a toll in the $80–$95 per barrel range is a quarter of a million dollars of revenue that runs through equipment you already own, in the shoulder months when your own tanks would otherwise sit empty. Anything that makes you a tidier, faster, more responsive co-packer defends that revenue. Being able to answer "yes, your recipe stays on our server, here is how" during a diligence conversation is worth more than the hours.

Keep a human on these three

Deviation calls stay with your production manager and the brand owner, together. Software can tell you batch 4471 finished four points high. Whether that beer ships, gets blended, gets sold as a variant or gets dumped is a commercial and reputational decision involving somebody else's brand, and it is a phone call, not a workflow.

Anything that goes to a regulator stays signed by a person. On-site or not, your Brewer's Report of Operations, your excise return and any formula work are your permit on the line.

And do not let the confidentiality promise be a verbal one. If you are going to tell brand owners their material never leaves the building, put it in writing in the brewing agreement, describe where the machine physically sits and who has access, and be prepared to have that clause read carefully. A promise you cannot describe in two sentences is a promise you should not make.

The first move, and it is not buying a server

Go through your four co-packing agreements this week and highlight the confidentiality and data-handling clauses. Most owners have not read them since signing. You will find out quickly whether your restriction is genuinely "must stay on our premises" or the far more common "must not be disclosed to third parties," which several of the paid business services already satisfy on paper.

If it is the strict version, price the on-site option properly — hardware, a contractor to set it up, and a named person who owns it. If it is the ordinary version, you may not need a server at all; you need the right service tier and a clause in your own agreement that says so. Either way, the answer comes out of the contract, not out of a product brochure.

Frequently asked questions

Does on-site hardware mean we get nothing when the power goes out?

It means the assistant is down when the building is down, which is the same time your glycol, your packaging line and your point-of-sale are down. In practice the bigger risk is a failed drive on a Tuesday. Whoever sets it up should give you a spare and a restore that has been tested once, in daylight, before you depend on it.

Can the same machine serve the taproom and the contract-brewing side?

Yes, but separate what it can see. The taproom side should reach your tap list, allergen matrix and event calendar and nothing else. The contract side should reach one brand's material at a time. That separation is easy to configure and is the single thing a brand owner will ask about during diligence.

We are a distillery, not a brewery. Same answer?

Largely, and the restricted list is often longer. If you distil or bottle for other labels, you may be holding their mash bills, barrel entry records, blending sheets and formula approvals, plus your own bonded-premises records. Distilleries also carry more physical-security expectation around the bonded area, which tends to make the on-site case easier to explain internally.

How much of our paperwork actually falls under a restriction?

Far less than owners assume. Do the highlighting exercise before you spend anything. A typical contract brewer finds the strict set is co-pack recipes and specs, brand-owner formula files, and chain-account pricing. Tap lists, tour scripts, event enquiries, job postings, your own recipes and your own tasting notes are yours to do whatever you want with.

Once you have drawn that line, the inbound side gets simpler too. Tour questions, private-event enquiries, "are you dog friendly," "do you fill growlers," and the after-hours calls from a distributor's night driver are not confidential and do not need to sit on your own hardware. CallSphere builds the voice and chat agents that answer those on the phone and on your website around the clock, book the bookings, and pass the real leads through — leaving your production manager's attention for the four brands whose recipes stay in the building.