Self-hosted
An avatar of a person,
inside your own walls.
Some organisations cannot let their working data leave the building, and some roles are too sensitive to hand to a hosted service. This is the same idea as the marketplace, run entirely on your own infrastructure: an avatar with its own mailbox that answers colleagues, clients and suppliers from what it is allowed to use.
The hard part is not the answering
An assistant that has read an entire mailbox is a disclosure waiting for a polite question. "What does Sam earn?" and "what did the other client say?" are not prompt-writing problems. They are access-control problems, and this treats them as such: four gates, of which the one that matters runs before the model is involved at all.
- 01
Identify the asker
Who is asking is established from your mail boundary's authentication result, not from the From header. A sender that does not verify is treated as unknown, whatever the address claims.
- 02
Decide before the model sees anything
The material an asker is not entitled to is filtered out before the model is prompted. There is nothing for a clever question to extract, because the answer was never in the room. This is the guarantee that survives a jailbreak.
- 03
Check the draft
Every substantive sentence must rest on a record the avatar was allowed to use. Redaction runs, sensitive patterns are caught, and anything that fails goes to a person instead of out the door.
- 04
Record it
An append-only log of the question, the asker, what was admitted and refused, and the rule that decided — in language a compliance officer can read.
Your rules, in a file you can read
Who may see payroll. Whether one client's material may be discussed with another. What internal staff may have. Written plainly, validated when you save, and testable in a simulator before a single email goes out.
It starts cautious and earns trust
Every avatar begins with a person approving each reply. Autonomy is granted one topic at a time — scheduling long before invoicing, and some categories never — with the approval history as the evidence for the decision.
It stays inside your estate
One host or your own cluster, with the databases under your control. The only call that leaves is to the model, and for an air-gapped site that can be a model you run yourself.
Skills travel; data does not
An avatar accumulates capability with a track record. When an engagement ends, the skills go with it and the employer's material does not, by construction rather than by promise.
What it connects to
Calendar is handled with care: the avatar can tell a client when you are free without telling them what you are doing. Sign-in uses your own identity provider, with provisioning and four roles.
Where it is up to
In pilot, and we will tell you exactly what that means
Built and tested
- The four gates, end to end
- Classification, retrieval and the answering loop
- Mail, files, chat and calendar connectors
- Single sign-on, provisioning, roles and audit export
- Backup, restore and an operator runbook
Not yet done
- It has not run against a live tenant — the first pilot is that run
- No independent penetration test yet
- Classifier accuracy on a real mailbox is unmeasured
- Single host by default; clustering exists but is untried
Which is why the first engagement is a pilot: one organisation, one tenant, every avatar starting with a person approving each reply, and a week of reading those approvals before anything is granted autonomy.