On your machine, by default
Mail, conversations, memory, documents and the search index are stored locally. The application is fully readable and usable with no connection at all.
Trust
Built to be handed real correspondence
Email is not a low-stakes surface. These are the specific commitments the product makes about where your data lives, what it is allowed to do, and how you stop it.
Where your data lives
The search index never leaves
Semantic retrieval runs on your device. Nothing is uploaded to make search work, because search does not need a server to work.
Bring your own AI provider
Choose the model tier per worker, including a fully on-device private tier. A workspace-level privacy switch defaults new workers to local processing, and any first-time content egress passes an explicit gate.
No telemetry
Apart from calls to the AI provider you chose, data does not leave the device. Credentials live in the operating system keychain — never plaintext on disk, never in logs.
Portable, not captive
Export everything to open formats. Signing out only locks the workspace; your local data stays yours. Stop using the product entirely and your mail is still readable by any other client.
Deployable inside your walls
The same product runs as a desktop application, a self-hosted install, or fully air-gapped — one product resolved by configuration, never a separate edition.
What it is allowed to do
Manual Only
Analysis and advice. It reads, explains and recommends. It drafts nothing and does nothing.
Semi-Auto
It drafts and stages. You approve every send. This is the ceiling — autonomous execution is not part of this release.
Three safeguards you cannot switch off
- Sending requires a frozen preview of exactly what will go out, plus a second, consequence-named confirmation.
- Anything touching money, attachments or a VIP contact is forced down to a draft for human review, whatever the settings say.
- One click drops a single superworker — or all of them — to advice-only, effective immediately.
How you stop it
- One click drops a single superworker — or every one of them — to advice-only, effective immediately.
- Deleting a worker archives its data for thirty days before anything is destroyed, so a decision made in frustration is recoverable.
- Every authorisation is set per capability and can be lowered at any moment, with no cooling-off period and no penalty.
What you can check afterwards
Every file operation and every autonomous action lands in an append-only log with a single global viewer. Each approval keeps a record of what was shown to you and what you decided. The trail is not summarised or rotated away.