Your agent. Your data. Your call on every boundary.
Twelve statements. Four guarantees, four honest facts about storage, four hard things it will never do. No marketing copy - the plain version, early and upfront.
Trellvix
Twelve statements. Four guarantees, four honest facts about storage, four hard things it will never do. No marketing copy - the plain version, early and upfront.
What holds
At a glance
Three things that shape everything else.
Judgment boundary
Everything reversible runs on its own. Anything that cannot be undone - an outbound call, a signed contract, money leaving the account - stops and waits for your go.
Trace is immutable
Every outbound call, every lookup, every file touched, every boundary stop and why. A ledger you can hand to your auditor, your lawyer, or yourself a year from now.
Never sells your signal
Your memory, your drafts, your meetings and the patterns inside them are not a training set. Nobody else gets to ride the work you paid to have handled.
What we guarantee
Four promises that are not features, and are not upgrades.
They hold on the free plan because they are the product.
Owned by a passkey, not a password
You claim your agent with Touch ID or Windows Hello. There is no password to phish, reuse, or leak - the key never leaves your device, and only you can open the door.
One agent, one person
Your agent is a single isolated thing with its own memory - not a row in a shared table with your name on it. Nobody else’s agent can ever see inside yours.
Leave with everything, or leave nothing behind
Export the whole of what it knows about you, any time, in one move. And when you want out, closing your agent really does delete it - the memory, the ledger, the attachments, the passkey - and retires the name so nobody else is ever given it. Both are day one, not roadmap items.
Told plainly where things go
When Trellvix goes out to the world to look something up, it records the trip. You are never left guessing what left, or why.
Where your data lives
Four honest facts about storage, including the one that is not reassuring.
A padlock should not imply more than it does.
One database per person, not one table for everybody
Most products keep everyone in one place and separate you with a filter on a query. Get that filter wrong once and somebody reads somebody else. Your agent is its own database with its own storage - there is no shared table, so there is no query to get wrong.
Encrypted where it sits
What it knows is encrypted on disk under a key derived for your agent alone. A stolen disk, a leaked backup, a snapshot: bytes. And the honest limit, since a padlock should not imply more than it does - that protects the storage, not us.
Some things even we cannot open
Anything you seal is encrypted in your browser with your passkey before it reaches us. We hold the bytes and the label you wrote. We cannot read the rest - not for you, not for anyone, not if we were asked to.
What we could be made to hand over
Everything else it knows, readable - because it has to read your memory to think. We would rather say that plainly than let encryption imply otherwise. Anything you sealed is the exception, and it is the only claim here that survives a subpoena.
What it will not do
Four hard limits.
Each is enforced by code rather than asked for in a prompt, which is the difference between a boundary and a preference.
It cannot spend, send, or delete on its own
Anything irreversible stops and waits for you - and not by policy. The code that carries out an action accepts only one that you approved, so there is no path where a scheduled job or a clever sentence talks it into acting alone.
Nobody can pay it to change its answer
There is no advertiser in this product and no paid placement in anything it suggests. When it recommends, it is reading what it found, not what somebody bid. You are the only party it has.
It cannot give you a number it cannot source
A figure it cannot trace back to something you told it or something it actually read does not get spoken. Ask what it found when it found nothing, and it says so. Being confidently wrong is the failure that ends the relationship, so it is treated as the one that matters.
It cannot install a skill from a stranger
There is no marketplace and nothing trying to publish into. When a rival opened one, roughly a fifth of what appeared there in its first month was malicious. What your agent can do ships with your agent.
The difference
This is not another generic AI wrapper with nicer design.
The point is not to give you one more model interface. The point is to give a busy founder or CEO a product shaped around real staff work: holding context, preparing decisions, drafting important communication, and making sure open loops do not die the moment you switch tabs. And because it has one client, nobody can pay it to quietly bias the work it does for you.
Built around the judgment boundary, not around model input-output
The code that carries out an action accepts only one you approved. That is a type, not a policy: there is no sentence, scheduled job or clever letter that reaches money, mail or deletion without your passkey on the exact words you were shown.
Warm operational memory that survives past the chat window
Every kept thing carries who put it there and when, and says so when it answers. What you told it outranks what it read; what it read can never overwrite what you said. Repetition becomes something it knows; a near miss is offered as the nearest thing, never stated as the answer.
One principal, one agent, one client - never shared, never ranked
Your agent is its own database, and the only key to it is yours. No team session, no shared gateway, no support person reading over its shoulder. If we ever take money from a vendor, it cannot reach what the agent recommends: paying buys a capability, never an opinion.
A public, inspectable ledger of every outbound call and the data involved
Before anything leaves, you see the fields that would travel and can strike any of them. After, a sealed record says what went, to whom, for what, and what was held back. You can hand it to your auditor; nobody can quietly rewrite it.
The trust model
What is a boundary, and what is only a convenience.
A boundary holds against somebody trying. A convenience helps when nobody is. Products blur the two; this page will not.
Your passkey
The only way in, and the only thing that can approve a consequence. Not a click, not a voice, not a session cookie. Lose every device and there is no reset by email, because a reset by email would be a second door.
One object per person
Nobody else’s query can reach your memory because there is no shared table for a query to run over. Isolation is the architecture, not a filter somebody remembered to add.
What you sealed
Encrypted in your browser with your passkey before it reaches us. We hold bytes and the label you wrote. This is the one claim on this page that survives a subpoena.
Encryption at rest
Real, and it protects the disk, not you from us. The agent has to read its memory to think, so the key is ours. Said plainly rather than implied by a padlock.
The session list
Shows every browser holding a live session and lets you end one. Ending a session is reversible - you sign in again - so it needs no ceremony, and it is not what keeps a stranger out. The passkey is.
The hourly rounds
They look at what you have told the agent and what it is holding for you. Until an inbox or a calendar is connected, nothing else flows in, and the rounds say so rather than pretend to watch an inbox they cannot see.
The rest of the workbench.
Decisions arrive with the work done, not the questions still open.
Context that stays warm after the meeting, the email, and the tab close.
Every outbound action. Every piece of your data involved. On the record.
Research with a spine: sources cited, nothing invented, nothing personal leaks out.
It keeps the thread after the meeting. After the inbox zero. After the tab close.
Meet the chief of staff your company never had.