Your sovereign personal AI.
A personal AI that lives on your hardware and answers only to you. Not to OpenAI, not to Google, not to anyone selling your attention.
Six pillars working as one platform. Ten best-in-class open-source tools woven together. One cryptographic identity you hold. Ingestion from every cloud vendor you have ever used, distilled into one queryable store, kept private by architecture rather than promises.
The premise
Your AI shouldn’t live in someone else’s data center.
Most personal-AI tools today ship your data to someone else’s servers by default. Your inbox, your photos, your calendar, your conversations, your medical history. You don’t own the infrastructure it runs on. You didn’t write the terms it operates under. The models you’re talking to were trained on data scraped under terms you couldn’t consent to either.
Ancilla runs on your own hardware and uses local models by default for everything. Your data stays in your storage, your prompts go to models loaded in your own GPU, your AI answers without anything ever leaving the box. Cloud is available as an opt-in escape valve for the handful of cases where you decide a frontier model is worth it (and you pick which one, per request). When that happens, a local model scrubs private spans before anything leaves. You see what went out, where, and why. The default is local. Cloud is the exception, not the path of least resistance.
This isn’t a chat wrapper. It’s a complete platform: six integrated pillars, an ecosystem of best-in-class open-source tools, a cryptographic identity you hold, and a mesh that keeps working when the internet doesn’t. Built to outlive any single piece of software, including its own.
A day with Ancilla
One prompt, fifteen years of context, your hardware.
You’re heading into a meeting with Sarah Walker in twenty minutes. Calendar reminder pops. You open Mission Control and type:
you brief me on sarah, last 18 months
ancilla Sarah Walker · resolved via Ancilla Identity to your work-domain Sarah (not your college friend or your daughter’s teacher).
Last contact: 9 days ago, Slack DM, she asked you to follow up on the staging contract by today. [unfollowed-up open loop, surfaced]
Relationship arc: warming. 4 collaborations this quarter (up from 1 last year). She co-authored your strategy memo in March. Lens notes she replies fastest to your morning emails.
Open commitments to her: staging contract (due today), Q3 forecast revision (you promised by 31st), intro to your tax person (you committed in Feb, not yet done).
Open commitments from her: her cost-projection spreadsheet (she promised April 8, still pending).
Financial: her invoice 2026-07 for $4,250 paid Feb 19. Two more invoices outstanding totalling $11,800.
Her org: reports to Marcus (who you met at the November conference). Team grew from 4 to 9 this year.
Public news (last 30d): her company raised a Series B; she was quoted in TechCrunch about the new product launch.
Likely meeting topics: the staging contract you owe her, the Q3 forecast follow-up, and a probable check-in about the Series B (she usually mentions company news in person).
Want me to draft the staging contract reply, or pull the original spec doc to refresh you?
Twenty minutes ago you didn’t know any of this. Three seconds of reading and you walk in prepared. The data was always yours; Ancilla just held it together.
What your own data can answer
Questions other AI tools can’t even parse, let alone answer.
Most personal-AI tools index a conversation history. Ancilla turns decades of your life into a relational graph with cross-modal search. Some questions only become possible when the data is yours, the relationships are typed, and the sources are cited.
“Who in my work network also went to my college? Show me the bridge people.”
Graph traversal across two parallel network graphs (work + college) with betweenness centrality on the intersection. Returns the names + how Ancilla knows each connection. About a hundred milliseconds, fully local.
“Everyone I’ve paid more than the rent threshold this year, and what for. Group by relationship type.”
Property-graph query over paid_to edges joined against your relationship layer. Receipts and invoices cited per amount. Currency-normalized to your home currency with the actual exchange rate on each payment date.
“Find photos that look like the sunset I described in last week’s journal.”
Your journal text is embedded into an image-aligned space. Ancilla returns the matching photos from your archive with confidence scores and the source the description came from.
“Moments of laughter in last week’s audio. Who was I with?”
Audio archive searched with a text-aligned sound model; speaker diarization resolves who was present per segment via Ancilla Identity. Returns the timestamps plus context from your calendar for each.
“Why did I decide to switch to the new vendor in March? Trace the reasoning.”
Ancilla Lens walks the decided_at edges back to the meeting where it happened, then to the emails, voice memos, and notes from the prior two weeks that shaped the call. With sources, in chronological order.
“What conditions correlate with my most creative work weeks? When am I in flow?”
Lens cross-references your output (commits, drafts, decisions made) against sleep stages, calendar density, location, ambient noise, and time-of-day patterns. Returns the conditions that show up most often in your high-output weeks. None of it is guesswork; every correlation cites the underlying weeks and events.
“The last six times my sleep dropped below seven hours for three nights running, what was happening that week?”
Anomaly detection on health metrics joined against calendar, location, work pattern, and message volume for the same windows. The pattern surfaces (heavy travel weeks? deadline crunches? specific people? a recurring date?) with the source events for each window.
“What did I commit to in the last quarter that I haven’t followed through on?”
Open committed_to edges with due dates past or stalled, joined against your channel-broker sent history to see what you have and haven’t acted on. Sorted by how much it matters to you (closeness to the other person, weight of the commitment).
“How many days was I tax-resident in each country last assessment year?”
Days-present derived from your location archive joined against the per-jurisdiction tax-residency threshold (US 183-day rule, etc.). Returns the count per country, the residency status determined, and the source events that contributed each day.
Every answer cites the underlying events. Every wrong answer becomes a correction signal that improves the next one.
How Ancilla thinks
Six chapters of a personal-AI day.
Most personal-AI tools do one of these well and ignore the rest. Ancilla does all six, in one platform, on your hardware.
-
Live · capture without effort
Your voice on every call, your screen when you ask, your messages across twelve channels, your photos and locations and financial events. Ancilla Bastion ingests it all into one sovereign store with retention you control per source.
-
Remember · decades, queryable
Email back to 2008, every photo, every meeting transcript, every WhatsApp message, every health metric. One query layer over content-addressed blobs and a unified semantic index. Ancilla Identity resolves “Sarah” to the right person every time. Ancilla Recollect builds rolling summaries from 30 minutes up to a year.
-
Reason · the right model, every time
Ancilla Nexus routes each request across about fifteen local model backends, your LAN companion devices, your rented GPUs, and (opt-in per provider) vendor APIs. Cascade routing escalates only when needed. A local model scrubs private spans before anything cloud-bound leaves the box.
-
Synthesize · patterns across decades
Ancilla Lens reads everything Bastion has stored and surfaces what no single source could show: behavioral trends, relational arcs, topical trajectories, decision archaeology, anomaly alerts, cross-modal connections between your photos and your conversations. Every insight cites its sources. Your AI gets to know you better the longer you use it.
-
Act · on your behalf, with your sign-off
Send a message, book a calendar event, file an invoice, run an automation, all through the channel-broker, the granular consent layer, and the “Human + LLM 2-of-2” gate for anything sensitive. Every action is audited, every approval is granular, and your AI never sends anything you didn’t see.
-
Defend · security, resilience, continuity
Ancilla Aegis sandboxes every plugin, scans every dependency, watches the network. Ancilla Beacon keeps you running when the internet doesn’t. Cryptographic inheritance hands the keys to your designated heirs. Your AI outlives outages, devices, and you.
The six pillars
One platform. Six integrated peers.
Each pillar stands alone as its own open-source project. Each runs in concert with the others. Ancilla is the brand; the pillars are the workhorses.
Your single pane of glass. One cross-platform program (and per-desktop widgets) showing everything Ancilla knows, letting you configure anything it does, and approving or revoking every access in three seconds.
Your sovereign personal-data store. A single Rust daemon holding your life-log, messages, photos, financial records, calendar, contacts, health metrics, smart-home events, even decisions and commitments your AI extracts. Open formats, encrypted at rest, designed to outlive its own code. If Ancilla disappears tomorrow, your data is still yours.
Your smart LLM router. One OpenAI-compatible API in front of fifteen local backends, your LAN devices, your rented GPUs, and opt-in vendor APIs. Per-request routing policy. Cascade with confidence-based escalation. Ground-truth benchmarks on your actual hardware. Cloud is opt-in per request, never silent.
Your security shield. Wraps the open-source security ecosystem (vulnerability scanning, anti-malware, supply-chain checks, AI-specific threats, sandboxing) under one operator UX. Holds new dependencies in a five-day quarantine. Audits everything that has ever touched your system.
Your connection of last resort. A cryptographic mesh built on Reticulum that runs over LAN, Bluetooth, LoRa radio, USB sneakernet, even audio modem. Same architecture for a power outage and a six-month expedition. Your AI doesn’t stop working when the internet does.
Your cross-source analyst. Reads Ancilla Bastion in batches and surfaces patterns across decades of your data: behavioral trends, relational dynamics, topical trajectories, decision archaeology, anomaly alerts, executive digests. Every insight cites its sources back to specific events. Your sovereign AI knows you, and gets to know you better over time.
Identity & relationships
Every person in your life lives in multiple worlds at once.
So does the graph Ancilla Identity builds for you. Most contact apps store names, numbers, emails. Ancilla Identity stores the full shape of who someone is to you, across every context they appear in.
Multi-network parallel graphs
Family, work, friends, school, college, freelance, hobbies. Each network has its own graph; people exist in multiple at once.
Granular role + closeness
Spouse, colleague, mentor, vendor, ex, child. Tagged with closeness, dynamic, and side-of-relationship. Frequency tracked over time.
Genealogy + ancestry
Family tree with GEDCOM import. DNA exports from 23andMe, AncestryDNA, MyHeritage. Ancestral lines that go back as far as the records do.
Workspace genealogy
Who works with whom, who reports to whom, who came from which prior company. Org charts you actually need, built from your real interactions.
Cross-domain overlap detection
Your college friend who now works at a vendor you use. Your hobby acquaintance who is also your kid’s teacher. Ancilla notices the overlaps without confusing the contexts.
Third-party relationship mining
“Marcus knows David through Catherine.” The transitive relationships in your network, surfaced when relevant, hidden when not.
Property-graph with evidence
Every relationship, payment, attendance, decision, and commitment is a typed edge in a Cypher-queryable graph. About eighty builtin predicates, time-bounded validity, every edge cites its source events. Lens traverses these for insights like warming or cooling relationship arcs, who bridges otherwise-separated communities, or which decisions trace back to which conversations.
Three different Sarah Walkers in your contacts.
One is your colleague at work (joined 2024, reports to Marcus, lives in Austin).
One is your college friend (last seen 2019, lives in Berlin, you owe her a call).
One is your kid’s teacher (Mrs. Walker formally, replies fastest to email).
Ancilla knows all three are different people. When you mention “Sarah,” it picks the right one from context. When you start a new message, it asks if you mean Marcus’s Sarah or Berlin Sarah or Mrs. Walker.
Every contact app collapses them into one row. Ancilla keeps them separate, and keeps track of when they intersect.
Ingestion & versatility
Every byte of your digital life. One platform.
Ancilla Bastion is built ground-up to absorb data from everywhere you’ve ever existed online. A one-time mass migration brings your historical archive home. Ongoing ingestion keeps it current. The flexible schema absorbs new services as they appear, without migrations.
Google Takeout
Gmail, Calendar, Maps, Keep, Contacts, Photos, Drive, YouTube history. Parsed and indexed per source.
Apple iCloud Export
Mail, Photos, Notes, Contacts, Calendars. Apple’s walled garden, unlocked into your store.
Microsoft & Outlook
OneDrive, Outlook PST, OneNote, Teams history. Years of work archives ingested in one pass.
Meta · X · LinkedIn
Facebook, Instagram, WhatsApp, Threads, X archive, LinkedIn full data. Every post, like, message, connection.
Spotify · Netflix · YouTube
Listening, watch, search history. Your taste graph reconstructed from a decade of consumption.
Discord · Reddit · Slack
Server history, DM archives, subreddit activity, workspace messages. Everywhere you’ve been a member.
Messaging · 12 channels
WhatsApp, Email, Slack, Telegram, Discord, Signal, iMessage, Matrix, IRC, XMPP, SMS, RCS. Live capture, search, reply.
Voice · Screen · Browser
Mic audio, screen captures with OCR, browser history with dwell time. Continuous capture, opt-in per stream, retention you control per source.
Health · Location
Every wearable, every lab PDF, every prescription, every step, every place you’ve been. Deduplicated across devices.
Treasury · Receipts
Bank statements and credit-card exports from any country. Transfer refs across ACH (US), SEPA (EU), Wire, UPI (India), Faster Payments (UK), Interac (CA), PIX (BR), PromptPay (TH). Wise, Revolut, Stripe, PayPal. Invoices, subscriptions, bills, tax artifacts. Reconciled across sources.
Phone · Vehicle · SDR
Android ADB exports (SMS, call log, app usage). OBD-II vehicle telemetry. SDR captures: weather satellite imagery, aircraft ADS-B, marine AIS, amateur radio, broadcast metadata.
Legacy · Time Machine
Old hard drives, scanned documents, photo libraries, legacy mailbox dumps. Anything you’ve ever saved.
The schema is flexible by design. When a new service launches in 2027, Ancilla absorbs it as a new source type, no schema migration, no data rewrite. Every row you ingest today is still yours tomorrow.
The Master Review Queue is the mechanism. When ingestion sees a new field shape that recurs often enough to deserve a typed column, when a new entity proposal needs your confirmation, when the schema-evolution engine wants to promote a frequently-used JSON key into structure, it surfaces a one-tap approval in Mission Control. You see what the database is learning. You decide what to keep. The DB grows with your life, on your terms, with the audit trail to prove it.
The federation
Ten best-in-class tools, orchestrated as one.
You don’t have to switch tools to use Ancilla. Keep whatever you already prefer: Notion, ClickUp, Asana, Google Calendar, Apple Notes, Things, Todoist, anything. Ancilla one-time-imports your historical data and then bidirectionally syncs ongoing changes. Your daily workflow stays where you like it; Ancilla maintains its own canonical copy underneath so your AI has the full picture.
The ten tools below are the option for going fully local-first: best-in-class open-source replacements that Ancilla deploys, supervises, and unifies under one UI. Use any combination. Use none if you prefer.
Stalwart
replaces gmailEmail server, all-in-one Rust binary. SMTP, IMAP, JMAP under your domain.
Radicale
replaces google calendar · contactsCalDAV calendar and CardDAV contacts. Standards-based; talks to every device.
Memos
replaces google keepLightweight notes. One source of notes that Ancilla cross-links to everything else.
Vikunja
replaces google tasks · trelloTasks, kanban, and CalDAV alarms backing your reminders engine.
Dawarich
replaces google maps timelineYour location history on a map you own. Routes, places, time spent.
Immich
replaces google photos · icloud photosPhotos and videos library with face recognition. On your storage, never re-uploaded.
Seafile
replaces google drive · dropboxBlock-level file sync. The Drive replacement that doesn’t need a third party.
n8n
replaces zapier · iftttCross-component automation hub. Connect anything to anything, on your terms.
AdGuard Home
replaces nextdns · pi-holeNetwork-wide DNS filtering. Block ads and trackers for every device in your house.
Headscale
replaces tailscale control planeSelf-hosted mesh-VPN control. Reach your Ancilla from anywhere, with no third party.
Each tool keeps its own name. Ancilla doesn’t rebrand other people’s work. Ancilla Mission Control surfaces them under one UI; Ancilla Bastion holds the canonical state and keeps them in sync with whatever you actually use day-to-day.
Anywhere on Earth. Off-planet too.
Built for every place you’ll ever be.
Resilience, globalization, and continuity aren’t bolt-ons. They’re foundational. Ancilla runs in every time zone, every currency, every jurisdiction, and across every link from your home Wi-Fi to a multi-minute satellite delay.
Multi-region · multi-currency · multi-language · multi-jurisdiction
BCP-47 language tags plus ISO-15924 script awareness on every text field, so a contact’s name in Latin and the same name in another script are the same person to Ancilla. Multi-currency portfolios with historical exchange-rate provenance. Six calendar systems running side by side (Gregorian, Hindu lunar, Hijri, Buddhist, Lunar Chinese, Hebrew) for cross-tradition date math. Per-jurisdiction PII tier catalogue covering eleven countries from day one, so the egress scrubber knows what counts as sensitive in each. Land anywhere: your AI doesn’t blink.
Calendar math that just works
Cross-timezone meeting scheduling, jet-lag-aware reminders, location-tagged events so your past stays anchored to where it happened. DST transitions, half-hour offsets, leap seconds handled.
Works through every outage
ISP down for a week? Power out for the storm? Capture keeps going, queries keep working on local data. Reconcile when the link returns. Most personal-AI tools become bricks the moment the network drops; Ancilla doesn’t.
Six transports, one platform
Ancilla Beacon runs over LAN, Bluetooth, LoRa radio, USB sneakernet, audio modem, and (when available) the open internet. Same architecture for an apartment and an expedition. Two Ancillae always find each other.
Hiking · sailing · research stations
Three weeks in Patagonia, six months on a research vessel, a year at McMurdo. Your AI keeps recording and reasoning on local hardware. When you return to coverage, your federation peers and chosen cloud tools catch up cleanly.
Designed for satellite delay
Lunar base. Mars colony. Three-minute lightspeed delay one way? Twenty-four? Ancilla’s store-and-forward architecture and delay-tolerant federation handle it. Your sovereign AI doesn’t care where in the solar system you are. The only personal AI built from day one for the next planet, not just the next continent.
Apps built on Ancilla
The platform’s APIs are open. Build your own.
Two federation-peer applications run on top of the Ancilla platform today, alongside the six core pillars. The same APIs are open for anyone to build the next ones.
AncillaHealth Hub
Your local Google Fit and Apple Health. Aggregates every wearable into one deduplicated metric store. Lab PDFs get OCR’d. Prescriptions and appointments cross-link to email and calendar.
peer · plannedAncillaHome Assistant
Gradually retire Alexa and Google Home. Smart-home routines on your network, sensor data in Ancilla Bastion, voice commands routed through the same consent layer as everything else.
peer · plannedYour app here
Open APIs over MCP. Build the analyst, agent, or interface you’ve been waiting for. Use Ancilla’s memory, identity, routing, consent, and audit. Ship it.
platform · openWhat makes Ancilla different
Ten things only Ancilla does.
-
One integrated platform, not five tools glued together.
Six pillars designed as peers under a single control plane: shared auth, shared config, shared trust model. You install one thing.
-
Substrate, not another AI tool.
Most personal-AI tools are the agent. Ancilla is what the agent stands on. The tool you talk to (Claude Code, Cursor, OpenCode, whatever you prefer) keeps working and now inherits your memory, identity, routing, and audit trail.
-
Ingests from every cloud vendor you have ever used.
One-time mass migration plus ongoing bidirectional sync. Google Takeout, Apple iCloud, Microsoft, Meta, X, LinkedIn, Spotify, Netflix, Discord, Reddit, legacy hard drives, Time Machine, scanned documents. The schema absorbs new services without migrations.
-
Smart routing per request, not per app.
Ancilla Nexus lets you decide local-first, cloud-first, or strict-local for any single LLM call, with a five-tier vendor trust classification and a local PII scrubber on every cloud-bound request.
-
Identity that holds the full shape of who people are to you.
Multi-network parallel graphs (family, work, friend, school, freelance) with cross-domain overlap detection, family tree and genealogy, workspace org-graph, and granular role + closeness + dynamic dimensions on every contact.
-
Your identity is a key you hold, not an account on someone’s server.
Every Ancilla install gets its own cryptographic identity. Two Ancillae verify each other directly: no central account, no email-and-password, nobody in the middle who could spoof you or lock you out.
-
Works when the internet doesn’t.
Ancilla Beacon runs over LAN, Bluetooth, LoRa radio, USB sneakernet, even audio modem. Same architecture for a hiking weekend and a six-month expedition with no contact.
-
Inheritance is a designed feature.
A dead-man switch in Ancilla Bastion gated by your Master-signed daily proof-of-life. Designated heirs hold FROST K-of-N threshold shares; succession aggregates partial signatures without ever reconstructing your plaintext key. The threshold is enforced cryptographically. Your sovereign AI passes cleanly when you don’t.
-
A property-graph over your life.
Every relationship, payment, attendance, commitment, and decision is a typed edge with about eighty builtin predicates, time-bounded validity, and source citations. Cypher-queryable. Ask “everyone I paid more than a threshold in the last quarter who is also in my work network” and Ancilla answers from your own data, with the edges that backed every answer.
-
Cross-modal search across image, audio, and text.
Photos, sounds, and text live in shared embedding spaces. Ask in words and Ancilla returns images that match. Ask in pictures and it returns the text that resembles them. Find “moments of laughter” in your audio archive, or “photos that look like the sunset I described in last week’s journal.” Your archive becomes searchable in the way you actually remember things.
What Ancilla does, and what it refuses
Promises made by architecture, not marketing.
✓ What Ancilla does
- Runs entirely on your hardware by default.
- Encrypts everything at rest with a key in your OS keyring.
- Logs every routing decision, every consent grant, every action taken.
- Shows you what data left your machine, when, and to where.
- Verifies model files and dependencies cryptographically before loading.
- Survives ISP outages, blackouts, and arbitrarily-long disconnection.
- Hands your data to your heirs on your terms, with your keys.
✗ What Ancilla refuses
- No accounts. No login server. No identity provider in the middle.
- No telemetry. No phone-home. No analytics on Ancilla’s own usage.
- No hosted SaaS version, ever. Sovereignty isn’t a tier.
- No silent cloud calls. Cloud is opt-in per request, per provider.
- No training-on-your-data deals with anyone, ever.
- No vendor lock-in. Open formats. Apache-2.0.
Common questions
What people ask before they install something this big.
Is Ancilla free? Will there be paid tiers?
Yes. Free. Apache-2.0. No paid tiers, no premium features, no subscription, no usage limits. Ancilla runs on hardware you already own; we never have your data to charge for. This exists to be useful, not extractive.
When does Ancilla v0.0.1 ship?
When the code works reliably end-to-end in daily use. The maintainer is the first user; release happens when one human can rely on it without regressions. Follow Reddit or X for actual news.
Do I have to switch to the federation tools, or can I keep using my current ones?
Keep what you already use. Notion, ClickUp, Asana, Google Calendar, Apple Notes, whatever fits your day. Ancilla one-time-imports your historical data and bidirectionally syncs ongoing changes; your workflow stays where you like it, your AI has the full picture underneath. The federation tools are an option if you ever want to go fully local-first, not a requirement.
How is Ancilla different from the AI tools I already use?
Most personal-AI tools are the agent (the thing you talk to). Ancilla is what the agent stands on: your memory, your identity, your routing, your consent gates, your audit trail. Whatever tool you already use (Claude Code, Cursor, OpenCode, your favourite IDE) keeps working and now inherits all of that automatically. You don’t migrate. You add a layer underneath.
Do I need to be a developer to use Ancilla?
Eventually no. The end goal is that Ancilla works for non-developers: install, configure via Ancilla Mission Control, daily-driver use without touching a terminal. The first release will be developer-shaped (it has to be), but the design is for everyone.
Why no cloud version? Why no hosted Ancilla?
Because sovereignty is the point. The whole reason Ancilla exists is so your data, your routing, and your AI memory stay on hardware you own. A hosted version would defeat that. If you want cloud LLMs, Ancilla Nexus can route to them on your terms, per request, per provider, with full audit and a local PII scrub before anything leaves your machine.
Can I use just one piece of Ancilla, or do I need everything?
One piece at a time. Each pillar stands alone. Run Ancilla Bastion as just a personal-data store. Run Ancilla Nexus as just an LLM gateway. Run Ancilla Aegis as just a security layer. They get much more useful together, but they’re not bundled into a monolith.
Can my partner and I share an Ancilla without giving up our private spaces?
You each run your own Ancilla. They pair as cryptographic peers, the same way any two trusted Ancillae pair: a 6-digit one-time code exchange, then a mutual cryptographic handshake. A shared household domain syncs the things you both care about (joint finances, shared calendar, household appliances, household events) between the two Bastions; everything else stays private to each one. Your Ancilla is yours alone. Your partner’s Ancilla is theirs alone. They cooperate as peers, not as tenants of the same instance. No central server, no multi-tenant code paths, no single Bastion holding both of your private lives. Consent grants for shared-household data that get sent to the outside world require both Masters to approve from their own Ancilla, enforced cryptographically.
What hardware do I need?
One workstation or home server with a GPU works well. The reference machine is a Ryzen 9 with 64 GB RAM and an RTX 3090 (24 GB VRAM). Less than that (a Mac mini, a Pi cluster, a NAS) runs the lower-VRAM pillars and offloads heavy compute to your other devices via the mesh. Pure CPU works for many tasks; a GPU unlocks the deeper ones.
What happens to my Ancilla when I’m gone?
Inheritance is designed in. Ancilla Bastion has a dead-man switch gated by a Master-signed daily proof-of-life (so a network outage can’t fake your death). Designated heirs hold FROST K-of-N threshold key shares; when K of them sign a succession event, your peers’ Ancillae recognize the new owner cryptographically. Your plaintext key is never reconstructed by anyone, even during succession. The threshold is enforced by the cryptography itself, not by trust in a single heir. Your sovereign AI passes cleanly when you don’t.
Stay in the loop
Hear from us when Ancilla ships.
Drop your email and we’ll let you know when there’s working code to try.
Or just email hello at ancilla.live directly.