MINDWARD — reclaim your own intelligence

THE PROBLEM

The thing you would least like to hand over

Every useful AI assistant today asks you to hand over exactly that. Not “data” in the abstract — the case notes, the client file, the diagnosis you were still thinking through, the strategy that isn’t finished yet. It goes to someone else’s servers, under a policy that can change, at a company that can be acquired.

The usual answers are both bad. Don’t use AI, and lose the leverage. Or use it, and hope.

There is a third option, and nobody sells it: use it, and keep the material.

THE THREE RUNGS

Two questions, three rungs

The whole product fits in two questions: who runs the interface, and who runs the model. Answer them and you have your rung.

Our models Your models

Our interface Hosted Bring your own inference

Your interface — Self-hosted

The three rungs, and who can read your text on each
Rung	Who runs the interface	Who runs the model	Who can read your text
HostedSign up and use it.	We do	We do	We can. We assemble the prompt, so we process your text. What we keep and for how long is a published retention policy — a contract, and we say so.
Bring your own inferenceWe run the interface; you point it at your models.	We do	You do	We still can. Your weights, your inference bill, our interface — we process the text, under the same retention policy. Your model provider sees what you send it.
Self-hostedYour machine, your models.	You do	You do	You. Only you. Nothing touches our infrastructure. This is the rung the founder runs, every day.

Every rung runs the same software. There is no community edition that is a worse version of the real product, and no feature held back to make the hosted tier look better.

THE PRIVACY SIMULATOR

Where your text goes

The same two questions, as switches. Flip them and watch which stages of the chain seal shut — and, just as plainly, which stay open.

Bring your own inference Bring your own harness

Hosted. We run both. Your stored messages are sealed; we process your text to run it. Hosted, your models. The model call is yours. We still assemble the prompt. Your harness, our models. Not a rung we sell today — shown for the mechanics. You assemble everything; our models see only what you choose to send. T3 — full end-to-end privacy. Every stage sealed from us; nothing touches our infrastructure. The sites you fetch still see their own traffic.

Sending prompts open — your prompt is assembled on our harness. We process your text, under the retention policy. sealed — assembled on your machine; only what you choose to send goes any further.
Receiving prompts open — our models run your prompt. We see what you send them. sealed — your models take the call; ours never do. The prompt still passes through our harness on its way to your endpoint, under the retention policy. sealed — your models take the call. Your hardware, your inference bill — we never see it.
Storing messages sealed — stored on our servers encrypted to your key. The machine cannot read the messages it keeps.* sealed — your disk, your database. Structural, not contractual.
Web search open — fetches leave from our harness, egress-guarded. We can see what you look up. sealed from us — fetches leave from your machine. The sites you fetch still see their own traffic.

*On rungs where we run the harness, the seal covers message bodies today; tool-call records are not yet covered — what we do not claim says so in full. How the seal works →

WHAT THE SOFTWARE DOES

Proof, not adjectives

Five structural properties. Not one of them is a promise about how much we care — each is a thing the software does or does not do.

These are properties of the software on every rung. Who can read your text depends on the rung — the table above says exactly which.

01The exit is a feature

One command exports every conversation as Markdown you can read in any editor, plus lossless JSONL you can import somewhere else, plus your documents as themselves — the original files, not an archive format of ours.

A hosted customer can leave for self-hosted and take everything. This is built and tested: 25 conversations, 800 messages, exported and re-cloned into a fresh instance.

What comes out — logos export --markdown

# Whitfield — limitation date

*Logos export · thread 4f2a91 · 2026-08-14T09:12:04Z · 34 messages*

## You — 2026-08-11 14:02

Draft a note to the client explaining why we are not filing
before the limitation date, and what the risk is if we wait.

## Assistant — 2026-08-11 14:02

Here is a draft. Two things I would check before it goes out —
the date the retainer was signed, and whether the earlier
correspondence counts as a standstill agreement.

> Dear Ms Whitfield,
>
> Further to our meeting on Tuesday...

## You — 2026-08-11 14:19

The retainer was signed on the 3rd. Redo the second paragraph.

Plain files, plain dates, plain speaker labels. Download this sample and open it in anything.

02Backups the machine cannot read

A recipient public key sits in the config. The private half never touches the box. The server creates its own snapshots and cannot decrypt any of them.

That property does not stop at the application. It extends to root, and to any automation running there. A backup that leaks is a backup nobody can open — including us, including you, unless you hold the private key.

03The interface tells you where you stand

The app shows which rung you are on and what that means for who can read your text. You do not go and read the documentation to find out what you agreed to. It is on the screen while you type.

04Deliberate about what leaves

Outbound fetching is guarded against reaching internal and cloud metadata addresses. There is a security event log. The assistant can retrieve a page; it cannot send one.

05Isolation by construction

Each customer is a separate instance with its own database and its own files. Not rows in a shared table with a tenant column.

The difference matters on the day someone writes a query with a missing WHERE clause. One query bug cannot cross customers here, because there is nothing to cross.

WHO IT’S FOR

Who this is for

Regulated small practices

Solicitors. GPs and private clinicians. Accountants. Therapists. You have a duty of confidentiality, no IT department, and a well-founded fear of doing the wrong thing with a file that is not yours.

Individuals with high-value IP

Founders, researchers, writers, consultants. The draft, the dataset, the thesis, the pitch. The material is the asset, and it is not finished yet.

Organisations with residency mandates

The ones for whom self-hosting is not a preference but a line in a procurement document. You need it to run where you say it runs.

THE EXIT

On leaving

If you stop paying us, you should still have everything. Run the export, take the Markdown, the JSONL and your original documents, and stand up your own instance against your own models. The software is the same, so there is nothing to port.

We would rather you stay because staying is easier than running it yourself, which is a real reason — not because your last four years of work are stuck in a format only we can read.

A product you cannot leave is not a product. It is a hostage situation with an invoice.

STATED PLAINLY

What we do not claim

Stated here rather than buried, because the people who buy this are the people who check.

We do not say “we cannot read your data” about the hosted tiers.: Whoever runs the interface assembles the prompt, and therefore processes the text. That stays true even when the model is yours. On those rungs the honest sentence is: your weights, your inference bill, our interface — we still process the text, under a published retention policy.
We do not claim full end-to-end encryption.: It is real but partial today: tool-call records are not encrypted yet. We will claim it when it is finished, and not before. How the seal works, in plain terms →
We do not call it open source.: The plan is AGPL. The repository has no licence file yet, so the accurate phrase is source-available to customers. When the licence lands, this paragraph changes.

Everything above is a limit we would rather you heard from us than found out later. Where the software does something, this site says what it does. Where it does not yet, it says that instead.

FROM THE FOUNDER

A note from the founder

I built Logos because I wanted it and could not buy it. I wanted to think out loud with a good model about things I am not willing to put on somebody else’s server, and every option asked me to choose between the leverage and the material. So I wrote the thing I wanted, and I run the self-hosted rung on my own machine, every day — the same build that hosted customers get. That is the whole reason the export works and the backups are keyed to somebody who is not the server: I needed those first, before there was anyone to sell them to.

START

Two ways to begin

Hosted

We run the interface and the models. You sign up and use it. Published retention policy, your own isolated instance, export available from day one.

Request hosted access

Run it yourself

Your machine, your models, your keys. Nothing touches our infrastructure. Source-available to customers; the install is the same software we host.

Get the self-hosted build

Your own AI,keep it.