Secure AISecure AI
Vision
Where this goes next.
The AI company never learns whose account a question came from. The harder half is the question itself: write my landlord Sarah Chen is withholding my deposit at 14 Bridge Street and the envelope is anonymous while the letter names three things about you.
So the details inside a message are swapped out too — names, emails, phone numbers, cards, addresses — and swapped back in the answer. That part is live. You write what you would write to someone you trust; the model on the other side sees the same question with the identity taken out. This page is what that covers today, and what it does not.
Substitute, don't delete
The obvious approach is to cut identifying details out. It breaks the product. Ask for help replying to your landlord with the name removed and you get an answer addressed to [name] throughout, which you then have to repair by hand — so you stop using the feature, and you have traded a real capability for a privacy gain you cannot see.
The approach that works is to swap each identifying detail for a stable placeholder, keep the mapping, and put the real values back in the answer:
The model gets a question it can answer. You get your own words back. The list joining Sarah Chen to PERSON_1 is never stored on a server — it comes back with the answer and your app sends it up again on the next message, so nothing here holds a table of people and the questions they asked.
What it covers
Some of this is easy and some of it may never be solved. Which is which:
In what you type
In what you upload
Where the swap happens
On our servers, today. Your message reaches us, we take the identifying details out, and we send on what is left — so the original does pass through us on the way. On Ultra it does not: the message is sealed on your device and opened only inside a computer we cannot see into.
Doing the swap on your device on every plan is where this is going. It means three more apps to build it in and it is limited by the oldest phone we support, which is why it is not first. When it arrives, this page and Security change the same day.
Agents, not just chats
The same swap now sits in front of AI agents. An agent does not paste one name into a chat box: it reads a CRM, opens a contract and sends an email in a single run. So the check moves from the message to the action. Each thing an agent tries to do passes through Secure AI first, which hides the private details, holds anything risky for a person to approve, blocks what should never leave, and records it all without keeping the values it protected. It is live today through the API, the SDKs and an MCP server.
The last 10% is context
Patterns and models catch most private details. The rest need context: knowing that “Marcus” is your client, that an eight-digit number is an account and not an order, or that an address belongs to a patient. No filter can know that on its own. Owning every surface, from the apps to the agent gateway, is how we get it, and the plan is to keep that context with you and apply it at the checkpoint rather than to collect it. It is also how we get there without ever training on what you write.
Built, and still to build
Seven of the nine are running. What is left is the two hardest: the things that identify you without naming you, and finding faces and text in a picture for you rather than you drawing the boxes.
Where it stops
This kind of detection is never complete, so: not every identifying detail is caught. Context is not caught at all — the things that point at you without naming you, like the size of the office that laid people off last Tuesday. Nothing is marked as shipped above on a platform where it is not running. And if the swap cannot run on a message, that message does not go: it fails rather than quietly travelling unprotected.
Questions, or want to be told when a stage moves? Email support@secureai.one.