Security
Your own AI,
behind your own firewall.
Alexis runs on a computer you own, inside your network. Her reading, drafting and rules run there, and the few outside services she uses are named, fixed and easy to wall in. Here is exactly what that means, including where the risks are.
Local first, with a short list
What stays home.
What goes out.
Stays on your computer
- The language model that reads and drafts your mail and holds her conversations
- Her rules and the approval gate, enforced in code
- The audit log of everything she does
- Her working files and drafts
Goes out, to named services only
- Microsoft 365, your own tenant, for mail, Teams and Planner
- Web search, when she researches something for you
- A cloud writing model, to write up research
- An image service, only for graphics you ask for
By design, your mail is read and drafted by the local model. The outside AI services receive only the research or graphics task you gave her. This is local-first, not air-gapped.
Why the short list matters
You control the doors.
Allow only what she needs
Her outside destinations are a short, fixed list of addresses. Your firewall can allow those and block everything else leaving the machine.
Nothing quiet
A new destination would be blocked and show up in your firewall log, not slip out unnoticed.
Easy for your IT to review
A one-page list of what she talks to is something your IT person or auditor can read in minutes.
Straight talk
Where the risks really are.
The computer becomes the target
Whatever runs her has to be secured like any important server: encrypted disk, current updates, limited access, tested backups, and tight permissions on the files that hold her keys.
Email can try to trick an AI
A stranger can write a message meant to talk an AI into misbehaving. That is why her approval gate lives in code. A tricked model still cannot send, change or delete anything without a person’s yes. We test her against hostile messages to prove it.
If the computer is off, she is off
Mail waits safely until she is back, but nothing gets done in the meantime. Plan the machine, power and restart steps like any other business system.
Local is different, not automatically safer
A well-run cloud service has security teams you cannot match. Running your own gives you control and visibility, and it also gives you the responsibility. We help you carry it.
Hardening checklist
What a safe install includes.
Straight answers
Questions owners ask me.
Is this air-gapped?
No. She needs to reach Microsoft 365 and a few other named services to do her work. The design is local-first with a short, fixed list of outside connections that your firewall can enforce.
Is local more secure than a cloud AI service?
It is different, not automatically better. You gain control, visibility and the ability to wall in her traffic. You also take on securing the computer. For some businesses that trade is right, and for others it is not. I will tell you which I think fits you.
What if the computer is stolen or compromised?
With an encrypted disk, a stolen machine is not readable. In either case you revoke her Microsoft 365 access and rotate her keys, which cuts her off from everything outside. The audit log shows what she did.
Is this a security certification?
No. It is a design and a checklist, not a certification or a guarantee. Have your IT or security advisor review any install for your environment.
Start here
One short call.
You leave knowing what to govern first.
Twenty minutes. Tell me what you want AI to do and we decide what it is allowed to do. No pitch theater, and you can stop at any point.
Book a 20-minute call → Or send an email →