Philosophy

The constraint

Authority belongs to the operator. Not to the vendor.

This is not a feature. It is not a differentiator. It is a constraint on everything we build, everything we say, and everything we ship.

If a product requires you to trust us with your data, your decisions, or your infrastructure, the product is wrong.

The cost constraint

Cost is the second constraint. Because the operator owns it, the vendor cannot meter it. The intelligence is on the machine you bought, running on the electricity you pay for. There is no token quota. There is no usage tier. There is no “your subscription is being upgraded” email.

The industry treats cost as the price of doing business. We treat regressions in cost as defects.

Cost is not a marketing pitch. It is a structural property of ownership.

What custody means

Most technology companies want custody of your data. That is their business model. Your footage lives on their computers. Your documents sync to their cloud. Your agents report to their infrastructure. You get the capability. They get the control.

The industry called this progress. We call it a bad trade.

The cargo cults are by now familiar: subscription as default. Cloud as default. Lock-in as default. Surveillance as default. Each one started as a choice. Each one became, somehow, the default no one questions anymore.

CustodyZero exists because the trade was never necessary. Capability and custody were never in conflict. The industry separated them because separation is profitable — not because it is required.

Local-first is not a feature

Local-first is an architectural constraint. It means:

• Data and processing stay on your hardware by default.
• No cloud account is required for functionality.
• No telemetry. No analytics. No phone-home.
• If data leaves your machine, that behavior is explicit, opt-in, and documented.

This is not “local-optional.” It is not “works offline too.” The system is designed to run on your hardware, under your control, without requiring you to trust anyone else.

Determinism where it matters

The intelligence inside our products is probabilistic. We do not pretend otherwise. What is not probabilistic is the structure around it — the rules that govern when intelligence runs, the criteria it must satisfy, the changes it is allowed to make, the record of what it did.

CustodyZero builds the deterministic wrapper around the probabilistic core. The model can suggest; the operator decides what to accept. The model can answer; the operator decides what to act on. The capability is harnessed, not unleashed.

Hidden state is a design failure. Ambient configuration is forbidden. The wrapper is auditable; that is what makes the intelligence usable.

Governance is not bureaucracy

Governance is the structural enforcement of constraints. It exists to reduce ambiguity, not add friction.

When CustodyZero says a product “enforces operator-defined rules,” that is governance. When StationZero applies the operator’s criteria to decide between Silent, Notify, and Escalate, that is governance. When Type lets the writer invoke the Assist explicitly rather than running it in the background, that is governance.

The operator decides what happens. The system enforces the decision. The logs prove it happened.

The instrument model

CustodyZero builds instruments, not platforms.

An instrument is a tool with craft. You buy it. It is yours. It does not stop working if you stop paying. You own what you produce with it. The manufacturer does not have a kill switch.

A platform is a thing you build on top of. The platform owner controls the foundation. They can change the rules. They can revoke access. They can raise prices. You are a tenant.

CustodyZero does not build platforms. CustodyZero builds instruments.

Ownership outright

CustodyZero sells ownership outright. What you buy is yours. The product doesn’t stop working when you stop paying for new things, because there is nothing about your existing capability that depends on continued payment.

Each product carries its own license shape — the specifics are stated on the product’s page. The principle behind them is the same: the operator bought the product. The operator owns the product. The vendor does not hold a kill switch.

A subscription that revokes the product on cancellation is a form of custody. The vendor holds a kill switch. CustodyZero does not hold kill switches.

What we never do

These are not guidelines. They are constraints.

• No collecting data we do not need. If a product works without it, we do not collect it.
• No gating local functionality behind a subscription. Core processing runs on your hardware, always.
• No silent data transmission. If data leaves your machine, you opted in and you know where it goes.
• No kill switches. Products you buy continue to work. Period.
• No making AI the identity. We build instruments. The intelligence is a component, not the product.

The position

Every product decision runs through one filter. If a feature serves the company providing the product more than the person using it, it doesn’t ship.

The capability is yours.