The company brain that never leaves the building.
Enclave gives your team a shared AI workspace — local models, autonomous agents, and your collective knowledge — running on a Mac you own. Not our cloud. Not anyone's. Yours.
Every “team AI” quietly uploads your work to someone else's cloud.
Your contracts, client files, case notes, deal memos — the most sensitive things your company owns — sitting on a vendor's servers. “You own your data” almost always means it's ours, scoped to you. For work under NDA, that isn't a policy footnote. It's a dealbreaker.
Enclave turns it inside out.
One always-on Mac in your office becomes the Hub — it holds the shared vault and can serve the heavy models. Every teammate runs the full workspace on their own Mac. Inference can travel across your network; your records never leave it. Remote compute, never remote data.
Six pieces — all on hardware you own.
Here's exactly what you're running, and why each part is built the way it is. No hand-waving.
One Mac becomes the brain. Everyone keeps their own.
Pick one always-on Mac — a Mac mini in a closet is plenty. It becomes the Hub: it holds the shared vault and, if you want, serves the larger models the whole team can call. Everyone else runs the full workspace on their own Mac, with their own private chats and files. The vault is the only thing that's shared — and only with the people you grant.
- The Hub holds shared vaults and can serve the heavy models.
- Each member runs a full local workspace — their own records never leave their Mac.
- The vault is the single shared surface, granted per person.
A member's question can run on the Hub's big model — the computation travels, the records don't. Remote inference, never remote data.
A shared brain made of plain files.
Your team's shared knowledge is just markdown and documents on the Hub — portable, searchable, and yours. No proprietary database, no export button you can never find. Access is granted per vault, per person, and everything syncs like a private Dropbox: only what changed, with conflicts saved as copies and deletes sent to a trash you can recover.
- Plain files. Markdown + docs, greppable, zero lock-in.
- Per-vault access. Reader, Writer, or Admin — assigned per person.
- Safe edits. An agent stages changes in a shadow copy; you review a diff and promote.
| Capability | Reader | Writer | Admin |
|---|---|---|---|
| Read & search | ✓ | ✓ | ✓ |
| Add & edit files | — | ✓ | ✓ |
| Manage access | — | — | ✓ |
Sync moves only the changed files. A conflict becomes a “conflicted copy,” a delete goes to trash, and every change is attributed to who made it.
Small models you can actually trust with tools.
Enclave runs real models on Apple Silicon — no cloud, no tokens metered. A curated catalog tells you exactly what fits the Mac in front of you and what to offload to the Hub. And because small local models are notoriously flaky at calling tools, Enclave wraps every tool call in a two-layer safety net, so the agent actually works instead of just demoing.
- Fits-your-Mac catalog. Memory-aware — you know before you load.
- Hub offload. Too big for a laptop? The Hub serves it to everyone.
- Reliable tool calls. A grammar constrains generation; a parser recovers any drift.
An agent that knows your team's stuff.
Scout is your team's local agent — chat, research, draft, code. Its tools search and edit the shared vault, so it answers from your team's actual knowledge, not the open internet. Teach it a procedure once as a Skill, and everyone's agent knows it. All of it runs on the local or Hub models, so its context — your docs, your conversations — never leaves.
- Knows your vault. Semantic + keyword search across shared docs.
- Skills. Reusable procedures your team writes once, everyone reuses.
- Local context. Nothing it reads or writes leaves your building.
Answered from your files — with the source, so anyone can check it.
Agents that work while you sleep — safely.
Emissary runs agents on a schedule — research, drafting, monitoring, follow-through — while nobody's watching. Because nobody is, it's built to be safe: each run is bounded so it wraps up cleanly instead of spiraling, and every change it makes is staged for a human to promote. An unattended agent proposes; a person approves. And they're included, unlimited — not $100 an agent.
- Scheduled + autonomous. Daily, weekly, or your own cadence.
- Bounded runs. It wraps up before it runs out of room.
- Nothing auto-applied. Changes stage; a human promotes.
Rounds are capped so a run always ends with a clean report — never a runaway loop. Its edits wait in a shadow copy until you promote them.
Your team reaches the Hub — the internet can't.
Teammates reach the Hub over an encrypted mesh on your own network — auto-configured, LAN-first, with no public endpoint for the outside world to find. Joining is a single-use invite link that carries a pre-authorized key, so a member never touches network settings.
- Encrypted & private. A WireGuard mesh with no exposed address.
- One-click join. A single-use link carries a pre-authorized key.
- On your network today. Working from anywhere is coming next.
An Enclave-supported relay is on the way, so your team can connect from any network — home, the road, a client site. Connections are peer-to-peer wherever possible, and even the fallback relay only ever forwards encrypted traffic it can't read. Your data never touches a cloud.
The only thing that ever leaves is a receipt.
Privacy isn't a setting in Enclave — it's the shape of the system. Draw the line where the bytes actually are, and two planes fall out.
- Your vaults & documents
- Every prompt and every response
- All inference — local or on the Hub
- Your chats, files, and history
- A signed license check — nothing else
signed · verifiable · zero customer data
And if the subscription ever lapses, the product pauses — adding members and Hub-served models stop. Your data stays fully yours and readable. You are never locked out of your own knowledge over a billing hiccup.
Built on Courier OS.
Enclave isn't a v1 experiment. It's the private-team edition of Courier OS — a mature engine that already runs AI natively on Apple Silicon. Everything above is Courier OS, hardened in the wild; Enclave adds the team layer on top.
So you're not betting on a brand-new stack. You're getting a proven engine with a team wrapper — and an OpenAI-compatible API underneath, if your developers want to build on it.
Running in an afternoon.
Set up the Hub
Pick a Mac in your office and make it the Hub — the vault and the models everyone draws on.
Invite your team
Send a single-use link. Each teammate joins, and the vaults they're granted start syncing to their Mac.
Just work
Chat, search your vault, run agents — all local. Unplug the internet and it keeps going.
Same job. Opposite architecture.
| Enclave | Cloud team-AI | |
|---|---|---|
| Where your data lives | A Mac in your building | Their AWS account |
| Price | $500/mo flat, per Hub | $500/mo + $100 per agent |
| Autonomous agents | Unlimited, included | $100/mo each |
| Works with the internet off | Yes — by design | No |
| Runtime | Its own app + local models | Bolted onto a coding tool |
| Privacy model | Architecture | Policy |
One price. Your whole team.
- Unlimited people. No per-seat pricing, ever.
- Unlimited agents. Not $100 a head.
- Local models on every Mac
- Private team vault + encrypted mesh
- No usage bills, no token meters
Boutique agencies, law firms, accountants, consultancies — teams whose work is bound by an NDA and whose data simply cannot leave.
One flat rate covers the whole firm. Add every person, run every agent, and pay the same. The math against per-seat, per-agent cloud tools isn't close.
Nothing leaves the building.
Give your team the AI workspace they want and the privacy your clients require — on hardware you already trust.