Ancilla · an-SILL-ah

Your sovereign personal AI.

A personal AI that lives on your hardware and answers only to you — not to OpenAI, not to Google, not to anyone selling your attention.

Five pillars under one roof, ten open-source tools woven together, one cryptographic identity you hold. Capture your life, query decades of context, route your AI requests between local and cloud on your terms. No central servers. No vendor lock-in. No surveillance.

In active development · v0.0.1 ships when it works · no fake deadlines
5 pillars under build 10+ federated OSS tools 0 central servers Apache-2.0 when it ships

The premise

Your AI shouldn’t live in someone else’s data center.

Today’s personal-AI tools send everything to someone else’s server: your inbox, your photos, your calendar, your private conversations, your medical history. The infrastructure isn’t yours. The terms aren’t yours. The models you can’t see were trained on data taken with terms you didn’t write.

Ancilla flips the relationship. Your AI runs on your hardware. Your decades of personal context live in your storage. Every cloud call is a decision you make per request, not a default you can’t see. When you want to use a frontier model, you pick which one and what leaves your machine; a local model strips private spans first.

This isn’t a chat wrapper. It’s a complete platform: five integrated pillars, an ecosystem of best-in-class open-source tools, a cryptographic identity you hold, and a mesh that keeps working when the internet doesn’t. Built to outlive any single piece of software, including its own.

A day with Ancilla

One question, every source, your hardware.

You’re in a call with a client. Mid-conversation, you ask:

you    “Ancilla, the invoice from Madhuri last quarter — what was the amount and did we pay it?”

— voice captured by Ancilla Voice Pipeline; routed through the on-device dispatcher —

ancilla   “Madhuri Singh (resolved via Ancilla Identity, your work-domain graph). Invoice INV-2026-07 dated 2026-02-14 for ₹82,500, ingested from Stalwart on Feb 15. Paid via UPI from your Canara account on Feb 19, reference UPI/24502819XXXX. Confirmation email on Feb 19 19:14 in Stalwart. Want me to draft a reply or pull the PDF?”

— Ancilla Bastion correlated four sources (Stalwart, Ancilla Treasury, Ancilla Identity, Recollect summary) in 1.3s on local hardware. Zero outbound calls. —

Your client never knew the question was asked. The answer never left your room.

How Ancilla thinks

Five chapters of a personal-AI day.

Most personal-AI tools do one of these well and ignore the rest. Ancilla does all five, in one platform, on your hardware.

  1. Live · capture without effort

    Your voice on every call, your screen when you ask, your messages across twelve channels, your photos and locations and financial events — Ancilla Bastion ingests it all into one sovereign store with retention you control per source.

  2. Remember · decades, queryable

    Email back to 2008, every photo, every meeting transcript, every WhatsApp message, every health metric — one query layer over content-addressed blobs and a unified semantic index. Ancilla Identity resolves “Madhuri” without confusion. Ancilla Recollect builds rolling summaries from 30 minutes up to a year.

  3. Reason · the right model, every time

    Ancilla Nexus routes each request across ~15 local model backends, your LAN companion devices, your rented GPUs, and (only when you turn them on) vendor APIs. Cascade routing escalates only when needed. A local model scrubs private spans before anything cloud-bound leaves the box.

  4. Act · on your behalf, with your sign-off

    Send a message, book a calendar event, file an invoice, run an automation — through the channel-broker, the granular consent layer, and the “Human + LLM 2-of-2” gate for anything sensitive. Every action is audited, every approval is granular, and your AI never sends anything you didn’t see.

  5. Defend · security, resilience, continuity

    Ancilla Aegis sandboxes every plugin, scans every dependency, watches the network. Ancilla Beacon keeps you running when the internet doesn’t. Cryptographic inheritance hands the keys to your designated heirs. Your AI outlives outages, devices, and you.

The five pillars

One platform. Five integrated peers.

Each pillar stands alone as its own open-source project. Each runs in concert with the others. Ancilla is the brand; the pillars are the workhorses.

AncillaMission Control
The human boss

Your single pane of glass. One cross-platform program (and per-desktop widgets) that shows everything Ancilla knows, lets you configure anything it does, and approve or revoke every access in three seconds. Every status line has an Edit button.

AncillaBastion
The data boss

Your sovereign personal-data store. A single Rust daemon holding your life-log, messages, photos, financial records, calendar, contacts, health metrics, smart-home events. Open formats. Encrypted-at-rest. Designed to outlive its own code — if Ancilla disappears tomorrow, your data is still yours.

AncillaNexus
The compute boss

Your smart LLM router. One OpenAI-compatible API in front of fifteen local backends, your LAN devices, your rented GPUs, and opt-in vendor APIs. Per-request routing policy, cascade with confidence-based escalation, ground-truth benchmarks on your actual hardware. Cloud is opt-in per request, never silent.

AncillaAegis
The security boss

Your security shield. Wraps the open-source security ecosystem — vulnerability scanning, anti-malware, supply-chain checks, AI-specific threats, sandboxing — under one operator UX. Holds new dependencies in a 5-day quarantine. Audits everything that’s ever touched your system.

AncillaBeacon
The network boss

Your connection of last resort. A cryptographic mesh built on Reticulum that runs over LAN, Bluetooth, LoRa radio, USB sneakernet, even audio modem. Same architecture for a power outage and a six-month expedition. Your AI doesn’t stop working when the internet does.

The federation

Ten best-in-class tools, orchestrated as one.

Ancilla doesn’t reinvent email or calendars or photo libraries. It deploys the best open-source tools that already exist, supervises them, and unifies their data through a single index. You get the depth of dedicated tools and the cohesion of one platform.

Stalwart

replaces gmail

Email server at ancilla.live — SMTP, IMAP, JMAP, all in one Rust binary you run.

Radicale

replaces google calendar · contacts

CalDAV calendar + CardDAV contacts. Standards-based; talks to every device.

Memos

replaces google keep

Lightweight notes — one source of notes that Ancilla cross-links.

Vikunja

replaces google tasks · trello

Tasks, kanban, and CalDAV alarms backing your reminders engine.

Dawarich

replaces google maps timeline

Your location history on a map you own — routes, places, time spent.

Immich

replaces google photos · icloud photos

Photos + videos library with face recognition. On your storage, never re-uploaded.

Seafile

replaces google drive · dropbox

Block-level file sync. The Drive replacement that doesn’t need a third party.

n8n

replaces zapier · ifttt

Cross-component automation hub. Connect anything to anything, on your terms.

AdGuard Home

replaces nextdns · pi-hole

Network-wide DNS filtering. Block ads and trackers for every device in your house.

Headscale

replaces tailscale control plane

Self-hosted mesh-VPN control. Reach your Ancilla from anywhere; no third party.

Each tool keeps its own name — we don’t rebrand other people’s work. Ancilla Mission Control surfaces them under one UI; Ancilla Bastion holds the canonical state.

Apps built on Ancilla

The platform’s APIs are open. Build your own.

Three peer applications consume Ancilla’s substrate today. The same APIs are open for anyone to build the next ones.

AncillaLens

The analyst. Turns your decades of personal data into weekly patterns, relationship dynamics, cross-source narratives, decision archaeology, and anomaly alerts. Every insight cites its sources back to specific events.

peer · planned

AncillaHealth Hub

Your local Google Fit + Apple Health. Aggregates every wearable into one deduplicated metric store; lab PDFs get OCR’d; prescriptions and appointments cross-link to email and calendar.

peer · planned

AncillaHome Assistant

Gradually retire Alexa and Google Home. Smart-home routines on your network, sensor data in Ancilla Bastion, voice commands routed through the same consent layer as everything else.

peer · planned

What makes Ancilla different

Seven things only Ancilla does.

  • One integrated platform, not five tools glued together.

    Five pillars designed as peers under a single control plane — shared auth, shared config, shared trust model. You install one thing.

  • Substrate, not another AI tool.

    Most personal-AI tools are the agent. Ancilla is what the agent stands on. The tool you talk to — Claude Code, Cursor, OpenCode, whatever you prefer — keeps working and now inherits your memory, identity, routing, and audit trail.

  • Smart routing per request, not per app.

    Ancilla Nexus lets you decide local-first, cloud-first, or strict-local for any single LLM call — with a five-tier vendor trust classification and a local PII scrubber on every cloud-bound request.

  • Your identity is a key you hold, not an account on someone’s server.

    Every Ancilla install gets its own cryptographic identity. Two Ancillas verify each other directly — no central account, no email-and-password, nobody in the middle who could spoof you or lock you out.

  • Works when the internet doesn’t.

    Ancilla Beacon runs over LAN, Bluetooth, LoRa radio, USB sneakernet, even audio modem. Same architecture for “hiking weekend offline” and “Mars mission, six months no contact.”

  • Built to outlive itself.

    Open file formats. Raw blobs on disk. Documented HTTP/JSON APIs. If Ancilla’s code disappears tomorrow, your data is still readable with nothing more than a filesystem.

  • Inheritance is a designed feature.

    A dead-man switch in Ancilla Bastion, Shamir Secret Sharing for designated heirs, and cryptographic succession events your peers recognize. Your sovereign AI passes cleanly when you don’t.

What Ancilla does, and what it refuses to do.

Promises made by architecture, not marketing.

What Ancilla does

  • Runs entirely on your hardware by default.
  • Encrypts everything at rest with a key in your OS keyring.
  • Logs every routing decision, every consent grant, every action taken.
  • Shows you what data left your machine, when, and to where.
  • Verifies model files and dependencies cryptographically before loading.
  • Survives ISP outages, blackouts, and arbitrarily-long disconnection.
  • Hands your data to your heirs on your terms, with your keys.

What Ancilla refuses

  • No accounts. No login server. No identity provider in the middle.
  • No telemetry. No phone-home. No analytics on Ancilla’s own usage.
  • No newsletter funnel. No fake waitlist. No FOMO.
  • No hosted SaaS version, ever. Sovereignty isn’t a tier.
  • No silent cloud calls. Cloud is opt-in per request, per provider.
  • No training-on-your-data deals with anyone, ever.
  • No vendor lock-in. Open formats. Apache-2.0.

Common questions

What people ask before they install something this big.

Is Ancilla free? Will there be paid tiers?

Yes. Free. Apache-2.0. No paid tiers, no premium features, no subscription, no usage limits. Ancilla runs on hardware you already own; we never have your data to charge for. This exists to be useful, not extractive.

When does Ancilla v0.0.1 ship?

When the code works reliably end-to-end in daily use. The maintainer is the first user; release happens when one human can rely on it without regressions. Follow Reddit or X for actual news.

How is Ancilla different from the AI tools I already use?

Most personal-AI tools are the agent — the thing you talk to. Ancilla is what the agent stands on: your memory, your identity, your routing, your consent gates, your audit trail. Whatever tool you already use — Claude Code, Cursor, OpenCode, your favourite IDE — keeps working and now inherits all of that automatically. You don’t migrate. You add a layer underneath.

Do I need to be a developer to use Ancilla?

Eventually no. The end goal is that Ancilla works for non-developers — install, configure via Ancilla Mission Control, daily-driver use without touching a terminal. The first release will be developer-shaped (it has to be), but the design is for everyone.

Why no cloud version? Why no hosted Ancilla?

Because sovereignty is the point. The whole reason Ancilla exists is so your data, your routing, and your AI memory stay on hardware you own. A hosted version would defeat that. If you want cloud LLMs, Ancilla Nexus can route to them on your terms — per request, per provider, with full audit and a local PII scrub before anything leaves your machine.

Can I use just one piece of Ancilla, or do I need everything?

One piece at a time. Each pillar stands alone. Run Ancilla Bastion as just a personal-data store. Run Ancilla Nexus as just an LLM gateway. Run Ancilla Aegis as just a security layer. They get much more useful together, but they’re not bundled into a monolith.

What hardware do I need?

One workstation or home server with a GPU works well; the reference machine is an Ryzen 9 + 64 GB RAM + RTX 3090 (24 GB VRAM). Less than that — a Mac mini, a Pi cluster, a NAS — runs the lower-VRAM pillars and offloads heavy compute to your other devices via the mesh. Pure CPU works for many tasks; GPU unlocks the deeper ones.

What happens to my Ancilla when I’m gone?

Inheritance is designed in. Ancilla Bastion has a dead-man switch; Shamir Secret Sharing splits the keys to your designated heirs in physical or digital envelopes; a cryptographic succession event signed by reconstituted keys lets your peers’ Ancillas recognize the new owner. Your sovereign AI passes cleanly when you don’t.

Stay in the loop

Hear from us when Ancilla ships.

Drop your email and we’ll let you know when there’s working code to try. No newsletter, no follow-ups you didn’t ask for.

Or just email hello at ancilla.live directly.