Your sovereign personal AI.
A personal AI that lives on your hardware and answers only to you — not to OpenAI, not to Google, not to anyone selling your attention.
Five pillars under one roof, ten open-source tools woven together, one cryptographic identity you hold. Capture your life, query decades of context, route your AI requests between local and cloud on your terms. No central servers. No vendor lock-in. No surveillance.
The premise
Your AI shouldn’t live in someone else’s data center.
Today’s personal-AI tools send everything to someone else’s server: your inbox, your photos, your calendar, your private conversations, your medical history. The infrastructure isn’t yours. The terms aren’t yours. The models you can’t see were trained on data taken with terms you didn’t write.
Ancilla flips the relationship. Your AI runs on your hardware. Your decades of personal context live in your storage. Every cloud call is a decision you make per request, not a default you can’t see. When you want to use a frontier model, you pick which one and what leaves your machine; a local model strips private spans first.
This isn’t a chat wrapper. It’s a complete platform: five integrated pillars, an ecosystem of best-in-class open-source tools, a cryptographic identity you hold, and a mesh that keeps working when the internet doesn’t. Built to outlive any single piece of software, including its own.
A day with Ancilla
One question, every source, your hardware.
You’re in a call with a client. Mid-conversation, you ask:
you “Ancilla, the invoice from Madhuri last quarter — what was the amount and did we pay it?”
ancilla “Madhuri Singh (resolved via Ancilla Identity, your work-domain graph). Invoice INV-2026-07 dated 2026-02-14 for ₹82,500, ingested from Stalwart on Feb 15. Paid via UPI from your Canara account on Feb 19, reference UPI/24502819XXXX. Confirmation email on Feb 19 19:14 in Stalwart. Want me to draft a reply or pull the PDF?”
Your client never knew the question was asked. The answer never left your room.
How Ancilla thinks
Five chapters of a personal-AI day.
Most personal-AI tools do one of these well and ignore the rest. Ancilla does all five, in one platform, on your hardware.
-
Live · capture without effort
Your voice on every call, your screen when you ask, your messages across twelve channels, your photos and locations and financial events — Ancilla Bastion ingests it all into one sovereign store with retention you control per source.
-
Remember · decades, queryable
Email back to 2008, every photo, every meeting transcript, every WhatsApp message, every health metric — one query layer over content-addressed blobs and a unified semantic index. Ancilla Identity resolves “Madhuri” without confusion. Ancilla Recollect builds rolling summaries from 30 minutes up to a year.
-
Reason · the right model, every time
Ancilla Nexus routes each request across ~15 local model backends, your LAN companion devices, your rented GPUs, and (only when you turn them on) vendor APIs. Cascade routing escalates only when needed. A local model scrubs private spans before anything cloud-bound leaves the box.
-
Act · on your behalf, with your sign-off
Send a message, book a calendar event, file an invoice, run an automation — through the channel-broker, the granular consent layer, and the “Human + LLM 2-of-2” gate for anything sensitive. Every action is audited, every approval is granular, and your AI never sends anything you didn’t see.
-
Defend · security, resilience, continuity
Ancilla Aegis sandboxes every plugin, scans every dependency, watches the network. Ancilla Beacon keeps you running when the internet doesn’t. Cryptographic inheritance hands the keys to your designated heirs. Your AI outlives outages, devices, and you.
The five pillars
One platform. Five integrated peers.
Each pillar stands alone as its own open-source project. Each runs in concert with the others. Ancilla is the brand; the pillars are the workhorses.
Your single pane of glass. One cross-platform program (and per-desktop widgets) that shows everything Ancilla knows, lets you configure anything it does, and approve or revoke every access in three seconds. Every status line has an Edit button.
Your sovereign personal-data store. A single Rust daemon holding your life-log, messages, photos, financial records, calendar, contacts, health metrics, smart-home events. Open formats. Encrypted-at-rest. Designed to outlive its own code — if Ancilla disappears tomorrow, your data is still yours.
Your smart LLM router. One OpenAI-compatible API in front of fifteen local backends, your LAN devices, your rented GPUs, and opt-in vendor APIs. Per-request routing policy, cascade with confidence-based escalation, ground-truth benchmarks on your actual hardware. Cloud is opt-in per request, never silent.
Your security shield. Wraps the open-source security ecosystem — vulnerability scanning, anti-malware, supply-chain checks, AI-specific threats, sandboxing — under one operator UX. Holds new dependencies in a 5-day quarantine. Audits everything that’s ever touched your system.
Your connection of last resort. A cryptographic mesh built on Reticulum that runs over LAN, Bluetooth, LoRa radio, USB sneakernet, even audio modem. Same architecture for a power outage and a six-month expedition. Your AI doesn’t stop working when the internet does.
The federation
Ten best-in-class tools, orchestrated as one.
Ancilla doesn’t reinvent email or calendars or photo libraries. It deploys the best open-source tools that already exist, supervises them, and unifies their data through a single index. You get the depth of dedicated tools and the cohesion of one platform.
Stalwart
replaces gmailEmail server at ancilla.live — SMTP, IMAP, JMAP, all in one Rust binary you run.
Radicale
replaces google calendar · contactsCalDAV calendar + CardDAV contacts. Standards-based; talks to every device.
Memos
replaces google keepLightweight notes — one source of notes that Ancilla cross-links.
Vikunja
replaces google tasks · trelloTasks, kanban, and CalDAV alarms backing your reminders engine.
Dawarich
replaces google maps timelineYour location history on a map you own — routes, places, time spent.
Immich
replaces google photos · icloud photosPhotos + videos library with face recognition. On your storage, never re-uploaded.
Seafile
replaces google drive · dropboxBlock-level file sync. The Drive replacement that doesn’t need a third party.
n8n
replaces zapier · iftttCross-component automation hub. Connect anything to anything, on your terms.
AdGuard Home
replaces nextdns · pi-holeNetwork-wide DNS filtering. Block ads and trackers for every device in your house.
Headscale
replaces tailscale control planeSelf-hosted mesh-VPN control. Reach your Ancilla from anywhere; no third party.
Each tool keeps its own name — we don’t rebrand other people’s work. Ancilla Mission Control surfaces them under one UI; Ancilla Bastion holds the canonical state.
Apps built on Ancilla
The platform’s APIs are open. Build your own.
Three peer applications consume Ancilla’s substrate today. The same APIs are open for anyone to build the next ones.
AncillaLens
The analyst. Turns your decades of personal data into weekly patterns, relationship dynamics, cross-source narratives, decision archaeology, and anomaly alerts. Every insight cites its sources back to specific events.
peer · plannedAncillaHealth Hub
Your local Google Fit + Apple Health. Aggregates every wearable into one deduplicated metric store; lab PDFs get OCR’d; prescriptions and appointments cross-link to email and calendar.
peer · plannedAncillaHome Assistant
Gradually retire Alexa and Google Home. Smart-home routines on your network, sensor data in Ancilla Bastion, voice commands routed through the same consent layer as everything else.
peer · plannedWhat makes Ancilla different
Seven things only Ancilla does.
-
One integrated platform, not five tools glued together.
Five pillars designed as peers under a single control plane — shared auth, shared config, shared trust model. You install one thing.
-
Substrate, not another AI tool.
Most personal-AI tools are the agent. Ancilla is what the agent stands on. The tool you talk to — Claude Code, Cursor, OpenCode, whatever you prefer — keeps working and now inherits your memory, identity, routing, and audit trail.
-
Smart routing per request, not per app.
Ancilla Nexus lets you decide local-first, cloud-first, or strict-local for any single LLM call — with a five-tier vendor trust classification and a local PII scrubber on every cloud-bound request.
-
Your identity is a key you hold, not an account on someone’s server.
Every Ancilla install gets its own cryptographic identity. Two Ancillas verify each other directly — no central account, no email-and-password, nobody in the middle who could spoof you or lock you out.
-
Works when the internet doesn’t.
Ancilla Beacon runs over LAN, Bluetooth, LoRa radio, USB sneakernet, even audio modem. Same architecture for “hiking weekend offline” and “Mars mission, six months no contact.”
-
Built to outlive itself.
Open file formats. Raw blobs on disk. Documented HTTP/JSON APIs. If Ancilla’s code disappears tomorrow, your data is still readable with nothing more than a filesystem.
-
Inheritance is a designed feature.
A dead-man switch in Ancilla Bastion, Shamir Secret Sharing for designated heirs, and cryptographic succession events your peers recognize. Your sovereign AI passes cleanly when you don’t.
What Ancilla does, and what it refuses to do.
Promises made by architecture, not marketing.
✓ What Ancilla does
- Runs entirely on your hardware by default.
- Encrypts everything at rest with a key in your OS keyring.
- Logs every routing decision, every consent grant, every action taken.
- Shows you what data left your machine, when, and to where.
- Verifies model files and dependencies cryptographically before loading.
- Survives ISP outages, blackouts, and arbitrarily-long disconnection.
- Hands your data to your heirs on your terms, with your keys.
✗ What Ancilla refuses
- No accounts. No login server. No identity provider in the middle.
- No telemetry. No phone-home. No analytics on Ancilla’s own usage.
- No newsletter funnel. No fake waitlist. No FOMO.
- No hosted SaaS version, ever. Sovereignty isn’t a tier.
- No silent cloud calls. Cloud is opt-in per request, per provider.
- No training-on-your-data deals with anyone, ever.
- No vendor lock-in. Open formats. Apache-2.0.
Common questions
What people ask before they install something this big.
Is Ancilla free? Will there be paid tiers?
Yes. Free. Apache-2.0. No paid tiers, no premium features, no subscription, no usage limits. Ancilla runs on hardware you already own; we never have your data to charge for. This exists to be useful, not extractive.
When does Ancilla v0.0.1 ship?
When the code works reliably end-to-end in daily use. The maintainer is the first user; release happens when one human can rely on it without regressions. Follow Reddit or X for actual news.
How is Ancilla different from the AI tools I already use?
Most personal-AI tools are the agent — the thing you talk to. Ancilla is what the agent stands on: your memory, your identity, your routing, your consent gates, your audit trail. Whatever tool you already use — Claude Code, Cursor, OpenCode, your favourite IDE — keeps working and now inherits all of that automatically. You don’t migrate. You add a layer underneath.
Do I need to be a developer to use Ancilla?
Eventually no. The end goal is that Ancilla works for non-developers — install, configure via Ancilla Mission Control, daily-driver use without touching a terminal. The first release will be developer-shaped (it has to be), but the design is for everyone.
Why no cloud version? Why no hosted Ancilla?
Because sovereignty is the point. The whole reason Ancilla exists is so your data, your routing, and your AI memory stay on hardware you own. A hosted version would defeat that. If you want cloud LLMs, Ancilla Nexus can route to them on your terms — per request, per provider, with full audit and a local PII scrub before anything leaves your machine.
Can I use just one piece of Ancilla, or do I need everything?
One piece at a time. Each pillar stands alone. Run Ancilla Bastion as just a personal-data store. Run Ancilla Nexus as just an LLM gateway. Run Ancilla Aegis as just a security layer. They get much more useful together, but they’re not bundled into a monolith.
What hardware do I need?
One workstation or home server with a GPU works well; the reference machine is an Ryzen 9 + 64 GB RAM + RTX 3090 (24 GB VRAM). Less than that — a Mac mini, a Pi cluster, a NAS — runs the lower-VRAM pillars and offloads heavy compute to your other devices via the mesh. Pure CPU works for many tasks; GPU unlocks the deeper ones.
What happens to my Ancilla when I’m gone?
Inheritance is designed in. Ancilla Bastion has a dead-man switch; Shamir Secret Sharing splits the keys to your designated heirs in physical or digital envelopes; a cryptographic succession event signed by reconstituted keys lets your peers’ Ancillas recognize the new owner. Your sovereign AI passes cleanly when you don’t.
Stay in the loop
Hear from us when Ancilla ships.
Drop your email and we’ll let you know when there’s working code to try. No newsletter, no follow-ups you didn’t ask for.
Or just email hello at ancilla.live directly.