01 · What Sentinel does
Six abilities, one private system
Sentinel is an app on your phone, installed from the browser like any other app. Behind it is a server that belongs to you. Everything it knows comes from you, and everything it says can be traced back to something you told it.
Briefs you
The Daily Brief
Every morning: what each company needs from you, today's meetings and clashes, who to prioritise or avoid, and a protected slot for your run. It can read the brief aloud.
Remembers
Your private memory
Companies, departments, department heads, KPIs, key people, routines and every update you give it, stored encrypted on your own server.
Answers
Ask Sentinel
Ask in plain words. It answers only from your own data and shows where each fact came from. If the answer isn't there, it says so. It never guesses.
Listens
Voice notes
Speak an update after a meeting. Your voice is turned into text on your own server, so the recording never goes to an outside company.
Talks in code
Codenames everywhere
You give each person, company and place a codename. Outside your signed-in screen, Sentinel uses only codenames. One tap switches your screen to codenames too.
Watches · later stage
Heads-up alerts
Once your companies report in automatically, Sentinel warns you when a KPI slips, a deadline nears or a relationship goes cold. It stays quiet during your quiet hours.
02 · A day with Sentinel
What a normal Tuesday looks like
Times follow your phone, so if you wake in another city the brief still arrives at your 06:30.
- Nightly backupYour server scrambles a copy of everything and stores it off-site. Only your recovery phrase can unlock it.
- Sentinel preparesIt gathers today's meetings, routines, priorities, "avoid" flags and new updates, works out clashes and free slots, and picks your exercise slot.
- The brief is writtenOnly codenames go to the AI, which writes the brief in your tone and length. A fact check rejects any name or time that isn't in your data.
- "Your brief is ready."That is all the lock screen ever shows. You open the app with Face ID and real names appear on your screen only.
- Run, 5 kmYour first free slot, protected because you asked for three runs a week.
- Voice note after a meeting"FALCON says the handover slips two weeks." Transcribed on your server and stored under the right company.
- You ask a question"What did the finance heads report last week?" The answer comes with its sources. If something is missing, Sentinel tells you.
- Quiet hoursNo notifications until morning, unless you change that.
03 · Talks in code
Real names stay with you. Everything else sees codenames.
Tap the three views below. The same brief looks different depending on who is looking.
07:10Run, 5 km. Your first free slot.
10:00Meet Daniel Mwale, finance head at Harbourline Logistics. Cash collection is 12% behind plan.
TodayCall Ruth Tembo back. Last contact was 19 days ago.
AvoidPeter Banda until 14 November, as you asked.
Fictional example. These people and companies do not exist. The bracketed codes are record numbers that let you check every line against its source.
04 · How it's built
A fortress you own
Every part that touches real names runs on one private server (a VPS) rented in your name. Only two things ever leave it: codenamed requests to the AI, and a content-free "Your brief is ready" to your phone.
Plain truth about the key
So that your brief can be ready at 06:30 while you sleep, your server must be able to unlock your data. The promise is therefore this: after handover, only your server and your phone can read your data, and Tarjeti has no way in. The handover certificate proves it, account by account and key by key.
05 · Your companies and departments
How your businesses feed Sentinel
At first you give Sentinel updates yourself, by typing or speaking. In a later stage each department can run its own Tarjeti module, which sends a short weekly report into a private inbox on your server. Information only ever flows one way: into Sentinel.
| Department | What Sentinel tracks | Matching Tarjeti module | What reaches your brief |
|---|---|---|---|
| Finance | Cash in, overdue invoices, spend against budget | Invoice & Quotation Generation, Payments & Transactions | "KESTREL cash collection 12% behind plan" |
| Sales | New leads, deals won and lost, pipeline value | Lead Capture & Management Agents | "Three large deals waiting on your sign-off" |
| Operations | Stock levels, delays, supplier issues | Data & Inventory Management Systems | "Stock-out risk at one site by Friday" |
| Customer care | Complaints, escalations, review scores | Complaint & Escalation, Review Management Agents | "Two escalations need a call from you" |
| People | Headcount, key hires, leave | Scheduling & Reminder Agents | "Head of Operations on leave from Monday" |
06 · The AI team
Who does what, and what each one is allowed to see
Each AI tool has one job. Tools marked your server run on hardware you own. The one marked outside only ever receives codenames or public information.
The Analyst
- Tool
- Claude Opus 5.5 by Anthropic, on an account in your name with zero data retention requested
- Job
- Writes the brief and answers your questions
- Sees
- Codenamed facts only
- Stage
- 4 and 5
The Ears
- Tool
- Whisper, an open speech model
- Job
- Turns your voice notes into text
- Sees
- Your recordings, which never leave the server
- Stage
- 4
The Voice
- Tool
- Piper, an open text-to-speech model
- Job
- Reads your brief aloud in a calm, clear voice
- Sees
- The finished brief
- Stage
- 4
The Librarian
- Tool
- An open embedding model (such as BGE-M3) with pgvector
- Job
- Finds the right notes when you ask a question
- Sees
- Codenamed updates
- Stage
- 2
The Guard
- Tool
- Your codebook rules plus an open name-spotting model (such as GLiNER)
- Job
- Swaps names for codenames and asks you about any name it doesn't recognise
- Sees
- Everything, before anything leaves
- Stage
- 3
The Clock
- Tool
- n8n automation
- Job
- Checks every 15 minutes whether it's time to prepare your brief, and runs backups
- Sees
- Timings only, no content
- Stage
- 4
Public Radar
- Tool
- Grok by xAI, chosen for its live view of news and X
- Job
- Watches public news and sentiment for your sectors and markets
- Sees
- Public topics only, never your data. Watching a named company would reveal your interest in it, so that needs your say-so.
- Stage
- 8
Fortress Mode
- Tool
- An open language model running on a GPU server you own
- Job
- A switch that keeps every request in-house, for your most sensitive days
- Sees
- Everything, and nothing leaves
- Stage
- 8
The most powerful model
- Why not
- Anthropic's top tier (Claude Fable 5.1) requires 30 days of data retention. Sentinel uses only models that can run with zero retention.
07 · The stages
Built in eight stages, with a gate after each
At every gate you see the working result and decide whether we go on. Each stage maps to a step of the five-stage method Tarjeti uses on every AI project. Lengths are indicative and are confirmed in the detailed plan.
0
Discovery
- Your discovery questionnaire (no names, nothing confidential)
- Design document, threat model and the rules Tarjeti must follow
- Detailed build plan for your approval
Gate · your approval
1
Foundation and vault
- Private server set up, app installable on your phone
- Sign-in with Face ID or fingerprint plus a second factor
- Encryption, activity log, and test data with fictional names
Gate · your approval
2
Onboarding and memory
- The private setup wizard: your style, codebook, routine, health goals, companies, people, limits and consent
- Screens for companies, departments, people and routines
- "Add update" and manual calendar entries
Gate · your approval
3
The code layer
- Codename swap, name restore and leak check, tested against tricky cases (initials, nicknames, misspellings)
- Discreet mode switch
Gate · your approval
4
Daily Brief and voice
- The brief engine with fact check and a safe fallback
- "Your brief is ready" notification, thumbs up or down on each brief
- Voice notes in (Whisper) and brief read aloud (Piper)
Gate · your approval
5
Ask Sentinel
- Questions answered from your data, with sources
- Says plainly when it doesn't know
- Protection against poisoned content, daily spending cap
Gate · your approval
6
Hardening and handover
- Security hardening, session timeouts, re-check before viewing your codebook
- Cost tracking, brief ratings over time, encrypted nightly backups
- Tarjeti's access removed, every key changed, handover certificate and your user guide
Gate · you go live
7
Care and tuning
- Monthly backup restore test and security updates
- Review of new AI models and brief quality, based on your ratings
8
Company network
- Google or Microsoft calendar connection
- Private reports inbox and department modules
- Heads-up alerts, Public Radar, Fortress Mode
08 · Security
What could go wrong, and what stops it
No NDA is needed, because the system itself is built so that nothing can leak. This is how each risk is handled.
| Risk | What stops it |
|---|---|
| Your phone is lost or stolen | Face ID or fingerprint plus a second factor, short sessions, sign-out of all devices from any other device. Nothing readable is kept on the phone. |
| Someone looks over your shoulder | Discreet mode shows codenames only, with one tap. |
| Your lock screen | Notifications only ever say "Your brief is ready". |
| The AI company | It receives codenames only. Zero data retention is requested on your account, and the leak check blocks any request that contains a real name. |
| Tarjeti, the builder | At handover all Tarjeti access is removed and every key is changed. The certificate lists every account, who owns it and what was removed. |
| The server's hosting company | Sensitive fields are encrypted before they are stored, and the key is kept apart from the database. |
| A poisoned report or email | Incoming content is treated as information, never as commands. This is tested with deliberate attacks. |
| Sentinel makes something up | Every line links to its source record, and the fact check rejects any name or time that isn't in your data. |
| A backup is stolen | Backups are scrambled before they leave the server. Only your recovery phrase unlocks them. |
| The server itself is broken into | This is the hardest risk, so the server is kept small: few open doors, automatic security updates, alerts on unusual sign-ins, and an activity log you can read. |
09 · Running it
Everything a system like this needs
Accounts, all in your name
- Server (VPS) provider
- Private web address (domain)
- Anthropic API account
- Off-site backup storage
- Sign-in email address
Hardware
- One server: 8 processor cores, 32 GB memory, 200 GB storage
- An iPhone (iOS 16.4 or later) or an Android phone with Chrome
- A GPU server only if you later want Fortress Mode
Monthly cost (estimate)
- Server: about $60 to $150
- AI usage: about $30 to $80
- Backup storage: about $5
- Domain: about $15 a year
Paid directly by you to each provider. Confirmed once we know your usage.
Software, all open or self-hosted
Next.js app, Supabase (database and sign-in), pgvector, n8n, Whisper, Piper, Caddy (secure web gate), Docker.
Routine care
Nightly encrypted backup, monthly restore test, security updates, monthly cost report in Settings, model review every quarter.
People
You, as the only user. Tarjeti builds it and hands over every key. After that, support only happens if you invite us back in.
Sentinel will never
Send a real name outside your server
Invent tasks, people, meetings or numbers
Store medical information or give medical advice
Mention a topic you've put off limits
Run on WhatsApp or any messaging app
Sentinel will always
Show where each fact came from
Say "I don't have that" rather than guess
Let you change or delete anything you've told it
Respect your quiet hours and family time
Keep a log of everything it did, for you to read
10 · Next steps
Four steps to the first build
Step 2
Discovery questionnaire
About 15 minutes. Preferences only, no names.
Step 3
Design and plan
Tarjeti turns your answers into the full design and build plan.
Step 4
Stage 1 begins
Your server is set up and the app lands on your phone.