Join waitlistRequest early access
← Back to home
Product · Privacy architecture

Private by design.
Useful by default.

Nupick is built so your most sensitive context can stay local. When a cloud model genuinely helps, only the right, sanitized slice is routed out — and you stay in control.

Your data
Stays where it lives
Documents, apps, memory, and tools are indexed on your device by default.
Local core
On-device retrieval & reasoning
Search, ranking, memory, and private tasks run locally — nothing leaves your machine.
Boundary
The privacy boundary
A clear checkpoint. Before anything crosses, names, emails, and figures are redacted, and raw files are stripped out.
Routing
Model routing
Tasks are routed by privacy, complexity, and capability — local models for private work, cloud models for depth.
Cloud
Optional cloud reasoning
Only sanitized context is sent, and only when it helps. You can stay fully local at any time.
Always
Human approval & audit
Sensitive actions wait for your sign-off, and every cloud crossing is logged for you to inspect.
How redaction works

Deterministic, not a model's best guess.

The boundary doesn't ask an AI to “please remove the sensitive parts.” Redaction is rule-based and deterministic: names, emails, and figures are stripped, identifiers are tokenized, and anything that could single out a person is suppressed — before a single byte crosses to the cloud.

  • Tokenized identifiers. Quasi- and direct-identifiers become opaque tokens (CAT_007) the cloud never resolves; your machine rehydrates the real labels locally.
  • Secrets stay blocked. API keys, passwords, and credentials are kept out of anything sent to a model.
  • Two transcripts. The cloud sees the tokenized, suppressed projection; your device keeps the full-fidelity copy.
  • Auditable. Every crossing is logged with a hash and manifest — raw payload bodies are never stored.
Ask your data

Question a database with a cloud model — without the rows ever leaving.

Connect a SQL database and ask analytical questions in plain language. Instead of letting a cloud model write SQL against your raw data, Nupick compiles a validated, privacy-safe plan locally and sends only the aggregate result outward. Here's every step it passes through:

Parse
Structured plan, not free SQL
Your question becomes a strict, validated query plan — never raw SQL a model wrote by hand.
Validate
Allow-listed fields only
Every field, table, and join is checked against a manifest you control. Unknown columns are rejected.
Policy
k-anonymity & suppression
Group sizes below your threshold are suppressed, so no individual can be re-identified from an aggregate.
Compile
Parameterized, read-only
Identifiers come only from the manifest; values are always bound parameters. SELECT * is never emitted.
Classify
Safe envelope out
Results are classified into a privacy-safe envelope — aggregates and tokenized labels, never raw rows.
The principle

You should never have to choose between capable AI and your own privacy.

Most tools force the trade. Nupick is designed so local-first privacy and cloud-grade reasoning live in the same workspace — with you holding the controls.

Early access

Start building your
private AI workspace.

Local-first, privacy-first, and built for people who want powerful AI without handing over everything.

Request early access →Contact the team