The thread is the boundary
Cosmo starts with the conversation you are in, not every message, account, or detail in your life.
Trust
Trust and privacy by design.
Cosmo needs context to coordinate effectively. The product makes that context understandable, limited, and easy to change.
Principles
Trust is designed into the workflow.
Cosmo needs context to coordinate well. The product should make that context understandable, limited, and easy to change.
Memory is visible
Preferences, plans, and loose ends are easy to review, correct, or remove.
Action needs consent
Cosmo can prepare the work. Sensitive steps, like adding calendar events, ask before they happen.
Messages
Your conversation stays the center.
When you ask Cosmo for help, Cosmo works from the thread, the people in it, and the context allowed for the request.
Your thread
Allowed context
Cosmo reply
Encryption
End-to-end encrypted for all chat participants.
Every message you send in Cosmo is scrambled into a secret code the instant you hit send, and it only gets unscrambled on the screen of the person you sent it to. Even Cosmo’s own servers only ever see the locked version, never the actual words. We use Messaging Layer Security, the open IETF standard for end-to-end encrypted group messaging, so nothing in between your phone and theirs can be read by anyone else — not hackers, not us.
You send
See you at 6 👋
They read
See you at 6 👋
Messaging Layer Security · end-to-end encrypted
Cosmo Private Runtime
Locked workspace for AI work
Visible memoryApproved toolsThread reply
Private Runtime
AI work happens in a narrow space.
Before Cosmo’s AI reads anything to help you, it strips out the personal stuff — names, phone numbers, addresses — like a censor blacking out details on a page before it’s shown to anyone else. Only after that cleanup does the message get looked at by the AI model that helps plan your day. That happens inside the Private Runtime: a walled-off space built specifically so your raw, personal information never touches the AI directly.
Memory
Useful details should not disappear into chat history.
Cosmo turns repeated preferences, plans, and commitments into visible memory. You should be able to see what matters, fix what changed, and remove what no longer belongs.
Dinner thread
Memory
Sarah is gluten-free.
ReviewCorrectRemove
Roadmap
We will publish the proof as the system ships.
Cosmo is pre-launch. The security model will become more visible in the product and in public documentation as each layer is ready.
- More precise controls for people, groups, plans, and connected accounts.
- Clearer notices when Cosmo uses sensitive context.
- Public security documentation as each part of the architecture ships.