01 thesis.mdtwo questions, one company

two questions, one company.

since 2024 we have answered the first one for our clients. the second one is the product we are building now.

Models can be wrong for the right-looking reasons. Bias comes first, hallucinations come next, and hidden confounders create effects that were never there.

Our consulting, engineering and operations practice exists to replace plausibility with measurement: causal reasoning instead of correlation, formal logic next to language models, counterfactual tests instead of gut feeling.

The most valuable questions in medicine, compliance and public policy rarely fail on method. They fail because no single party holds enough cases, and the data may not be pooled.

Someone must run the infrastructure; the same someone must never read the content. Today every provider that can read is a provider legal has to say no to.

where the two meet
q1 · is it true?          ─┐
                           ├──▶  locked intelligence  = the same causal, inspectable methods,
q2 · who may see it?      ─┘                           executed on data that stays sealed.

method is public. data is not.  the reverse of today's data rooms.
02 services.mdwhat we do, and where it leads

what we do, and where it leads.

three practices that already run for clients. each one is a building block of the locked layer.

tree ./appilogic
├── strategy/     the questions and the causal models   ─┐
├── systems/      frozen, versioned, enforced formats    ├──▶ locked/  analyzes, scores, prepares -
└── operations/   run it, measure it, improve it        ─┘            while the operator cannot read a word

ai strategy & causal intelligence

We design AI strategies grounded in causal reasoning, not hype. Combining language models, statistics and formal logic, we turn assumptions into measurable, testable impact.

read strategy.md

ai-native system design & development

We build systems that pair language models with rule-based logic and causal models, reducing hallucinations and keeping intelligence controllable and inspectable.

read systems.md

managed ai operations

We operate, monitor and refine AI systems with statistical validation, counterfactual testing and structured evaluation. The locked layer takes that role to its logical end: an operator who runs everything and reads nothing.

read operations.md

what we do in detail
03 problem.md15 lines

the problem.

someone must run the infrastructure. the same someone must never read the content. today, every provider that can read is a provider legal must say no to.

today's deal
trust       ──────────────────▶  insight

our deal
inspection  ──────────────────▶  without insight

Data processors, banking secrecy, professional privilege: the provider is technically able to read, so legal says no, and the project dies.

Hospital networks, state data centers, group audit functions: one platform, many parties that must stay legally separated.

Benchmarks between competitors, whistleblowing channels, external audits: participation collapses the moment one party could see individual data.

04 promise.mdthe glovebox

the promise.

a service that works on locked data and never holds the key.

Think of a sealed glovebox. The operator can sort, weigh and label what's inside, but the box never opens. Only the owner holds the key, and only the owner ever sees results.

That is not a policy, a contract or an access log. It is a mathematical property of how the data travels. A compromised server, a rogue admin or a subpoena yields nothing readable of the content.

The theory has existed for years. What's new: we made it fast, cheap and useful enough for everyday work, by choosing carefully what to compute this way.

~ operator.rs
operator.can(
  classify, score, check_rules,
  match_knowledge,
  prepare_structured_output,
  aggregate_statistics
)

operator.cannot(
  read_inputs, read_results,
  identify_people_in_the_data,
  reconstruct_documents
)  by design

consequence
deploy = anywhere   on-prem or any cloud
trust  = unchanged
05 architecture.txtthree zones, one line never crossed in the clear

how it works.

the work is split along the trust boundary. the service computes centrally without seeing; your side decides, and your own language model writes locally without sharing.

~ architecture.txt
┌─ YOUR SIDE · OPEN ───────────────────────┐     ┆      ┌─ THE SERVICE · BLIND ────────────────────┐         ┌─ TEAM KNOWLEDGE ─────────┐
│                                          │     ┆      │                                          │         │                          │
│ a small client on your device            │     ┆      │ a catalog of specialists                 │         │ your documents,          │
│ submit a task · receive the result       │     ┆      │ each does one thing well                 │         │ your knowledge base      │
│ nothing else                             │  locked    │ added without disturbing the others      │         │                          │
│                                          │  ═══════▶  │                                          │  ◀────  │ owned by the team,       │
│ your own language model                  │     ┆      │ scores · sums · knowledge lookups        │         │ not user data            │
│ calls the locked specialists             │     ┆      │ the numbers behind a decision, computed  │         │                          │
│ applies the rules · writes the output    │  ◀═══════  │ without unlocking anything               │         │ grows without ever       │
│                                          │  still     │                                          │         │ collecting names         │
│ ■ your key                               │  locked    │ no key that can unlock, ever             │         │                          │
│ created here · kept here                 │     ┆      │ what it holds lets it work, not read     │         │                          │
│ locks what leaves · unlocks what returns │     ┆      │ portable to any host                     │         │                          │
└──────────────────────────────────────────┘     ┆      └──────────────────────────────────────────┘         └──────────────────────────┘
                                                 ┆
                                    nothing crosses in the clear

on-premise today, any cloud tomorrow. the move changes nothing about trust, because the service holds nothing that can unlock your data.

illustration only: no real cryptography, nothing sent. it shows the shape of the deal.

06 capabilities.mdwhat the locked layer does for you

what the locked layer does.

1 find
Point to the exact words that name people and organizations, in a document the service never reads. Deadlines and risk follow with the first catalog.
2 answer
Hundreds of checklist questions at once: three hundred answered in one locked call of under five milliseconds; the first question catalog is being written.
3 prepare
Consistent placeholders instead of names, normalized fields, category labels, report outlines, ready for your own model to finish.
4 escalate
Combine the locked scores into decisions such as urgent && names_present && needs_approval, on your side, once they are unlocked for you alone.
  • Every check ships as a plain-language question with a measured accuracy; regulators and works councils will be able to read the catalog
  • Specialists are frozen and versioned; nothing learns from your data unless you explicitly release it, and what you release is pseudonymised before it is stored
  • New specialists come from a repeatable pipeline; each is measured on held-out data before it is exported, and the numbers are recorded with it
  • Outputs follow enforced formats: malformed results are rejected before they reach you

explainable by construction, not by after-the-fact rationalization

07 doors.mdsame service, two ways in

two ways in.

one key per user, one service. the service knows who is calling - that is deliberate, it is how access is granted and revoked - and nothing about what was asked.

submit --task report.enc
result.enc received · unlocked locally · 8 ms

A small client on your device. Submit a task, receive the unlocked result within milliseconds. No local AI required; a browser version is in preparation.

The result is the product: a placeholder, a label, a structured report, a statistic nobody else could see.

complaint desks · form submitters · field staff

> draft the response letter
calling locked.policy_check()   ✓
calling locked.sensitivity()    ✓
writing final text locally…

Your own language model does the work. Mid-task it calls the locked specialists and writes the final text itself.

New specialists appear as new tools: a specialist deployed to the service is listed to the assistant within a second. Capabilities grow without anyone reinstalling anything.

lawyers · ombudspersons · auditors · analysts

metadata is protected by the usual means - authentication, TLS, retention policy - not by the encryption. the routing stays hidden too: one locked call runs every specialist and your side selects the result, so the service sees the same request whichever way it is routed, at no extra cost.

08 levels.mdfrom signals to foresight

four levels of blind analysis.

[1] perceive  ────▶  [2] structure  ────▶  [3] estimate  ────▶  [4] foresee

Where is the sensitive content, what kind, how severe: a location map returned to the owner, never to the service.

Roles, relations and sequences of events, turned into a knowledge structure that contains no names.

Which measure actually reduced violations? Which factor drives outcomes? Estimated across parties that may never pool data.

Project risks forward, compare interventions, ask "would this have happened under policy X?", answered as a probability, on data no one else saw.

every level inherits the same property: questions and assumptions are public, data and answers are locked. method is inspectable; content is not.

09 applications.tsvtwelve cases, one pattern

where it fits.

whowhat
law-firm networksshared contract review without breaking privilege
tax advisers &
accountants		client correspondence classified and pseudonymised under professional secrecy, without a provider ever reading it
hospital groupsletters coded and redacted; research across sites without pooling patients
banks & insurerscomplaint triage by an outsourced team that never reads a letter
reporting channelswhistleblowing, compliance hotlines, ombuds offices: a host that holds no key and cannot read a report
industry benchmarkscompetitors submit KPIs; with several key holders, nobody, not even the association, sees a value
whowhat
compliance-scan saas"we cannot see your data" as the product
public administrationshared data centers, separated authorities
access-rights auditinspection without insight: conflicts, orphans, creeping privileges
risk foresightprojected risk per identity; test a policy before rolling it out
counterfactual audit"would it have happened under policy X?", including fairness checks
employee surveysanswers summed under several key holders and released only above a participation threshold; no single questionnaire is ever readable

pattern = a party that must operate but must not read. wherever you find it, the product fits unchanged.

10 flagship.mdwhat open data cannot do

answers across organizations that may never share data.

Important questions in medicine, compliance and public policy rarely fail on method. They fail because no single party has enough cases, and the data may not be pooled.

Imagine twenty hospitals contributing locked summaries. The effect of a treatment, adjusted for severity, is estimated across all of them from the released totals alone; we have run the mechanism on synthetic data. No hospital sees another's patients. The method is published; reviewers check it line by line; the data stays sealed.

Same machinery: an auditor learns which control most reduces violations across a whole client base, without seeing a single client's records.

  • the computing service holds no key and can never unlock; releasing a joint result is a separate, controlled hand-off
  • small groups are protected: results released only above participation thresholds
  • method is public, data is sealed: the reverse of today's data rooms
  • research that does not exist today, because privacy blocks it, not because anyone lacks the math
11 benchmark.logwhat we have measured

status.

it runs, on one machine and across the network. the catalog, document analysis and first pilots follow over the next quarters.

0msper locked prediction across the network, measured end to end; under 2 ms on one machine
0/ssingle-signal locked checks per second on one desk-side machine, every result verified; one client across the network sees about 100 per second
0keys of any kind held by the service, verified by design and by test
████████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
Q3 2026     Q4 2026     Q1 2027     Q2 2027
▲ now
  • locked service running
  • performance measured
  • understanding pipeline live: names, intent, urgency, routing, knowledge lookup
  • threshold release for statistics: no single key holder
  • first real specialists
  • registry & production pipeline
  • assistant integration
  • document-level analysis
  • first question catalog
  • security hardening
  • complaint triage
  • access-rights audit
  • first domain catalog

honest caveat: the numbers are for the locked specialists on sample models, each result checked against the plaintext. a full reply through your own language model takes seconds, and that is the model's time, not the lock's. technical deep-dive under NDA.

12 ask.mdtwo pilot partners · twelve months · one proof

two pilot partners. twelve months. one proof.

  • a pilot partner for blind complaint triage: a bank, insurer or claims service provider whose complaint handling is bound by banking secrecy
  • a pilot partner for the access-rights audit product: an IAM or security team, an audit firm, or group internal audit
  • domain experts to curate the first question catalogs
  • a working locked triage or audit product on their own data, without ever handing it over
  • co-authorship of the catalogs that define their domain
  • priority in the first domain-catalog licenses
  • a defensible answer to "who can read this?": only you
mail baraki@appilogic.com -s "pilot partnership"
appilogic gmbh · bänschstr. 40 · 10247 berlin
we answer personally.
contact us. follow on linkedin