TitleDesk Agentby The Harness Lab
What leaves your computer, and when
| Data | Leaves your computer? |
|---|---|
| Title documents, scans, county records | No by default — selected content leaves only when you explicitly use a connected service. |
| OCR text and extractions | No by default — OCR runs locally (Tesseract). |
| Ownership calculations, runsheets, reports | No by default — a report leaves only when you explicitly export or upload it. |
| Project files and folders | No by default — selected files leave only when you explicitly send or upload them. |
| Licence activation (device fingerprint, licence status) | Yes — to the licence server only. |
| Content you explicitly send to a connected AI | Yes — to the AI provider you chose. |
| Files you sync to a Drive workspace you connected | Yes — to your own Google Drive. |
| Data you send through an approved connector or research source | Yes — to the HTTPS host you approved. |
Company Drive is read-only
Both Drive roles use Google's drive.file Picker scope. Application rules and SQLite guardrails refuse company-Drive writes. Personal Drive can receive finished packages when you say so.
A model proposes. Code computes.
Ownership math is deterministic. A deterministic parser always runs first; a model can add to what it found but can never delete a requirement, overrule a person, or decide what the software is capable of. Assignment text is treated as data and never receives tools. Reports refuse unsupported figures instead of looking finished.
The record cannot be rewritten
An append-only audit log records every consequential action — acceptance, rejection or change of a determination, and who did it — and cannot be edited or deleted, including by the software itself.
Encrypted at rest
AES-256-GCM database. The key is held in the macOS Keychain, Windows DPAPI or Linux libsecret — never in a file next to the data. One installation switches between companies with an isolated encrypted database per workspace; one company's workspace cannot read another's.
Research inside the fence
A dedicated research browser with its own profile touches only domains you have approved, with spending safeguards for paid sources. Passwords are entered by you in take-over; the software never holds the credential.
Paid actions are provable
Before a paid county document is clicked, the intent is written to encrypted disk. If the response is lost, the attempt is reconciled — never retried blindly — and a document already receipted is reused rather than bought again.
Policy documents: Privacy Policy · Terms of Service.