Local by Default. Verifiable by Design.

Most AI products ask you to trust them. ProtoModule is built so you don't have to. The difference isn't marketing. It's architecture.

When you plug a ProtoModule into your TV, the intelligence lives in your home, not in someone else's data center. Every question you ask, every call you make, every visual your agent renders is processed on the device itself. The cloud is strictly opt-in, and even then it's your choice, made once, clearly.

Killswitches you can feel

Software toggles can be ignored, overridden, or quietly reset. So ProtoModule doesn't rely on them. On the side of the device are physical slider switches that cut the camera and microphone power rails. Not a setting. Not a menu. A real, physical break in the circuit.

When you slide the camera switch, the camera is off. Not "off until an update." Off. The LED ring and the on-screen indicator confirm it in the same place, in the same style, every time. You can see the state of your privacy at a glance, and you can change it with your thumb.

Every visual carries its proof

When an agent renders something on your TV, it doesn't just appear. It arrives with a provenance badge: verified, with its source, its model version, its timestamp, and its hash. Think of it as a trustmark on every single visual.

You can see where the information came from, which model produced it, and exactly when. It's the difference between "trust me" and "here's the receipt." The badge is always present, always in the same place, so you learn to read it without thinking.

The anti-placebo principle

Here's a promise most companies won't make: every control on ProtoModule genuinely does what it says. We never fake a refresh, a save, or a personalization. If a button says it does something, it does it. If a control can't honestly do what it claims, we remove it.

That sounds simple, but it's rare. Most software has buttons that pretend. ProtoModule doesn't. This is a real differentiator, and we state it plainly: no false buttons, no dark patterns, no hidden privacy state. What you see is what's true.

No agent code on your device

The deepest part of the design is what doesn't happen. No agent code ever runs on the device. Agents don't send programs. They send structured descriptions, which pass through a validation pipeline before anything is rendered.

The pipeline checks the schema, enforces an allowlist of known components, and applies strict resource budgets. Only then does a deterministic render happen, and every render is versioned and replayable. If a description is rejected, the agent gets structured feedback so it can learn and try again.

This is what makes ProtoModule safe, and it's the deepest moat we have. The device never executes untrusted code. It only renders what it has verified.

  flowchart LR
    A[Agent sends JSON spec] --> B[Validation pipeline]
    B --> C{Checks}
    C --> D[Schema compliance]
    C --> E[Component allowlist]
    C --> F[Resource budgets]
    D --> G[Deterministic render]
    E --> G
    F --> G
    G --> H[Provenance badge + telemetry]
    C --> I[Rejected spec]
    I --> J[Structured feedback to agent]

Privacy you choose, not privacy you're told

At setup, ProtoModule asks how private you want to be. It's a real choice, made once, and it's yours:

• Maximum. All AI runs locally. No cloud connection, ever. No analytics, no updates over the network.
• Balanced. Local AI for everyday use, with optional cloud for larger models, updates, and the marketplace. Anonymous crash reports only.
• Connected. The best AI capabilities, with cloud models for complex tasks and full marketplace access. Encrypted and under your control.

Whatever you choose, the device is honest about it. The privacy indicator is always visible, always in the same place. "Local only. No data leaves the stick." That's the message, in plain language, every time you look.

A network that trusts itself

Even inside your home, ProtoModule is careful. The local network is encrypted, and every tool has its own permission level. Nothing talks to anything else without being authorized. The trust framework is consistent: provenance badges, verifiable timestamps, and a privacy indicator that never hides.

Trust isn't a promise we make. It's the architecture we built. Local by default, verifiable by design, and honest about every single thing it does.