Your context stays yours.

The engine works in your environment

The engine runs on your computer, company server or rented server under your control. Your working files, rules and agenda context live there. Closing the app, signing out, losing a device or losing the connection does not itself cancel assigned work. The engine’s host must remain available.

Files you can open without Promptbook

Agents, tasks and conversations are readable files in agents/, tasks/ and chats/. Project settings live in ptbk.json. Use ordinary tools to inspect, edit, back up or move the content to another machine.

Changes have a history

By default, the engine commits completed project changes to Git. Compare file versions and see what changed during the work. Available task records help explain what happened. Restoring an earlier file version does not undo an email already sent or another action in an external system.

Both ends are yours. Encrypted communication between them.

The app and engine communicate with end-to-end encryption. Keys to working content stay on your endpoint devices. The relay and central backend pass encrypted working content without decrypting it. That is the zero-trust principle: you do not have to entrust the content of your work to the relay.

The same protection covers chat, transferred files, credentials in Wallet and any service terminal. Project access is verified even over an encrypted connection. Account, subscription and necessary operational data are separate from working content.

The local dashboard and engine interface are accessible only on the engine’s host and require no pairing. The remote app uses a separate authenticated, encrypted connection. Remote control does not require exposing the local interface to the internet.

You choose the model

Promptbook is not tied to a single AI provider. Choose a supported harness and model; your roles, rules and files remain part of your project. A local model can connect through a compatible integration of a supported harness. Its suitability for a particular workflow depends on the model, hardware and tools.

When using an external model, required inputs go directly from your environment to its provider. End-to-end encryption of the control channel does not mean the AI provider cannot see those inputs. The same applies to tools you authorize to use data.

A local model removes the need to send inputs to an external model provider. Suitability depends on the model, hardware and task; connected external tools do not automatically become local.

You control permissions and oversight

Together with your partner, choose which accounts the workflow may access, what it can do independently and when approval is required. Drafting and sending a reply are separate steps. Sensitive actions can stay under review.

Agents learn. You set the fixed rules.

Agents can improve their methods and knowledge within the limits you set. They do not change fixed goals, prohibitions or approval boundaries themselves, including during automatic repairs or updates. You authorize changes to those rules.

For each agent, you decide whether it may learn and which parts of its instructions it may change. An agent does not rewrite closed instructions itself. Open instructions allow learning within specified limits; the agent cannot remove those limits. If a fixed rule prevents completion, it asks for the decision it needs and continues independent tasks.

Updates under your rules

Automatic updates are enabled by default. The engine selects stable patch and minor releases within the same major version and waits for a safe idle opportunity. You can disable automatic updates or pin a particular version. Updates preserve a project’s manual pause or stop.

By default, automatic updates do not move to a new major version. A stable installation does not enter prereleases automatically. If you chose a prerelease, the engine follows later prereleases of that same version and then moves to its stable release. After that, it stays on stable releases.

Projects can use separate installations and different engine versions. When they share an installation, a version pin in any one project prevents other projects from changing it. Necessary project-file migrations are recorded in Git; if an update fails, the engine attempts to restore working operation.

Running your own environment also means managing access, updates, backups and the devices that display content. Public code allows implementation review; it is not a security certification by itself.

Want to look under the hood?

Explore the public code on GitHub ↗

Data in this calculator

Calculations run in your browser. Shared advanced-calculator links contain the entered assumptions. When you request a PDF, we save your email and calculation link in our contact system; this is not a newsletter subscription. Your email is not included in the shared link or PDF.