METHODOLOGY · FIRST-PERSON ACCOUNT

How Akki is built, and the choices behind it.

A reading of the things we got right, the things we got wrong, and the ones we are still working through. Eight minutes. No diagrams.

We did not start from “how do we add AI”.

We started from the question executives actually ask: “why can’t I think with this thing the way I think with a smart colleague?” That question turns out to be a privacy question, an audit question, and a workflow question — three at once. We refused to answer it as a chat product.

A chat product treats the conversation as the unit of work. For an executive or a non-executive director, the unit of work is the decision: a paper to sign off, a follow-up to send, a board cycle to close. The chat is the residue. Useful, but residue.

Synisense came first.

Before we let any model touch a customer’s prompt, we built a three-layer anonymisation engine: a regex pass that catches the high-confidence patterns, a Presidio + spaCy pass that catches the proper nouns, and a small-model judge that closes the gaps. Then we wrote a separate architectural guard — the Privacy Wall — that field-projects every cross-board read and refuses queries that don’t constrain by tenant.

The implication: a non-executive director who sits on five boards cannot accidentally cross from one to another even if they wanted to. The wall enforces this in code, not in policy.

We invented Solva because chat is not how executives reason.

Solva is a four-mode reasoning surface — seek clarity, develop strategy, simulate hypothesis, see perspectives. Before any answer, it runs a frame audit and surfaces the audit gaps. If the grounding is thin, it refuses to speculate — and the refusal itself is an exportable artefact, watermarked and audit-tracked.

We treat the frame audit and the refusal artefact as the most important things Solva does. Most products optimise for a confident-sounding answer. We optimise for a defensible one.

The chat audit chain is hash-linked.

Every chat turn is appended to a hash-chained audit log (row_hash = SHA256(prev_hash + canonical_payload)), and the export bundles a Python verifier so auditors can prove the chain from genesis to current row without trusting our infrastructure. Genesis is fixed.

What we did not do.

We did not build customer-data fine-tuning. We did not build embeddings that persist across tenants. We did not build a marketplace of plugins. We did not build a public chat surface. Each of these was a design choice, not a missing feature.

We are also conservative about model loyalty. The workspace routes calls to three providers — Claude, Gemini, GPT — with direct streaming where the keys are present and proxy fallback when they’re not. If a provider regresses, the work continues.

The unresolved questions.

We do not yet have a clean answer for board observability across tenants that respects director privacy — the metadata layer is helpful but partial. We do not yet have a fully automated master-key rotation for the Privacy Wall envelope; today it is a planned-outage operation. These are the things we are working through with the early-access group.

— The team