How the AI Brain runs on your device — and never phones home

When a company says their app is "AI-powered," it almost always means the same thing under the hood: your data gets sent to a server, a large model processes it there, and a response comes back. That is fine for a lot of use cases. It is a non-starter for a notes app that promises your content never leaves your device — an AI feature built the normal way would quietly break that promise every time you used it.

Prevon’s AI Brain is built the other way around. It runs entirely on-device, in a process that is deliberately isolated from the internet at the code level.

Not a policy. An air gap.

This is the important distinction: the part of Prevon that runs the AI has no code path to the internet. That is not "we promise not to send your data" — the networking code simply is not present in that process to call, even if something tried to trigger it. If someone found a way to manipulate the AI into attempting to leak your notes, there is nothing in that isolated process capable of sending them anywhere. A promise can be broken. Code that doesn’t exist cannot be exploited into calling home.

What the AI actually does with that access

Being on-device and offline doesn’t make an AI generic — it makes it more capable of understanding your actual context, because it can see your real vault structure instead of a stripped-down API payload. It knows what a note is, what a vault is, what a deletion means, and it acts inside a permission system built for exactly that context:

Permission tiers. Reading is low-risk and automatic. Anything that changes or deletes something asks for confirmation first. Wiping the vault requires re-entering your PIN. The same AI that can find a note you wrote six months ago cannot delete it without a separate confirmation step.

A real audit trail. Every action the AI takes is logged in plain language, not a technical timestamp: which notes were touched, what it decided to do, and why. Most AI agents give you a black box. This gives you receipts.

Scope limiting. You can wall off Work notes from Personal notes, and the AI’s queries are filtered so it physically cannot see across that wall — not just told not to.

The notes app is the proof, not the point

This permission system, the audit trail, and the isolated AI process are not notes-app features with an AI bolted on. They are properties of the underlying engine — which is why anything else eventually built on that same foundation inherits them automatically, instead of needing to be rebuilt from scratch. Notes is simply the first, hardest test case: reading, writing, deleting, and syncing all happen constantly, and all of it touches every layer of the engine at once. Get notes right, and the engine underneath it is proven.