Armore Edge runs a real AI on the hardware you already own, and links your machines into one encrypted mesh — ask a question here, answer it from a file over there. It is designed so that the reasoning happens on your machine rather than in someone else’s cloud.
Built for people who work with confidential documents every day — founders, lawyers, accountants — where “we won’t look” isn’t good enough.
90 seconds, served from this site. Watch on YouTube if you prefer.
Every AI you use ships your files, chats, and thoughts to someone else's servers. Everyone now says they won't misuse it. No one lets you prove it.
Not a chatbot in someone's cloud. A workspace that runs on your machine and treats your data as yours.
A real on-device AI over your own files — ask, search, extract. Once the model is set up, the reasoning happens on your machine and works offline. It is third-party open weights we package and run, not a model we trained.
Your machines become one private workspace: message across them, and ground an answer on a file that lives on another one. The machine holding the file answers the question; the passage comes back, over a direct encrypted link. What the mesh does.
Work can carry a signed receipt: fingerprints of the exact input, the model and the output, signed on your device. Anyone can re-check it offline — how that works.
No account required to start. No cloud sees your content. No lock-in.
Free installers for macOS (Apple silicon + Intel), Windows (x64) and Linux (x64), with no account to start. The Mac build is signed and notarised, so macOS should not require right-click > Open; the Windows installer and both Linux builds are not code-signed, so SmartScreen will warn you and Linux has nothing to check. On first run the app asks before it fetches your model — about 4.9 GB of third-party open weights we package and run and did not train. After that it works offline.
Ask, search and extract on your own machine. Extraction is grounded: if the document doesn’t support a value, Armore leaves it blank instead of inventing one.
Keep Claude Code, Codex or Copilot and add one line to their config, so the search, ranking and extraction run on your machine instead of being billed to a cloud. How to set it up. They ask your machine a question; the answer comes back.
Open Armore on your other machine, choose Join a workspace and enter your workspace key. Both machines are then in the same workspace, and the private keys each one holds never leave it.
Message and ask across your devices, end-to-end encrypted — no server can read the content. When a direct link isn’t possible, a relay carries the traffic: it is ours by default and self-hostable, it cannot read anything, and it does see which devices are talking, when, for how long, how much, and their addresses.
Your question leaves as a vector, not as text — and the answer comes back as the passage itself, so the machine holding your file sends you the text it found. Three things leave on their own: the app checks GitHub for updates at launch, it fetches your model once, and the optional web search sends your query — only if you turn it on — to an engine we do not run. None of those three carries a file of yours.
Connectors are the exception, and they are off until you create one: connect an account and that connector moves the content you point it at.
Armore Edge is not one app on one laptop. Join your machines to a workspace and they behave as a single private system — messaging, shared context and retrieval across them, end-to-end encrypted, with no server able to read any of it.
End-to-end encrypted messaging in both directions, with read receipts and reactions. Send while the other end is closed and it queues and delivers when that device comes back — store-and-forward works on two real machines across a network boundary.
Ask a question on this machine and ground the answer on a document that lives on another one. The machine holding the file answers the question there; the passage comes back — over a direct encrypted link, with a signed record on both ends.
Join a device — or a person — with a workspace key, and they get the workspace’s context rather than a copy of your disk. Group messaging decrypts verbatim for everyone holding the key, and you decide who holds it.
Let a colleague ask questions against your workspace without ever receiving your documents. They get answers; the files stay on your machine, and every search runs under your approval.
A git-remote-armore helper makes a workspace a git remote, so a repository moves between your own machines over the encrypted link instead of through a hosting service.
When a direct peer-to-peer link drops, the mesh falls back to the relay and returns to direct as soon as it can — confirmed live on two real devices, with nothing for you to reconnect.
The saving comes from answering out of your own documents instead of shipping them somewhere: the question and the answer are small, and the document never moves.
| Task class | With your documents | Context | No-document control |
|---|---|---|---|
| extraction / lookup | 98% overall 10/10 strict |
10,530 doc tokens → 44 answer tokens — 99.58% saved (S-q4, 10/10) 10,530 → 48 — 99.54% saved (C7, 10/10) |
25% — +72 pp |
| multi-hop extractive | 96% | not measured | 4% — +92 pp |
| yes/no judgement | 54% | not measured | 42% — +12 pp, noise |
| Cloud "private AI" | Local dev tools | Armore Edge | |
|---|---|---|---|
| Where the AI runs | their servers | your machine | your own devices |
| Easy to use | yes | no (techie) | a real app, not a toolchain |
| Devices work together | no | no | yes — encrypted mesh |
| Privacy is… | a promise | local, unproven | signed receipts, checkable offline |
Armore can sign a receipt for a piece of work: a fingerprint of the exact bytes it read, the model it used, and what it produced — signed on your device. Change one byte of that file afterwards and the fingerprint stops matching. Try it.
No account, no server, no trust required — the check runs on your own machine.
Armore hashes the exact input bytes, the model file, and the output, and signs those fingerprints with a key held in your device’s keystore.
It carries fingerprints, not the document. You can hand it to a counterparty and they learn nothing about what was in the file.
armore audit receipt re-hashes the file you hold and checks the signature against the public key. This receipt is a file you keep — distinct from the short-lived one the relay checks as traffic passes, which is verified in the moment and not stored.
This tells you a specific thing: this output came from this input, on this model. It is not a claim that the answer is correct, and it is not a claim about who you are — it is a check anyone can run without taking our word for anything.
Three desktop installers, a command-line tool for five targets, and a full bill of materials — 104 files on the public mirror — the 52 payload files among them each carrying their own Sigstore attestation of how and where it was built, 1:1 — plus three signed update manifests. Free, and nothing to sign in to.
Signed, notarised and stapled (Developer ID, Team WV528CL2Y5), so macOS should not require right-click > Open.
The Windows installer is not Authenticode-signed — SmartScreen will warn you on first run.
Not code-signed, x64 only — nothing for the OS to verify against.
The same interface runs in a browser tab, served by your own machine — not by us. There is no account and nothing to install separately: the web client is inside the installer above. You ask questions, read your documents, conversations and memory, and see your mesh and peers. Saving a new exchange and live streaming are desktop-only today.
Nothing is hosted. The page is served from your laptop over loopback, so there is no Armore server between you and your own files.
armore-darwin-arm64 · armore-darwin-x86_64 · armore-linux-x86_64 · armore-linux-arm64 · armore.exe — plus git-remote-armore for each, so git can push to a workspace over the mesh. All ten are on the public release, each with its own attestation.
The aarch64-linux build is made without on-device inference by product decision, so it is not the same binary as its siblings.
22 CycloneDX SBOMs — one per Rust crate, one for the JS tree — published beside the installers. You can see what is inside before you install it, and every file carries a Sigstore attestation of where it was built.
What changed in this release. Filenames and sizes throughout the page are read off the published assets.
What’s coming next is below.
What we are building next: a browser view you can open from any machine, not just the one serving it, and Armore on your phone, joining a workspace the way a laptop does. Behind those: the other direction of MCP — Armore as the client, reaching out to someone else’s tools rather than only answering yours — connectors that reach a service over the network with a ledger of what each one sent, updates that install themselves, and voice calls across the same encrypted mesh. What already ships is above.
This is what the saving is for: if an agent can ask your machine a question instead of being sent the document, the document never enters anyone’s context. Measured across every workload we ran: at least 88% less context sent, and at least 55% lower cost. Connectors are for retrieval and extraction, not judgement.
Two machines hand work to each other today. Beyond two we are holding it back: with several candidates able to answer, we are not yet confident the right one does every time, and we would rather say so than ship a router that quietly picks wrong. #6448
The browser view today is served by your own machine, which is the point — and it also means it is only there when that machine is. A hosted one is next. It is not open yet, and it is not a switch we are waiting to flip: it would currently reach one device rather than yours.
Coming soon: connectors that reach a service over the network. They arrive together with the ledger that shows you what each one sent, because a connector you cannot audit is not something we want to hand you first.
Coming soon: new builds arriving in the app. The signed manifests that name every installer are already published beside the release; for now, download the new version when you want it.
Coming soon: calling across the same encrypted mesh, and a phone that joins your workspace the way a laptop does.
All 104 files are on our public mirror, fetchable without an account, with every installer named in a signed update manifest. Nothing here gates the download — the list is just how we tell you when the next build lands.