An AI assistant that reads your email, helps you triage and reply — then forgets on a schedule you choose, and can prove it forgot. The AI runs on infrastructure you control. Built for anyone who wants their inbox handled to a regulated-professional standard.
The AI pass — summary, triage, suggested reply — runs locally via Apertus, with a clear path to a Canadian GPU host. No US clouds, no API keys. Your content never leaves.
Citadel stores only AI-derived data, each item encrypted with its own key. On your schedule the key is destroyed (“crypto-shredding”) — the data becomes permanently unrecoverable.
Every action is logged as proof — that an item was processed, and when it was forgotten — never the content, the summary, or any key. Show your work without exposing a word.
Read-only Gmail today (Microsoft 365 next). Raw email stays in memory only — never written to disk.
The local AI writes a one-line summary, a priority, and a suggested reply for each message.
Only the derived data is stored — encrypted per-item with a unique key.
On schedule (1h / 24h / 7d / on logout) the key is destroyed — gone for good.
The audit log shows it happened, content-free. One click proves the data is truly unrecoverable.
Everyone gets the same product — built to a regulated-professional standard.