One AI teammate for your inbox. team chat. code. tasks. Your infrastructure. Your rules.
Triazz triages Outlook, Gmail, Teams, Slack and Google Chat, drafts replies that wait for your sign-off, runs tasks and browser QA with your own playbooks, and answers from your repositories with real citations. It runs on your own infrastructure, with a model you choose per job.
Shadow Mode — awaiting you
firewall before any model
hash-chained · keyed
MCP tools, 133 on by default. Changes are opt-in.
dashboard languages: English, Hindi, Spanish
model providers: Ollama, Anthropic, OpenAI, Claude Code
services in one stream: Outlook, Gmail, Teams, Slack, Google Chat
Everything you receive,
one governed path.
Messages from five services flow through a firewall, get triaged, and reach one of three kinds of work. Nothing goes out without a gate, and every step is on the record. Hover or tap any block.
You shouldn't have to choose between
convenience and control.
Cloud AI assistants see everything and show you little. Building your own takes months. Triazz is the third option: one teammate, on your own infrastructure, with every action on the record.
Scattered inboxes
Outlook, Gmail, Teams, Slack and Google Chat stay in separate tabs. Triazz triages them into one stream and a "while you were away" digest.
Data leaves the building
Triazz, your mail and your database stay on your server. Of your data, only the text for one job goes to the model you picked, and none does on local Ollama.
No record of what it did
Every action is written to a hash-chained, keyed activity log, so tampering shows up.
Bots that act on their own
Shadow Mode reads and drafts only. Commands wait for you, and known push, deploy and migration commands are refused.
Knowledge trapped in repos
Knowledge bots answer from your actual repositories and notes, with the file and line cited.
Follow one message through Triazz.
Scroll, or click a step. Your approval sits at the end of every path.
Real screens.
Read, sorted and held for you.
Each card is a real screen from the Triazz dashboard (a seeded demo instance). Watch one cross the scanner: it turns into plain text showing what Triazz does with it. Drag the belt to scrub, hover to slow it.
From a plain-English task
to a reviewed patch.
Ask in plain language. The work happens on its own branch (or a work copy), every command waits for your approval, and known deploy, database-migration and git push commands are refused.
Container mode is opt-in. A one-person install runs commands on the host; a shared server refuses host commands by default, so it needs a container runner.
Try to leak a secret.
Paste text with a token or key in it. The firewall swaps secrets for placeholders before the text goes anywhere near a model.
Raw incoming message (unsafe)
What the model sees
Change one entry. Watch the chain break.
Each entry's SHA-256 hash covers the one before it. Edit any line and every hash after it stops matching. These hashes are computed live in your browser.
Compared with what you'd use today.
Pick the kind of tool you're comparing against. These are comparisons by category, so a given product may differ. Check any vendor's own pages before deciding.
Where others are ahead today
- Zero-ops hosting. You run Triazz yourself on SQLite files: one process by default, and no managed high availability. A hosted service has no server for you to look after.
- Instant everything. Mail and chat are polled, with optional instant push for Teams, Slack and Google Chat. Replies are drafts inside Triazz, not saved to your mail app's Drafts folder.
- Native apps. Triazz is a dashboard and chat apps, not a polished mail client, and there is no mobile app.
- Enterprise extras. There is no SSO beyond Microsoft and Google sign-in, and backups are a command and a restore script rather than a managed service. A shared server is designed for roughly 50 to 100 people; larger organisations run one server per team.
Hosted-assistant examples: Microsoft 365 Copilot in Outlook, Superhuman, Shortwave. Open-source examples: Inbox Zero and similar. Agent-builder examples: Lindy, n8n. Compared by category from their public pages, November 2026. Longer read: self-hosted vs cloud AI assistants.
One model per job. Your call.
Triage, drafting replies and tasks each get their own provider and model, or share the main one (free local Ollama by default). Pick below to see what leaves your infrastructure. Claude Code on the same computer works too, and so does no model at all for search, notes and a bot’s cited sources.
A teammate that works,
not just a chatbot.
Tasks that wait for your yes
The task works on its own branch (or a work copy), so your files stay untouched, and any command it wants to run, tests included, waits for your sign-off. There is an independent review step, and every finished task gets a report you can download as Markdown, or as PDF where Chrome is installed.
You approve every single commandLogins the AI never sees
Saved logins are encrypted at rest. Test runs use them, and no AI, log or written report holds the value.
AES-256-GCM or KeychainRepository knowledge bots
Triazz retrieves the relevant code first (keyword search, meaning search with an embedding model, and a code graph read from syntax trees for about twenty file types), then answers with a citation to the file and line. With no model you still get the cited matches. The graph is best-effort: it finds the common shapes and says nothing about code it does not recognise. More on knowledge bots.
> "How does the activity log stay tamper-evident?"
• Citation: src/core/audit-chain.ts:155
Browser QA runs
A real Chrome runs the checks you describe against a web address, then produces a captioned playback of the pages it visited and a downloadable PDF report. On a shared server anyone who may run tasks can start a look-only run against sites an administrator listed; only an administrator can let a test change data or add a site.
Chrome is not in the official Docker imageYour playbooks
Markdown instructions that steer tasks; new ones wait for review, and a starter set is preinstalled. Aim one at a repo, a bot, or just yourself.
Meeting briefings
Before a meeting: who is coming, recent threads and what you promised. Meeting transcripts (off by default) become short notes.
Waiting-on follow-ups
Notes with a time, plus follow-ups for things you're waiting on someone else for.
Bots never cross users
Each person has a separate private database. A colleague's bot can ask yours only if you turned sharing on and named them, only a text answer leaves, and your yes is the default.
A separate database per personReach it from Claude Code and other MCP apps
Almost everything in the dashboard is reachable over the Model Context Protocol, by stdio or HTTP. An AI app gets the same memory, repositories, tasks and skills, but can't send or approve directly (if you allow it, it can switch auto-reply on for a limited time).
triazz mcp me
// or over HTTP, same token
POST /mcp
Limits the user can't lift.
On a shared server an administrator sets the rules once and every private bot inherits them. People can make things stricter for themselves, never looser.
A baseline every bot inherits
Shadow mode only, firewall deny rules, hourly send ceilings, a minimum learning period, a required footer on every reply and house rules added to every persona. Set ceilings per group or per person: No limit, Ask or Never for each thing the bot can do.
Spend you can cap
Server-wide daily and monthly limits, a ceiling per person, model prices people can't lower, and a 30-day chart. Triazz counts every call, its tokens and its cost, never the text.
Second factor on risky changes
Where the server asks for it, loosening a rule or switching a chat app on needs an authenticator code. Loosening choices always ask for a yes first, and the dashboard starts on Cancel.
Encrypted, with key rotation
Saved logins are encrypted (a master key, or the macOS Keychain on a Mac install), and database encryption is available with one command (off until you run it). One command rotates it: it proves the old key first, keeps encrypted copies, and puts everything back if anything fails.
An outbound check on answers
Before one bot's answer reaches a colleague, it is checked for secrets, health information, private details about a person and text that gives orders. It's a cautious heuristic, not a guarantee, so the owner can always choose Ask me first.
Delete without forgetting how to help
Deleting data purges the raw content and keeps what the bot learned from it. A retention setting erases old message text on a schedule.
Agents with their own rails
Several personas, each with its own mode, voice and rules. Every message goes to exactly one agent, and each one can be paused and resumed on its own.
Ready for your network
Runs behind your own HTTPS proxy, or use the Docker Compose and Caddy HTTPS proxy setup we provide. Sign-in is rate-limited, and people sign in with their company Microsoft or Google account.
Not built yet: single sign-on beyond Microsoft and Google accounts, and scheduled or managed backups (backup and restore are a command and a script).
Evidence, not a vibe.
Triazz gives you evidence about how well it writes like you. Going live is always your own confirmed choice.
Learns from your edits
It turns your corrections and phrase preferences into style rules. By default they wait for your approval before they apply.
Check against your old mail
Run a check that drafts replies to messages you already answered and scores how close it got. Your record is the benchmark, not a vendor's.
A small local model
Optionally train a small draft model on your own material, on your own computer. It needs a Mac with an Apple M-series chip; elsewhere this stage stays off.
Official provider APIs, no browser hacks.
Triazz runs as a background service. Mail and chat are polled, with optional instant push for Teams, Slack and Google Chat.
Every connector is built and tested against fixtures written from provider documentation. Outlook, Gmail, Teams and Google Chat have also been run on real accounts; Slack and Jira have not yet. Expect small differences on first contact, and start with one pilot user.
Three ways to run it.
Just you, locally
Needs Node 22+ and Ollama, and is set up with us because the source is not public. Runs on your own Mac or Linux computer, on a built-in demo inbox in shadow mode until you connect a real account.
Get the setup stepsA whole team, one server
A shared team bot plus a private bot per person, designed for roughly 50 to 100 people per server; larger organisations run one server per team. People sign in with their company Microsoft or Google account; an admin sets roles, repository access and spend limits.
Get the setup stepsAs a container
We give you access to a private container image, plus the Docker Compose and HTTPS proxy setup to run it behind your own domain.
Get the setup stepsFrequently asked
What is Triazz, in one sentence?add
How is this different from Copilot or another assistant that claims to be secure?add
Does my data ever leave my infrastructure?add
Can I run it with no cloud AI at all?add
Will it send things without asking?add
What happens if a licence needs to be revoked?add
Is the source code public?add
How is Triazz built?add
Take control of your team's AI.
We handle setup hands-on. Start with one pilot user and decide when the evidence says so.