Armore Sovereign is a legal console we are building for firms and in-house teams whose matter data cannot be sent to a third party — because a client contract forbids it, because a statute keeps the data inside a border, or because the privilege posture of the work makes the question unaskable. The model runs on hardware you control.
This product does not exist as something you can buy, download or trial. Every capability described below is either built in our repository and not released, or planned and labelled as such — the next section marks which is which, item by item. We are targeting the first quarter of 2027. That is a target we set, not a commitment we have made to anyone, and we will move it in public if it moves. Nothing on this page is a current claim about a shipped product.
The question that decides whether this is for you is not “would you prefer privacy.” It is: is there something written down that stops you putting this matter in a cloud assistant? If there is, we want to talk to you. If there isn’t, the honest answer is in the box below it.
A client has written into the engagement that matter data will not be placed with a third-party cloud or processor, and will be returned or destroyed. That term is a hard boundary your tooling has to respect, and most assistants cannot be configured to respect it.
A statute, a regulator, or a government client’s own terms require the material to stay inside a jurisdiction, or inside a facility. We describe this as your constraint, because it is — we hold no certification that discharges it for you.
Criminal defence. Government and national-security investigations. Work where the existence of a query is itself sensitive. Here the problem is not where the answer is stored — it is that the question should never have been transmitted.
For the median firm, on-device is a convenience, not a requirement. The ABA’s Formal Opinion 512 already contemplates the use of cloud generative AI under appropriate diligence, including no-training and no-retention terms — so a mainstream cloud assistant under a properly negotiated contract is a legitimate choice, and we are not going to pretend otherwise to sell you something. We make no claim that running on-device is required by any rule of professional conduct. Sovereign is built for the cases above, where the prohibition is real and already written down. If none of the three describes you, you probably do not need this, and we would rather you knew that now than after a procurement cycle.
These are the design commitments the console is built around. Each one is stated with the limit we have actually measured, because a capability without its ceiling is the kind of sentence a general counsel tests first.
The console is built on Armore’s own on-device substrate — the same engine behind Armore Edge — so the reasoning happens on a machine you own, and the page it serves fetches no external font, script or stylesheet.
The ceiling: the open-source substrate has an operating-system-level egress jail, and it is not engaged on this product’s path today. The relevant field reports no enforcement in the production binding; it only becomes real inside a jailed worker that this console does not yet use. We will not describe the kernel as confining anything until that call site exists.
Matter segregation is the structure, not a setting: an ethical-wall screen is evaluated before the operation runs, so a screened action is refused rather than performed and logged. Indeterminate resolves to deny. Screen administration is itself gated, so someone screened out cannot lift their own screen.
The ceiling: this is app-layer enforcement scoped to a single console operator. It is not per-user screening and it is not cryptographic separation. Independent per-request identity — the thing that makes a wall hold between two people rather than around one — is planned and not built.
Actions write to a signed, append-only ledger, and a receipt binds the model, the input and the output together so it can be verified later without us. Where the console answers from your documents, citation verification checks that the cited passage is the one the receipt was bound to.
The ceiling: that binding is document-level. Passage precision drives navigation — taking you to the right page — and must not be read as attribution down to the sentence. The firm-wide view over that ledger is planned and not built, which is why the console says so in the empty state rather than showing you a clean, meaningless zero.
Unbuilt panes in the console render an explicit notice naming what is missing, rather than an empty table a reader would mistake for “no results.” An absence of data and an absence of the feature look identical on screen, and we treat that collapse as a defect.
Why it is on this page: it is also the reason the section below exists in this shape. A pre-release product that only lists what works has told you nothing.
Measured against the trunk of our sovereign repository on 13 October 2026. The left column exists in that tree and has not been released to anyone; the right column does not exist. We publish the right column because a reader who only sees the left one has been misled by omission.
We have not benchmarked this product. Not against a cloud assistant, not against another on-device system, not against itself on different hardware. Rather than leave the section out — which reads as though the numbers exist somewhere — here is what we intend to measure and what we will measure it against. When we have results they will be published with the hardware, the model and the document set named in every row, or they will not be published.
Field-level accuracy on the console’s own three templates, against a held-out set of real engagement letters, legal-hold notices and conflicts intakes, scored by a practitioner and not by the model.
How often a cited passage is the passage the receipt was bound to, and how often the console declines to answer rather than citing something it cannot bind. The refusal rate is part of the result, not an embarrassment to be hidden.
Time to a first answer over a real matter on named machine classes a firm would actually buy — not on a workstation nobody deploys.
The mainstream cloud assistants, on the same documents with the same prompts, because that is the comparison a buyer is actually making. If we lose a row we will publish the row.
A practitioner doing the same task unaided, which is the baseline that decides whether any of this is worth a licence.
Each result will name the build, the model weights, the hardware and the document set, so that someone outside Armore can run it again and disagree with us.
This list is load-bearing. It is the part of the page you can hold us to, and if a sales conversation ever contradicts it, this page is the one that is correct.
If one of the three constraints above is written down somewhere in your practice, tell us which one and what it says. That is more useful to us than a feature request, and it is the only thing on this page we are actually asking for. There is nothing to sign up for, nothing to try, and no waitlist — just a person reading mail.
Write to usNo trial, no sign-up, no demo environment. Targeting Q1 2027.