For One Person
For a TeamWhere we fall short.
If any of these limits changes, this page changes the same day.
Your agent asks before it sends anything in your name or changes your calendar, and that only helps if you read before you approve.
Before your agent creates, moves or deletes an event on a calendar you’ve connected, or sends an email or a text, it proposes the exact action. The app itself enforces that, rather than politely instructing the AI.
A text goes out only when you press Send on the draft, and an email only when you send it or set a time for it, each from your own account. Your agent cannot set that time on its own. A calendar change never applies on the turn that proposed it, only exactly as proposed, and never while you are away.
One seam: on a calendar change, the app guarantees the structure, and the AI judges whether your later message was a yes.
The approval gate cannot stop your agent proposing the wrong thing: approve without looking, and it will carry out its mistake faithfully. Read what it hands you before you say yes.
Your agent buys only if you switch that on. Off, anything shaped like paying on a website is stopped and routed to you. On, it stops at Place order and presses it only after you tap to approve that order, only at shops you listed and up to the limits you set. It never types a card you pay with.
The limit is checked against the price it reads on the page, so a shop that adds a charge at the last step can take it over. A card from your bank that works at one shop, with its own limit, is the ceiling nobody gets past.
Unprompted, it messages only you (on a shared Archie for Teams agent, also the people you let in). Anything it writes to anyone else waits for you, and a web form it fills stops before the button that submits it.
Untrusted text can reach your agent, and the gate won’t fully fix it.
A hostile message in a Slack attachment, a meeting transcript or a web page your agent reads could try to talk it into something you never asked for. This is a known attack on AI agents, and ours is not exempt.
The approval gate stops such an attack from changing anything in your connected accounts that is not easily reversible. It does not stop everything. An injected instruction can still add items to your lists and write a note into your agent’s memory, where it would persist and could steer a later job.
The worst case is a leak: your agent opening a web address or running a search whose text carries something from your conversation. Since Archie 0.3.5 that is narrower.
Your agent opens a page on its own only when the address came from you, from a page it already opened, or from a site you named. That holds until it reads something somebody else wrote in that job. An address it came up with itself, it shows you first and waits for your yes.
A skill that searches the web is given only the task: none of your memory, your profile, your files or the rest of the chat. After your agent has read an email, a page or a file in a job, it asks you before handing a search to one. A search still sends its words to the AI company’s search service; only the task can supply them now.
What that does not cover, as far as we know: a note in memory is still there in the next job you start. That job begins as if nothing outside had been read, so a note can still steer it into handing a search on without asking. An email read in an earlier job no longer can, since Archie 0.3.6.
Text typed into a page that is already open goes wherever that page sends it. A service you connect through its address for AI assistants can have a way of opening pages of its own.
Archie 0.3.5 and earlier had one more: on Telegram and Slack, the chat app’s own servers could preview a link in your agent’s “Opening…” line before your agent asked you. Archie 0.3.6 turns those previews off.
Asking first has a cost. A page your agent wants to open on its own judgment now waits for you, and a follow-up to the Researcher needs its subject named, because it no longer sees earlier messages.
For about ten messages after your agent reads new mail or catches up on a group chat, a search it hands on, or a site you name in passing, waits for your yes too. Archie for Teams has worked this way since 0.3.7.
Archie checks your plan each time it opens and can reach us.
Past the free tier, Archie is sold as a plan: $30 a month, or $299 a year. Because it checks your plan, it isn’t a fully offline product. The check carries your account ID and a sign-in token, and brings back what your account can open.
If you stop paying, your plan runs to the end of the period you have already paid for. After that, on Personal with a key from an AI company saved, Archie keeps opening on the free tier, at 20 jobs a day. Without a saved key it asks for one, and Archie for Teams asks for a plan.
Nothing on your computer is deleted, and since Archie 0.3.6 and Archie for Teams 0.3.7 the screen that asks for a plan has a button that saves a backup of your agents.
Picking your plan back up from Archie, rather than through a fresh checkout, puts everything back the way you left it; if anything looks stuck, write to us.
At sign-in, our server hands the app a signed note saying what your account can open, good for 60 days. Every launch that can reach us replaces it, so in ordinary use you will never see this.
Kept offline for two months, the note runs out. On Personal with a key from an AI company saved, Archie carries on at the free tier’s 20 jobs a day. Anything more, and Archie for Teams, asks you to connect to the internet and sign in.
The note is signed because a plain switch inside the app could be flipped by anyone; being unforgeable is what lets it expire at all.
If we disappear, Archie keeps working: on its last license note for up to 60 days, then on the final version the Terms oblige us to publish. In their words: “If Otian AI ceases operations, we will publish a final version of Archie that requires no license check, within 30 days of shutting down.”
That is a term of the agreement, so you don’t have to trust us for it. The note lasts twice as long as that deadline, so the final version has a month of room before your copy would stop.
If we vanished, you would lose updates, the marketplace, support, phone access, and any AI we were paying for until you connect an account of your own. You would keep the agent you built, on your own disk.
We never kept a copy of your conversations that we could read, so there is none to take, sell, or shut off.
We keep no list of which add-ons are yours.
Every add-on is included with Archie. Adding one bumps its public install count, signed in as you so the tally can’t be gamed, and the running total is all we keep. Your backup file carries every add-on on each agent to a new computer, with your setup answers and each routine’s times; without one, you add them again there.
Nobody has audited us but us.
We have no third-party penetration test and no SOC 2 report, and you should know that before you trust us with anything. What we offer instead is the check below, which needs no trust in us.
Check us in about 10 minutes.
Prove or disprove every claim on the Trust page without taking our word for any of it.
Install a network monitor.
LuLu is free and open-source; Little Snitch is paid and friendlier. Either shows every connection an app on your Mac tries to make, and lets you block it.
Open Archie and use it properly.
Sign in, install an add-on, and give your agent a real task with a file or your calendar. Then read the list of connections it made.
The addresses you should see.
If anything else carries your content, we have either lied to you or made a serious mistake, and we want to hear about it either way.
api.anthropic.com,api.openai.com,api.groq.com,api.x.ai,generativelanguage.googleapis.com,api.deepseek.com,api.mistral.ai, or the address you typed for another provider: your agent thinking, on your key. Whichever one you connected, and only that one.archie-4f35.onrender.com: our billing service. On launch it hands your app the signed note saying what your account can open. It stands in for Anthropic on the free credits and on the plan with the AI included, and adds one to an add-on’s public install count. An AI account of your own ends only the middle one, so expect this host on every launch.firestore.googleapis.comsecuretoken.googleapis.com: our sign-in and plan check, the version ping and crash and error reports until you turn those off, the add-on catalog, and the phone mailbox if you turned it on. Your messages sit there sealed with a key we never receive. Apart from that mailbox, this carries your account ID and those records, never your content.otianai.com: checking for an update, on launch, hourly, and when you come back to the window. Carries nothing about you.assets.otianai.com: only when an add-on you install needs a tool downloaded, like a voice.github.com: only if an update is downloading.- Plus whichever accounts you connected: Google, Microsoft, iCloud, Fastmail, Yahoo, AOL, Zoho Mail, GMX, Telegram, Discord, Slack, Matrix, Todoist, Fireflies, GoHighLevel, and any service you connected with a key of your own. Directly, on your tokens. A light you added from your own wifi shows up as an address on your own network, never as a host on the internet. Websites your agent opens show up under their own addresses.
Block our two hosts, and on your own AI account your agent keeps thinking.
Add otianai.com and archie-4f35.onrender.com to your firewall’s block list, and on an AI account of your own your agent’s thinking carries on exactly as before, because nothing of ours is in that path.
What stops is what those hosts are for: updates, new tool downloads, the add-on install count, and the periodic license renewal. After about two months of blocking us, everything past Personal’s free tier stops until Archie can check in once.
Before you connect a key, the same test stops the free credits instead, because that one path does run through us, as the second line of the list above says.
Where we think this ends up. The real answer to “why should I believe you” is an open-source client, so that none of this rests on our word. We’re not there yet; for now, there is the monitor and the block list.
Why an add-on can’t run code.
Archie has nowhere to run code. A Skill is a text file plus some settings, a Personality is written instructions, and a Routine is a schedule. Nothing in an add-on can run as a program, so an add-on cannot itself read your disk or open a network connection.
What an add-on can do is tell your agent how to behave, and declare which of your connected accounts it needs: a calendar Skill gets calendar tools. Your agent reads only what you have granted it and can fetch public web pages.
So a malicious add-on has the same leak channel as any hostile text your agent reads. Treat installed instructions with the same care; the prompt-injection admission above is about add-ons too.
Declaring is what narrows: an add-on that declares nothing, like plain chat, can reach every service you have connected. And declaring “calendar” grants reading, creating and deleting together, rather than asking you about each.
A calendar connected with reading alone never yields the create or delete tools to anything. Splitting that grant apart is not built yet, and we have no date for it.
Every add-on is read by a human before it is listed. Right now one of the two of us reads every line of every submission, and this paragraph will change the day that stops being true.
What is inside the backup file.
The file Archie writes under Backups is an ordinary zip archive ending in .archie. Rename a copy to end in .zip and your computer will open it.
Three things are inside. manifest.json says which Archie wrote it, for which account and edition, when, and how many agents, skills and routines it holds. archie.db is the app’s own database. The workspaces folder holds one folder per agent.
The written parts open in any editor. In each agent’s folder, persona.md is its instructions, user.md is what it knows about you, and memory/agent_memory.md is what it remembers. Each skill has a SKILL.md, and your conversations are in memory/primary_chat.json.
No key or password is in it, and it is not encrypted. Your keys stay in your computer’s password store, and a restore lists what to connect again. Everything else can be read by anyone holding the file, so keep it where you would keep a tax return.
It opens in Archie and nothing else. We publish the layout so you can see your own agent without us. The database and the settings files beside the text are Archie’s own bookkeeping, and they change between versions.