Architecture

How Castald is built.

For the household’s IT adviser: the parts, the rules they follow, and where your data lives.

I. The stack

Five layers, one set of rules.

Every screen talks to the same steward. Every action passes through the same executor. Every connection reports into the same stream of events.

Screens Where you see and speak

The wall An iPad by the door, in kiosk mode

Phone and tablet The app, its widgets and lock-screen activity

Television A ten-foot view, driven by the remote

Laptop The full web app

Alexa Another ear, with low-risk actions only

The steward The API: Hono on Node 22

Conversation and voice Chat and events over SSE; one voice socket per screen

Tool executor Tiers, roles, budgets, approvals and the record

AI router Five slots, any provider, your key or ours

Sign-in Passkeys, with an email code as the fallback

The engine The worker: BullMQ on Redis

Event bus One shape for everything that happens

Connectors Nineteen, polled or streamed live

Routines and errands Approved once, run within their tier

Briefs and notices Budgeted, with quiet hours

The keepers In your region

The vault Every secret sealed under its own key

Database Postgres; events partitioned by month

Files Scanned by ClamAV before they reach storage

Cloud browser Disposable Chromium sessions, recorded step by step

Your accounts In your name

Mail and diary Google, Microsoft 365, iCloud

The house Home Assistant, Kenaez, UniFi, Octopus

Money Xero, QuickBooks, Stripe

And the rest Messages, social, Graftix, any MCP server

II. A request, start to finish

Every action takes the same road.

A spoken question, a tap on a tile, a routine at dusk and an errand on its third day are all the same thing underneath: a call to a tool.

i.
You ask
By voice, by a tap, by a routine or by an errand. Each becomes a tool call.
ii.
It is checked
Against your role, the screen’s limits, the space it belongs to and the day’s budget.
iii.
It asks, if it must
Anything consequential waits five minutes for your yes. The highest tier also needs your passkey.
iv.
It acts
The connector does the work, with a key opened from the vault for that one use.
v.
It is recorded
Approved, declined or refused, every request is written to an append-only record.

III. Risk tiers

Four tiers, set by what an action can do.

Every tool carries a tier. An owner may raise one; nobody can lower it below its default.

Reading

Looks without changing anything. Runs at once.

Small things

Lights, scenes, drafts. Done at once, then announced.

Consequential

T2 · Asks first

Sending, posting, unlocking, deleting. Waits for an adult’s approval, stated in one plain line.

Irreversible

T3 · Asks first

The alarm, and money when it moves. Approval plus the owner’s passkey from the last two minutes.

Checked by name

Any tool whose name says send, pay, unlock, delete or the like must be at least T2. Two automatic checks fail the build otherwise.

Caps by caller

Children are capped at T1, guests at T0, Alexa at T1, and no AI app ever holds T3. Above its cap, a request becomes an approval, not an action.

A daily budget

By default no household runs more than 500 actions a day beyond reading. Routines and errands are approved once, at the tier of their riskiest step.

IV. The vault

Sealed item by item, opened one use at a time.

No endpoint and no tool returns a secret. The secrets API answers with descriptions only, and secrets are scrubbed from anything the browser’s AI sees.

The trust boundary, stated plainly: the database alone holds only ciphertext. With the service’s master key, a secret can be opened, which is how a connection keeps working while you sleep. Each opening is listed in a hash-chained record that can be verified end to end.

How a secret is kept

Household key X25519 key pair, one per space

Each item Its own key, XChaCha20-Poly1305

Sealing Ephemeral X25519 and HKDF-SHA256

Private key Wrapped under the master key, and under your recovery phrase

Recovery phrase Argon2id, 64 MiB, shown once

Record SHA-256 hash chain of every use

V. The AI

No prompt names a model.

Work is routed by slot, so any provider can fill any slot. The model we provide is the default and the fallback; your own key takes precedence wherever you set one.

Slots Router, assistant, planner, vision, embeddings

Provided Amazon Bedrock, London

Your own Anthropic, OpenAI, OpenRouter, Mistral, Gemini, Ollama

Fallback Per slot, if your provider fails or lacks tools or vision

Your keys Kept in the vault; usage shown, never billed

Before release Every AI feature is evaluated on three providers

VI. Voice

A pipeline, not a box on the counter.

The wake word and the voice detection run on the screen itself. Speech is streamed, answered and spoken back, and you can interrupt it at any point.

Wake word On the device, with Picovoice Porcupine

Listening Deepgram Nova-3, streaming, British English

Speaking ElevenLabs Flash, streaming

Interrupting Speak over it and it stops at once

Whose voice Picovoice Eagle, inside our service; voiceprints never reach a model

Several rooms The screen that heard you loudest answers; the others stay quiet

VII. Open standards

MCP in both directions, OAuth done properly.

Castald as an MCP server

AI apps connect through a full OAuth 2.1 server: metadata discovery, dynamic registration, PKCE S256 only, device flow, revocation, rotating refresh tokens. A grant acts as one member, under that member’s role.

Castald as an MCP client

Mount any MCP server. Tools it marks read-only run at T0, unmarked tools ask first, and destructive tools sit at T3. The owner may mark a tool read-only.

Signed, both ways

Your own tools receive an HMAC signature with every call. Inbound webhooks and Alexa requests are verified before anything is read.

VIII. Your data

Pinned to a region, and nowhere else.

A household’s region is set when it is created, in the UK or the EU. It is never taken from a request, and it does not change.

Database, files, AI, hosting London

Email The EU

Speech, voices, push Outside the UK and EU, under the UK transfer addendum, and only if you turn them on

Files at rest Encrypted, with a separate prefix for each household

Voice audio Not kept

Leaving Everything exported; deletion certified

IX. Reliability

Targets set in advance, and published.

Every service reports in every 30 seconds. A public status page says what is up, what is down and what is being done about it.

API target

99.9%

of requests answered without a server error, with 95 in 100 inside half a second.

Voice target

1.5 seconds

from the wake word to the first word of the answer, for 95 in 100 questions.

Recovery

Point in time

Database history that can be restored to a point in time, with a quarterly restore drill, and versioned file storage.

Web Next.js and React

Phone and tablet Expo and React Native

API and worker Hono and BullMQ on Node 22, Redis

Data Neon Postgres, Amazon S3, ClamAV

Hosting Northflank, London

Monitoring Prometheus and Grafana

A steward for the whole estate.

Tell us a little about your house and your business. We will be in touch.

Request access See how it works