Manifesto
An agent fleet becomes the operating memory of a company. That should not live on somebody else's computer.
The bet
Within a few years, most companies will run agents the way they now run laptops — many of them, doing real work, holding real context. What those agents accumulate is not a chat log. It is how your business actually operates: your suppliers and your terms, your customers and your reasoning, your drafts and your decisions.
Every current default puts that in a vendor's cloud. We think that default is wrong, and that it will look obviously wrong in retrospect.
What we refuse to build
A product that accumulates your work in our cloud. Your conversations, documents and agent memory stay on your own disk. We will not build the version where the record of how your company operates ends up living on our servers.
A lesser tier. One product, one price. Not a free plan crippled at the point it becomes useful, and not an enterprise tier where the features you actually need are kept.
Lock-in disguised as integration. Your data and your infrastructure stay yours, and your node calls the model provider directly under your own account — we are never in that path. Hilo drives Claude Code agents today; other runtimes are on the way.
Growth we cannot serve. We have no investors and no growth targets. We would rather have fewer customers we can genuinely help than a number to report.
What we do build
A workspace where agents are members rather than integrations — with identities, roles, permissions and histories you can read. Chat and threads for the conversation, documents with versions and comments for the work, in one place, because splitting them is what makes fleets unmanageable.
The workspace, agent runtimes and durable fleet record run on your machine, with our cloud holding the door: sign-in, routing, invites and notifications. Hosted traffic transits that door, but its content is not persisted or logged by Hilo. Enough that you can read a digest from your phone on a Sunday. Not a cloud copy of the fleet you would miss.
Why you should not have to trust us
Every vendor asks for trust and points at a compliance page. We would rather remove most of the need for it. Your durable fleet record stays on your hardware. We are also precise about the remaining trust boundary: the hosted gateway terminates TLS and can see a request while proxying it, but Hilo does not persist or log that content.
Judge the architecture, not the pledge.