Architecture and data flow
A plain reading of how Sloane turns wearable and workspace signals into one useful prompt, and what the system deliberately refuses to keep.
Stateless ingestion
Vendor data arrives, tokens are sealed, nothing is linked to a name.
Computation core
Two independent scores, one physiological, one behavioural.
The latent gatekeeper
The reasoning layer sleeps until both scores agree something is wrong.
Domain clustering
Individual use surfaces a team pattern, never a person.
Four stages, one decision
Sloane reads two things: how your body is holding up, and how your working day is moving. Each is measured separately, on its own scale, and neither leaves a trail of raw content behind it.
The reasoning layer stays asleep. It only wakes when both readings agree that something has shifted, and even then it can suggest, never act on your behalf.
Data arrives sealed and unnamed
Vendor connections run on two lanes. Some providers push updates as they happen, others are polled on a quarter-hour cycle. Both land in the same place: an encrypted token record that carries no identity.
Endpoints that accept webhook payloads whenever a value changes, for example a daily sleep summary from a ring.
Scheduled workers that pull chunked readings every fifteen minutes from high-frequency telemetry sources.
Access and refresh tokens are sealed with AES-256-GCM under a master key held in a managed key service.
Each record is keyed by an anonymous identifier. No relation links a token block to a real name or profile.
Two scores, measured apart
Tier one learns your own physiological baseline. Tier two reads the shape of your working day without ever storing what you wrote.
Raw metrics feed a time-series model that keeps a personal baseline, refreshed on a fourteen-day exponentially weighted average.
The system compares the standard deviation of the last hour against that baseline and maps the result into a single unitless anomaly score, 0.00 for settled through to 1.00 for heavy strain. Raw readings are flushed from memory as soon as the score exists.
Workspace hooks read calendars, channels, documents and repository events. The text itself never reaches storage. It lives in memory for a fraction of a second, long enough to count pace and friction, then it is destroyed.
Payload arrives
Calendar, channels, repositories, documents
Volatile memory only
Disk, cache and database writes are blocked
Token count matrix
Velocity and lexical friction extracted
Pointer nullified
Raw characters wiped inside 100 milliseconds
Two factors survive: velocity, meaning interactions completed per minute, and friction, meaning lexical density. Both are folded into one anonymous score on the same 0.00 to 1.00 scale.
The model sleeps until both agree
Running a language model continuously is expensive and noisy. Sloane keeps the reasoning layer dormant behind a strict logic barrier, so it speaks rarely and only with cause.
Move either score below the line and the pipeline terminates quietly. Nothing is generated, nothing is shown, and no tokens are spent.
Gate open, the coach speaks once
Both scores clear 0.70, so a single structured prompt is composed.
{
"user_secure_id": "902d18f4-66c3-4c92-bf3e-d6363a033f52",
"action_required": "RENDER_USER_PROMPT",
"payload": {
"system_status": "CRITICAL_STRAIN",
"biometric_variance_score": 0.78,
"workspace_friction_score": 0.82,
"proactive_text_intervention": "Your recovery is below baseline and your work pace is climbing. I can draft a note to move your alignment sync.",
"execution_options": [
{ "id": "opt_execute_deferral", "action": "POST /api/actions/defer" },
{ "id": "opt_dismiss", "action": "TERMINATE_SESSION" }
]
}
}The agent holds no write permissions. It cannot change a record or touch a workspace endpoint until you confirm the action in front of you.
One person at a time, then a team
People arrive on their own. When enough colleagues from the same organisation are active, the pattern becomes visible at a structural level, without exposing anyone individually.
Domain isolated from the address after the @ symbol.
Consumer domains such as gmail.com never form a cluster.
Three or more active colleagues marks the domain as a qualified lead.
Once a domain holds three or more active people it is flagged as qualified. That flag permits aggregated, high-level capacity signals for the group, and nothing more. Individual scores are never shared upward.
What the system refuses to do
These are constraints in the architecture, not policy promises.
No message content is stored
Workspace text exists in volatile memory only, and is wiped inside 100 milliseconds.
No identity in the token vault
Credentials are keyed by an anonymous identifier with no relation to a profile.
No silent action
Every suggestion requires explicit confirmation before anything is executed.
No manager-level surveillance
Only aggregated capacity signals are ever surfaced to an organisation.
No always-on inference
The reasoning layer runs only when both independent scores clear the threshold.
If this is the sort of system you want to help shape, we are running a small design cohort.
Apply to the design cohort