EDGE AI FABRIC BY WILDCARDTECH

Schema in, JSON out.

Your web application sends a document and a JSON schema. A trusted Mac in your organization answers with data that matches exactly that schema. Processing happens on the device — not in a cloud, not with us.

Talk to an engineer ↗ Get the Code

Apache 2.0 · On-device · macOS · End-to-end encrypted

SchemaYour application

// The schema is the contract.
const Invoice = z.object({
  invoiceNumber: z.string(),
  amount:        z.number(),
  currency:      z.enum(["EUR", "CHF"]),
});

Read on a trusted Mac · end-to-end encrypted

ResultThe device

{
  "invoiceNumber": "INV-2026-0417",
  "amount": 1234.56,
  "currency": "EUR"
}

Evidence /amountpage 1 · “… 1.234,56 EUR …”

For each field, Edge AI Fabric also delivers the evidence: the page and the passage the value was taken from. If none is found, the field is explicitly marked as unverified. The invoice values are illustrative.

01 — Why on the device

Why not just a cloud API?

The documents don't leave the building.

An invoice, a contract, a job application is read on a Mac in your organization. There is no data processing agreement covering content, because nobody but you has the content.

No cost per page.

The compute is already in your building and sits idle most of the time. Edge AI Fabric turns it into your execution layer.

The shape is guaranteed.

What comes back from a cloud API looks like the format you asked for. What comes back from Edge AI Fabric is that format — every time.

02 — Promises

Four promises.

The schema is the contract

Your application says which shape it needs. What comes back has that shape. A state machine built from your schema decides, before every generated token, what can continue a valid result: a wrong key, text instead of a number, an unknown enum value cannot occur. The result is validated once more before it is sent anyway.

Why it mattersAnyone processing language model output writes half their code for the case where the answer looks different than expected. That case goes away.

Strictly on the device — and end-to-end encrypted

Content is processed on the end device and leaves it only encrypted. In between sits a Relay that brokers, enforces policies and keeps logs — but technically cannot read the content. Input, schema, instruction and result are ciphertext. The Relay sees sizes, timestamps and error codes, even when we operate it. There is no plaintext mode, not even as an option.

Why it matters“We protect your data” is a promise. “We cannot read it” is a property.

Nothing without consent

An application can only find a device once the person at the device has consented — with graduated rights: only while they are watching, also in the background, also for others in their organization. The consent is signed by the device. Revocation takes effect immediately.

Why it mattersThe difference between “your company laptop computes for someone” and “you decided for whom”.

Five classification levels, cryptographically enforced

From public to restricted. The Relay doesn't just check who is allowed to compute — per-level keys ensure that a misrouted job is unreadable rather than merely unwanted. The highest level is never processed on the platform.

Why it mattersIn most systems, classification is a label. Here it is a lock.

* Measured, not claimed

Four figures from real runs.

What they cover and what they don't is stated alongside.

0 %loss across 5,999 jobs in the load test, including a Relay restart mid-job
4 msfrom job to a device's offer, p95 — the target was 500 ms
0schema violations across two test corpora
2.5 sfrom invoice to form fields, on an M4 Max

Field accuracy on two test corpora: 95.8 % and 100 %; line-item tables: 93 % and 98 % of cells. The shape is guaranteed — content accuracy is a measurement we report for your documents, not a promise.

* As of 25 Aug 2026 · every figure is on record in the repository as a test or an end-to-end run

03 — Who it is for

Who it is for.

SaaS providers with document-heavy workflows

Incoming invoices, contracts, applications, inbound mail. You want to offer an AI feature but may not put your customers' documents in a cloud. With Edge AI Fabric you offer it without ever holding them.

Companies and public authorities with Mac fleets

Compute on hundreds of devices that sits idle most of the time — and documents that may not leave the building. Existing hardware becomes your execution layer; classification is enforced, not just documented.

Agencies and freelancers with several clients

One machine, several clients, strictly separated worlds. A single Mac works for several organizations that learn nothing about each other — each sees it under its own fingerprint.

04 — At the device

For the person at the device.

You are not a target group in the sales sense. But nothing runs on your Mac without your consent, so this is where we tell you what happens on it.

What runs on my Mac?: An app in the menu bar, the Companion. It accepts jobs, runs them on the device and sends the encrypted result back. You see which organization is asking and what is running.
Who is allowed to do what?: Nobody you haven't consented to. For each organization, you decide whether jobs run only while you are watching, also in the background, or also for others in your organization. Every consent is signed by your device.
How do I stop?: Withdraw consent. Revocation takes effect immediately; open connections are no longer served.
What about my keys?: The device key lives in the Secure Enclave and never leaves the chip. Access tokens are stored in the macOS keychain. If you work for several organizations, each has its own device identity — visible in the settings, not just claimed.

05 — For developers

The call in ten lines.

The return type follows from the schema.

extract.tsTypeScript

const Invoice = z.object({
  invoiceNumber: z.string(),
  amount:        z.number(),
  currency:      z.enum(["EUR", "CHF"]),
});

const { data, fields } = await edge.extract({
  inputs: [pdf],
  schema: Invoice,
  classification: "CONFIDENTIAL",
});

data.amount;                 // 1234.56
fields["/amount"].evidence;  // { page: 1, text: "… 1.234,56 EUR …" }

extract: Structured data according to a schema, with evidence for every field.
generate: Free text with streaming — token by token, each chunk encrypted individually, delivered as a Server-Sent Event.

A job consists of input, schema and deadline. Jobs are idempotent and survive a restart of the Relay. Every brokering decision hangs in a signed chain.

06 — Security and operations

For security and operations.

Encryption: HPKE per RFC 9180, implemented independently in Go, Swift and TypeScript and verified for byte-equality in both directions. No plaintext mode.
Identity: Signing and key agreement in the Secure Enclave. Only a reference is stored, which is useless on any other Mac. This protects against the identity being carried elsewhere — not against someone operating the Mac.
Levels: Five classification levels from PUBLIC to RESTRICTED. A device without approval for a level receives no key for it. RESTRICTED is never processed.
Tenant separation: An organization is one Relay deployment. A Mac that works for several organizations faces each one under its own device identity. If one Relay fails, the Mac keeps working for the others.
Audit: Consents, brokering decisions and model manifests are signed and chained. The Relay logs sizes, timestamps and error codes — no content.
Model distribution: Models are distributed once via your Relay instead of once per Mac. The manifest is signed by the publisher; the device verifies size and digest itself, including against its own Relay.
Self-hosting: The Relay runs in your infrastructure. It does not need to read the content in order to broker — and it cannot.
Data protection: Built on in-house processing and end-to-end encryption. The Relay processes metadata only — sizes, timestamps, error codes — and you run it yourself.
License: Apache 2.0

07 — Limits

Limits that are part of the product.

The highest level is never processed.

RESTRICTED stays outside the platform. For HIGHLY_CONFIDENTIAL, the Relay requires device security confirmed by device management — a self-assessment by the device is not enough.

There is no plaintext mode.

Not for diagnostics, not on request.

It does not replace cloud AI everywhere.

Edge AI Fabric is built for document-based tasks that may not leave the building. Where an on-device model is too small, the path to a larger model stays open — through an architecture that allows the switch.

PlatformsMac today. Linux workers for the pool and Windows devices are in preparation.

08 — Talk to us

Documents that may not leave your building — and you still want structured data from them?

We will show you Edge AI Fabric on your own schema — and tell you the measured accuracy for your documents.