Horizon Intelligence is hosted infrastructure for groups working towards a shared objective. Your members’ data belongs to them. The map they compose is yours to act on.
A member’s data stays theirs, across every cycle of the engine — and beyond it. If a hub is decommissioned, you retain the collective intelligence of the group, and each member leaves with an export of their personal journey and the value they’ve built with their Personal AI.
The map is built from what members chose to reveal, at the level they set. You act on the aggregate truth of your network — the shape of the whole, never a file on any one person.
The map is only as good as the information that feeds it. The architecture guarantees privacy for your members — so each one can explore their position and their ideas in confidence, one-to-one and in their own words. The sections below are the machinery behind the guarantee.
A member’s conversation happens between the member and their Personal AI — a private thinking partner of their own. The sensitive account — where a member is stuck, what they’re planning, what they need — is captured in that private channel and held there.
The privacy boundary sits between a member’s private conversation and the collective position of the network. It holds structurally: each member’s records are locked to that member, and the part of the engine that produces the collective intelligence is sealed off from individual records. What reaches the group is set by two controls — the member’s reveal level, and the hub’s ceiling above it. Privacy here is enforced by the database.
The reveal ceiling
Everything a member says is analysed in private, with their own Personal AI — and in full, because that is what makes the intelligence worth having. What each member decides is how much of their personal circumstances they reveal to the rest of the hub. They set that once, on a simple scale — their reveal level — applied evenly across everything they share:
Full anonymity. Their contribution shapes the map, with nothing publicly visible attached to them.
Anonymised position. Peers see what they’re working on, what they bring, and where they’re heading — everything personally identifying withheld.
Open to being named. Who they are, person and organisation, revealed only to peers who have chosen to be equally open.
And at the close of each module they can fine-tune what leaves: holding back specific elements, asking for a rewrite, or adding to what they have said.
The reveal layer is mutual, and that is deliberate: openness is what unlocks openness. A name becomes visible only where two people have each, independently, chosen to be open to it — an overlap the engine finds where it already exists, never a request one member sends another. Each member sees others exactly as deeply as they let themselves be seen — so the hub rewards everyone for being as open about themselves as they are curious about others.
Every hub is founded with a ceiling: the most any member can ever be asked to reveal. Every member’s own reveal level lives inside it. It is fixed once and permanent — once founding closes it cannot be reopened or raised again by anyone, yours included. When you tell your members what the hub will ask them to reveal and the control they have over their data, the architecture keeps your word.
Some groups are convened around subjects where privacy is the first condition. An organisation supporting people through difficulty, whose members’ trust depends on never being identifiable. An investor’s portfolio, where companies speak plainly to the fund that backs them. A change engagement, where people say how it’s really landing inside the hierarchy they work in. For hubs like these, the ceiling is set at full anonymity at the founding: every member contributes in full, the map composes in full, and identity is never on the table — not even by a member’s own offer. The group gets the whole value of the engine, with privacy held as primary for every member.
Hubs are designed to run in many languages: the engine aggregates in a neutral, language-independent layer, applies its privacy protections there, and only then renders the collective intelligence into each reader’s language — so every reader, in every tongue, sees the same protected map.
And the ownership is literal. Each hub is a complete, self-contained instance of the engine, born whole from the same specification: its own architecture, its own database, its own walls, built for your group in its entirety. Everything it holds serves your group alone — and every other hub in the world stands inside walls of its own.
The privacy boundary holds at the deepest layer of the system: member records locked to their owners; the intelligence layer structurally sealed away from individual rows; the hub’s reveal ceiling held immutable from its founding. Each guarantee is a property of the schema — and of the specification itself, so every hub arrives carrying them.
Every output of the engine carries its audit trail. A member’s conversation becomes structured, comparable evidence through an end-to-end derivation — from words, to position, to aggregate map — and every step of that path is defined and leaves a record. Every reading in the map carries its provenance: a consented contribution, at the level the member chose to share. And every core component — the extraction, the clustering, the collective-intelligence layer, the privacy boundary — was built and exercised component by component, with repeated blind verification, ahead of the whole.
The record behind these claims: Origin →
Every protection on this page is built into the architecture of your hub. Each member’s record is locked to that member alone. Each member sees their own, and the collective position of the group, and chooses what they reveal. Questions about how it is engineered belong in the first conversation, with a Horizon Intelligence operator.
Start with a conversation
