How Nellie is built: architecture and security of your family agent

By Erik Hope September 25, 2026

Nellie is a family assistant. Everyone in the household can reach Nellie by email or text, and together they can work on lists, projects, calendars and more on the household's home page. Nellie also keeps a calendar and sends reminders, so everyone stays on the same page.

Assistants that read email and browse the web will eventually come across something hostile, like a message written to trick them or a web page with instructions hidden in it. This is known as prompt injection, and stopping the models powering Nellie from ever seeing this type of content is impossible, so instead we focus on preventing Nellie from doing anything harmful. For our Nellie households, that means:

• Only members of a household can talk to their Nellie. Texts from unknown numbers are dropped, and email from a stranger waits until the household's main contact approves the sender.
• Nellie only sends email and texts to household contacts unless specifically authorized. For contacting others, Nellie sends you the text of a proposed email for you to allow, deny, or request changes. The model is not involved in this approval path.
• Each family's data lives in its own container and folder, and no other family's Nellie can open them.
• Code that Nellie writes never runs on our servers. It runs in a separate sandbox in the cloud with no internet access.

Where each part runs

Nellie's logic lives in two main places: core and a set of cloud services. Core owns a family's memory, and it reads and responds to messages. It runs on our servers, in one container per family.

Each family's container gets its own network and, through Linux namespaces, its own private view of processes and files. The one folder from our servers that's mounted inside is that family's data folder. Core itself only ever gets one family's settings and data folder, chosen by our control tools, so a bug in core can't mix up two families' data.

SELinux adds a second, independent layer of separation. Docker gives each family's container its own private SELinux label and stamps the same label on that family's data folder. The Linux kernel checks those labels on every file access, so one family's container can't open another family's data folder. Every family gets a different label, and no family's container is exempt.

The cloud side has three separate parts:

• Home, the family web app, which also routes incoming email and texts.
• A real web browser that Nellie drives when a task needs a website.
• An isolated code sandbox for calculations and data work.

The browser handles untrusted content from the internet, so it runs in isolation, away from the family's files and keys.

Home

Home is where messages from households come in. Every incoming email or text relays through Home to core over a signed WebSocket. Since core only ever connects out, nothing on the internet can reach it directly, and every incoming message reaches it over that one connection to Home. Text messages are verified as coming from our SMS provider and matched to household members' numbers, and incoming email senders are authenticated using our email provider's SPF, DKIM and DMARC verdicts.

The browser

Each family gets its own browser in a dedicated cloud container. The browser can't see the family's files and has no administrative keys. Core only receives accessibility and metadata snapshots from the browser container, never the page itself. Every link that Core tries to open via the browser or fetch with its fetch tool is provenance checked: it either needs to be a search result or a link which was provided to Core through an authorized channel like email or SMS or search-cli. Links which do not come from an authorized source are rejected. Core controls its browser with signed requests that only work once, using a key that is scoped to that household only.

The code sandbox

When Nellie runs code, a dedicated container starts for that one job and is destroyed when the job ends. The sandbox has no internet access and runs with no special privileges.

What the AI model sees

To answer a message, Nellie sends it to an AI model along with the context it needs: the recent conversation, the notes Nellie keeps for the household, any lists or calendar entries the task calls for, and the household's names and contact details, so it knows who is who and how to reach them. Our model providers are under terms that prohibit training on what we send, and the models run in the United States. All of our model providers operate under zero data retention (ZDR).

Limiting what Nellie can do

Keeping keys out of Nellie's reach

The tools that send email and texts need keys to do it, and those tools run inside the family's container, so their keys are there too. These keys are scoped to that household and they sit in the family's data folder, one level above the workspace where Nellie works. Nellie has no command line, only its small tools, and its file tools refuse any path that leads out of the workspace, including paths that try to sneak out through shortcuts.

Small, single-purpose tools

Nellie can only act through small tools that each do one job, like sending an email, updating a checklist, searching notes, or fetching a web page. The tools run without a command shell, so stray punctuation in a request can't turn into a second command.

Other questions parents ask

Can one household member see another's conversations? Yes. Everything in a household is shared by design, which is why Settings asks you to add only people you fully trust. Anello is for the adults in a household, and our terms ask families not to give children access.

Can Anello staff read family data? Access to the systems that hold message content is limited to the people who need it to run the service, as our privacy policy says.

Is it encrypted? Yes, in transit and at rest. Everything on our own servers is encrypted on disk.

What about senders the main contact approves? Approving an outside sender lets Nellie read emails from that person and nothing more. Nellie can't reply to them or email them unless a household member approves the message, they don't become household members, and every limit above still applies to what their messages can make Nellie do.

Why it's shaped this way

This is how we keep the valuable parts and the risky parts in different places. Every connection between them is narrow and checked in code. None of the pieces are exotic or complex, and each one is simple enough to check on its own. Nellie will always see some untrusted input, and someone may still trick it into saying something wrong. The limits above keep that from turning into harm.

If you have questions about how Nellie handles your family's information, read our privacy policy or write to security@anello.co.