Know what you just promised, before you hit send.

Regulators have issued fines totalling over $3B since 2021 over how business communications were kept and supervised. That figure is worth stating once and then setting aside, because almost none of what sits behind it was malicious.

The ordinary version is much smaller and much more common. Someone types a promise they are not authorised to make, in a thread with a customer in it, and nobody notices until it is a contract dispute. The sentence took four seconds to write. Everything slow and expensive that follows is downstream of those four seconds.

Most tooling in this space works after the fact, by capturing and reviewing messages that have already been sent. That is genuinely useful for keeping records, and it is no use at all to the person who is about to send one.

The useful moment is the few seconds before the message leaves, and what makes it useful is knowing who the recipient is. We guarantee your data never leaves the US is loose shorthand between two colleagues who both know how the deployment is configured. Sent to a customer, the same sentence is a commitment. A check that cannot tell those two situations apart has to either stay quiet in both or speak up in both, and neither is worth having.

Second Thought sits under the composer and says nothing at all until a sentence is worth a second thought. When one is, a card appears with the rule in plain language, the reason that phrasing is risky, and suggested wording you can take with one click or leave alone. Nothing is ever held back from sending, and the suggestion is offered rather than applied.

The gesture that explains the product takes about two seconds: switch the recipient from your own team to a customer, leave the draft exactly as it is, and watch what it flags change. Try it in this browser, which is the only place it runs.

A scan runs in stages, cheapest first. A context gate decides which rules apply to this recipient at all. A deterministic stage then runs patterns and literal terms over the raw draft; it needs no model, so the page is already doing something useful in its first second while the rest is still downloading. Only then does the semantic stage run, and a rule fires there only when a cue phrase is present, no negation governs that cue, and the sentence clears that rule’s similarity threshold against its examples.

All three conditions are needed, and the reason is measurable rather than theoretical. Mean-pooled embeddings encode topic and vocabulary far more strongly than stance, so we cannot guarantee your data never leaves the US scores 0.978 against the data-residency examples while the actual promise scores 0.964. Similarity on its own would put a card under the most careful sentence in the draft, at maximum confidence.

Two models, with two different jobs. Detection is a 22MB sentence encoder, downloaded once and kept in your browser cache, whose only task is to turn a sentence into a vector that can be compared with a handful of examples. Rewriting is a much larger generative model with a task the encoder cannot do: phrasing the suggestion in your voice instead of the rule’s. It loads in the background, and its absence changes nothing you can see, because the reviewed wording is always there.

Detection uses a small encoder rather than a generative model because it has to run at every pause in typing, where a comparison against a few vectors costs milliseconds and asking a generative model for a judgement costs seconds. Measured so far: 21.9 MiB for the encoder file, and roughly 2 ms to embed a three-sentence batch on a CPU backend. First load on a cold cache has not been timed on a fresh machine yet, so there is no number for it on this page.

This is a design constraint rather than a feature that was added later, and the reasoning below is about why this product is built this way. None of it is a claim about anyone else’s software, and none of it is legal advice.

Section 7 of the NLRA protects most private-sector employees discussing pay and working conditions. Regulators have at times pressed for heightened scrutiny of monitoring technology on that basis; the specific NLRB General Counsel guidance from 2022 was rescinded in 2026, and enforcement posture here moves with each administration, which is exactly why we did not want the architecture to depend on it.

In Germany, §87(1)(6) BetrVG gives a works council, where one exists, co-determination over technical devices for monitoring behaviour or performance, and German case law reads capability rather than intent as the trigger. Under EU and UK data-protection law, monitoring employee messages is the kind of processing supervisory authorities treat as likely high-risk, so a DPIA is normally required, and employee consent is a weak basis because of the power imbalance.

None of that is a policy you have to take on trust. The site is a set of static files, its content security policy permits connections to this origin and nowhere else, and the model weights are served from this domain alongside the page, so the network tab is the entire audit: after the one-time download there is nothing further to see.

• No console. There is no view where a manager, an administrator, or we could read what you typed. That is not a permission left switched off; the surface does not exist, and nothing is transmitted that could fill one.
• No telemetry of any kind. No analytics, no crash reporting, no counters. The status line under the composer counts network requests made after the checker is ready, and it reads zero because there is nothing to send.
• Eight rules rather than eighty. Every additional rule is additional surface for false positives, and false positives, rather than missed detections, are what get a tool like this switched off in the first week.
• No holding anything back. It advises and never refuses, and the send button never waits on a model. The reviewed wording is offered first and a generated version second, never preselected, because a suggestion that applies itself has stopped being a suggestion.

Eight rules ship in the demo. Six of them apply only when the recipient is outside your company, which is what makes the recipient switch mean something; tone and language apply everywhere, because how a sentence lands does not depend on the domain in the address.

The same checks inside the tools teams already use

The composer on this site is a demonstration surface. The intended form is a browser extension, with the model staying inside the extension and the draft never leaving the page it was typed on. The ceiling is worth naming in the same breath: that layer advises, it is bypassable, and going from advice to enforcement would mean a managed-browser integration rather than a content script. We would only build that for someone who asked for enforcement rather than coaching.

Policy authoring, with a precision harness in front of it

Writing a rule should not be the same act as switching it on. The next version measures a candidate rule’s false-positive rate against a sample corpus before it can go live, which today is a build technique and belongs in the product.

A distilled, task-specific classifier

A smaller model trained for this exact task, with confidence-based escalation for ambiguous sentences, would be faster and more accurate than similarity against examples. It is not in this version for a plain reason: training only on synthetic data generated by a teacher model bakes in that model’s blind spots, and offline evaluation then flatters you because the test set is synthetic too. The gating requirement is a human-adjudicated gold set drawn from real drafts, and that does not exist on day one.