Tenet·Feature Guides 02 · On-Device Architecture ← All guides
Guide 02 · The Foundation

On-Device Architecture

Tenet does the sensitive work inside the student's browser, before any prompt reaches an AI vendor. This single design choice is what makes the privacy story, the speed, and the pricing all work. Learn to draw it on a whiteboard.

Architecture, all tiers
↓ Download the one-pager (PDF)
What it is

The work happens on the Chromebook, not in our cloud

Tenet installs as a managed Chrome extension. When a student types a prompt or uploads a file, the cleaning, the rule injection, and the safety checks all run locally, in the browser, in a few milliseconds. Only the cleaned prompt continues to the AI vendor, and only sanitized, categorical analytics ever reach Tenet's backend. The raw prompt text is never sent to us.

The data flow

Three layers, one picture

🧑‍🎓 Student
types a prompt or opens an AI tool
🛡️ Tenet, in the browser
block unapproved AI · scrub data · inject rules · safety check
🤖 AI vendor
receives only the cleaned prompt
↩️ Reply re-rendered
real names restored locally on screen
📊 Backend / district storage
receives only sanitized, categorical analytics

The backend stores district configuration and sanitized analytics. It does not store raw prompts or AI responses, because they never leave the device.

Layer 1 · The browser

Where all the sensitive processing happens: PII redaction, name pseudonymization, the ML safety classifiers, rule injection, and the block-or-allow decision.

Layer 2 · Tenet backend

Configuration, not content. District rules, roster (Pro), and sanitized analytics. No raw prompts or responses.

Layer 3 · District systems

Google Workspace for identity, CSV or roster providers for class lists (Pro), and the district's own analytics destinations.

Why it matters

Three buyer hooks fall out of one decision

Privacy that survives a worst-case question

If a buyer asks “what happens if Tenet gets breached?”, the answer is that student prompts cannot be exfiltrated from our servers because they were never there. That removes roughly half of a standard vendor security review before it starts.

Speed with zero proxy latency

There is no cloud round-trip in the path. The checks run on the device in a few milliseconds, so students do not feel a slowdown and the experience matches using the AI tool directly.

Economics that let Basic be free

Our backend cost scales with the size of a district's roster, not with how many prompts students send. Prompt volume is essentially free to us because it is handled on the device. That is why we can give Basic away and still run very healthy margins on Pro.

Memorize this
“Student prompts and AI responses never leave the student's browser to reach Tenet.”
What the backend does and does not hold

The data-ownership story, plainly

DataWhere it lives
Raw student promptsOn the device only. Never sent to Tenet.
AI responsesOn the device only.
District rules and configurationTenet backend (so devices can sync the latest policy).
Roster (Pro)Tenet backend, district-isolated.
AnalyticsSanitized and categorical only. Can ship to the district's own storage (Google Sheets, S3, GCS, webhook).
Student names in analyticsHashed or redacted before capture.

For the IT director, the headline is simple: analytics are district-owned, and Tenet does not store student data on its own servers. Each district is isolated from every other district at the database level.

Who it sells to

Lead with the right person

Director of IT

No infrastructure to deploy, prompts never reach our servers, and per-district isolation is enforced in the database. This is the section of a security review that usually causes friction, and here it largely disappears.

Superintendent

The defensible posture: the district can adopt AI without handing student prompts to another vendor's cloud.

CFO / Business office

Predictable pricing that scales with students, not usage, so a successful rollout does not produce a surprise bill.

Common questions

FAQ

If processing is on-device, what is the backend even for?
To deliver the latest district and class rules to every device, hold the roster for Pro features, and collect sanitized analytics. It is the control plane, not a content pipe.
Does on-device mean it works offline?
The governance runs locally, but using a cloud AI tool obviously needs internet. The point is that Tenet adds no extra network hop of its own.
How do devices get updated rules?
They sync periodically (more frequently on Pro), using an efficient check so an unchanged policy is almost free to fetch.
Honest limits

Say this before they ask

Where to set expectations

  • On-device today means Chrome (managed Chromebooks and Chrome on managed Windows). Other browsers and native mobile apps are not covered yet. Edge is on the roadmap.
  • Because we deliberately do not see prompt content, Tenet does not offer a central transcript archive of every prompt. That is a feature, not a gap, but worth stating for buyers who expect server-side logs.
Keep reading

Related guides