How it works
The mechanism, with the numbers left in.
The home page makes the claims. This is where each one is cashed: one thread walked message by message, every gate an inbound email passes with its real constant, what the numbers can and cannot tell you yet, and what Decize refuses to build.
One thread, start to finish
What an email thread turns into.
Four messages in a thread nobody treated as special. On the left is what people actually sent. On the right is what the record did about it — including the message that decided nothing.
01 · in your inbox · 12 Feb · 09:14
priya@acme.com
data residency — Helsinki can’t sign
The Helsinki team can’t sign until records sit in the EU. Renewal is 30 June, so if we’re moving we decide this month.
new_decisionconfidence 0.84Opens a record and drafts it from the message.
- Title · “Move our customer data region from US to EU”
- Owner · Priya R. — resolved from the sending address
- Deadline · 30 Jun · Status · Pending
- Reversibility · one-way door (AI read, correctable in one tap)
Replies once into the thread: logged, with the title, owner and date it read.
02 · in your inbox · 12 Feb · 09:31
dev@acme.com
Re: data residency — Helsinki can’t sign
Sounds good — adding it to Thursday’s agenda.
noneconfidence 0.22 · below the 0.6 floorLogged against the thread and dropped. No record changes.
- Nothing written to the ledger — this message decided nothing
Stays silent. Decize only speaks when something actually changed.
03 · in your inbox · 14 Feb · 16:02
marc@acme.com
Re: data residency — Helsinki can’t sign
Migrating now is the call. I’ll sign off — but dry-run the export first, I don’t trust the two-hour estimate.
updates_existingpatches the record this thread already openedUpdates the same record instead of creating a second one.
- Summary · rewritten to the agreed course
- Assumption · “export fits one maintenance window” · falsified if a dry run runs over 4h
- Sign-off · requested from Marc L.
Already replied to this thread inside 24h, so it stays quiet.
04 · in your inbox · 3 Mar · 11:47
priya@acme.com
Re: data residency — Helsinki can’t sign
Dry run took five hours. We’re not making the June window — reopening this.
updates_existingchangeKind · reversedFlips the record back to Pending. The reversal is recorded as a reversal.
- Status · Decided → Pending
- The reason a decision changed is what the analytics later count
- The original frame stays locked — it is not rewritten
Replies: reopened.
Nobody in that thread opened Decize. The outcome arrives the same way: when the decision is due, the owner gets an email whose buttons record how it went in one tap. What you are left with is the record — the thread stays in your mail client, and Decize keeps a copy of each captured message alongside the decision it produced.
Spam, abuse, and your data
An open inbox is a liability. This one isn’t open.
Handing a product your email is the moment you should get suspicious. So here is the whole mechanism: what it takes to get a message in, what happens to it, and what Decize will and won’t do with it.
What a message passes through, in order
Every gate below is enforced in code today. The numbers are the real constants.
- reject unsigned
Signature
Verified against a signing secret over the exact bytes received, before anything is parsed.
- 8 characters
Address token
The capture address carries a secret token. Retired tokens work for a grace period, then stop.
- default deny
Sender
Already on your roster? Accepted. Everyone else — including someone whose domain you allowlisted — is refused and reported to the owner.
- owner tap
New senders
A domain match queues a first-time sender for approval. It never admits them — an owner adds them with one tap, and nobody joins your roster without it.
- no loops
Machine mail
Auto-replies, out-of-office autoresponders, bounces and Decize’s own replies are dropped before triage.
- 200 / day
Volume
A hard ceiling on how many messages one workspace will accept in a day.
- 0.6 floor
Is it even a decision?
Below the confidence floor, or structurally unusable, nothing is written at all. Precision over recall.
- same thread
Scope of a reply
A reply can only patch the decision its own thread opened — it cannot be steered at another record.
- 20 / day
Decize talking back
Silence is the default: only on a real change, at most once per thread per day, and the owner can switch it off.
Your organization is the boundary
Threads and messages are scoped to one organization inside Postgres, not by application filtering, so the rule holds for a direct API call too. No client can insert or edit them — captured mail is written server-side only. Every active member of that workspace can read it; nobody outside it can.
What Decize actually keeps
The cleaned message and the original text, stored against the decision that message produced — so months later you can see what was really said, not just the summary. Each message is keyed by its own Message-ID, so a provider retry or a second forward of the same mail cannot create a duplicate decision.
Links in our emails are bound, not guessable
The one-tap buttons we send — record an outcome, add a sender, adjust a setting — carry a signature bound to one organization, one action and one person, and it is verified before anything is written. Forwarding the mail does not hand your workspace to whoever receives it.
You can shut the door
Rotate the capture address and the old one stops working after its grace period. Remove someone from the roster and their mail stops being accepted — their next message does not quietly reinstate them. Turn off replies and Decize never writes into a thread again. None of that needs us.
Two things we will not dress up. Decision text — including the captured message — is sent to an AI provider (Anthropic, with Google as a fallback) to be read and summarised; that is how the drafting works, and our privacy policy names the providers. And inside a workspace there are no private messages: every active member can read the ledger and the captured mail behind it. What is fenced is the organization, not the individual.
Decize also can’t be turned into a spam cannon on your behalf: it replies only when something changed, never more than once a day per thread, never more than twenty times a day for a whole workspace, and an owner can silence it completely.
What accumulates
Some of this works on day one. Some of it takes months.
Every row below says what it needs before it means anything. A number that would identify one person is withheld rather than shown.
Decisions per week, outcome distribution, one-way against two-way doors
raw counts — useful from week one
Median days from capture to decided
from your first decided call
Why decisions changed — planned revisit, new information, an assumption that did not hold
needs after-action reviews
Recurring themes across recent decisions, written from your own ledger
needs a handful of decisions
Loop health: outcome closure, on-time execution, owner coverage
each rate stays blank below five
Forecast calibration — Brier score, skill against the base rate, a reliability plot
needs five resolved forecasts; this one takes months, and it is the most honest number in the product
Outcome-closure run chart with shift and trend signals
needs about ten weeks of steady capture
Full ledger and activity log as CSV, and a system-health card telling you whether the automation itself is still running
available from day one
What Decize refuses to do
There is no surveillance layer in here.
A decision ledger is one bad product decision away from becoming an employee-monitoring tool. These are the refusals that keep it from becoming one.
No per-person scores, ever.
No leaderboard, no individual quality score, no “who hasn’t logged anything” list, no manager drill-down into one person’s record. The per-member analytics screen was deleted, not hidden.
Rates stay blank until they are anonymous.
Any rate that could be traced back to one individual is withheld below five data points. The dashboard shows a dash instead of a number, on purpose.
The dashboard cannot read your decisions.
Every number, chart and digest is computed from a database view that has no title column, no summary column and no message body — so a reporting bug cannot leak decision text into a chart.
Isolation is enforced by the database.
Row-level security scopes every read and write to organizations you are an active member of. It runs inside Postgres rather than as application filtering, so it holds for a direct API call too.
The AI is labelled, never authoritative.
Every generated read is captioned as Decize’s read and not a source of truth. A value alignment stays an estimate until a person confirms it, and a confidence the model inferred from a message does not count toward calibration until a human owns it.
Leadership gets the aggregate, and the email says so.
The weekly rollup to owners and managers carries organization-level counts and minimum-sample rates only, and prints that promise inside the message.
One thing to be straight about: inside a workspace there are no private decisions. Every active member can read the whole ledger, including the original message text, and the full member roster. Decize is shared organizational memory — what it refuses to build is a reporting layer pointed at individuals.
Three roles: members capture and read the ledger; managers also get the dashboard, analytics, the roster and workspace settings; owners hold role changes and the workspace itself.
Before you hand it to procurement
What your legal team will ask.
Answered here rather than three emails into an evaluation — including the ones where the answer is “not yet”.
- Where does our decision text go?
- To Anthropic for the feature you asked for, with Google Gemini as a fallback provider, and nothing else goes with it — we do not attach unrelated workspace content to a request. Related-decision embeddings are generated inside our own Supabase infrastructure rather than sent out. The full sub-processor list is Supabase, Vercel, Anthropic and Google, and Resend for mail; it lives on the privacy policy and that page is the authority, not this one.
- Does Decize train anything on our decisions?
- No. Decize operates no model of its own and runs no training pipeline — your records are read to answer a request and that is the end of it.
- How is our workspace separated from anyone else’s?
- By Postgres row-level security, which scopes every read and write to organizations you are an active member of. It runs inside the database rather than as application filtering, so it holds for a direct API call and not only for our own screens.
- Who inside our organization can see what?
- Every active member can read the whole ledger, including the original captured message and the full roster. Managers additionally get the dashboard, analytics, the roster and workspace settings; owners hold role changes and the workspace itself. There is no private-decision mode, so treat the ledger as an internally public document.
- Can we get our data out?
- Yes — the full ledger and the activity log export as CSV, and the ledger is permanent on every plan including Free. Dropping off a paid plan does not remove anything.
- Are you certified?
- No. No SOC 2, no penetration test, no bug-bounty programme. We are a beta product and we would rather you priced that in now than found out during a security review.
Two things we deliberately do not claim on this page: whether our model providers train on API traffic, and a signed data-processing agreement or a choice of region. Both are real questions and neither has an answer we are willing to print before it is true. Ask us where we are with them — contact.
Where Decize is today
Early, and specific about it.
Email capture
Live — your workspace’s own capture address is in its settings — and new. We are bringing the first workspaces on by hand.
Time to value
Counts, queues and the attention list are useful from your first decision. Forecast calibration needs five resolved forecasts. The run chart wants a few months of steady capture. We would rather say that here than have you find out in week two.
Certifications
We have not been audited. No SOC 2, no penetration test, no bug bounty. Our security page says plainly what we do and do not do.
Customers
None to name yet. There are no logos on this site because inventing them would undermine the one thing this product is for.