Technology
What the system is, in the order a sceptic would ask.
01The chain, in six stages
- 01
Human intent
“Home by eight.” A sentence, a calendar entry, a habit.
- 02Small and bounded
Constraint extraction
The language model turns it into explicit, bounded fields. This is all it does.
- 03
Explicit constraints
A deadline, a duration, a comfort floor, a hard exclusion. Readable by a person, checkable by a machine.
- 04The structural centre
Deterministic optimiser
The same window arithmetic as the demo, plus a thermal model and learned occupancy. No model in the loop.
- 05
Device orchestration
Commands go out through the manufacturers' interfaces, one home at a time.
- 06
Verification and fallback
Every command is checked against the constraints. If they cannot be met, the device runs as it would have without us.
02
Where the data comes from
Prices are day-ahead auction results, published per bidding zone. Carbon intensity is published per zone too. Both sources sit behind one interface in our code, so the same optimiser runs whether a zone is served by a public transparency platform or a commercial feed.
This site reads the public sources, which anyone can check. Our production system will also draw on commercial feeds from leading providers of market and emissions data. The agreements are ready, and they will be signed as we go into production.
03
Where the language model sits, and where it does not
The model does not choose when your heating runs. It converts unstructured input, such as a sentence, a calendar entry or a pattern in past behaviour, into explicit constraints: a deadline, a duration, a comfort floor, a hard exclusion. Those constraints go to a deterministic optimiser.
Keeping the model out of the control loop is a safety decision as much as an engineering one. An appliance in someone's home should not be driven by a system whose output cannot be bounded. Every action is checked against the constraints before it is issued, and the same constraint set explains the decision afterwards.
04
The optimisation
For a shiftable load, the decision is a window: which hours to run in, subject to being finished on time and not starting so early that the benefit evaporates. Scoring each candidate window on price and carbon and taking the minimum is enough to capture most of the available value, and it has the advantage that anyone can audit it.
Production adds what the demo cannot: a thermal model of the specific building so that pre-heating is physically justified, and occupancy learned over weeks rather than assumed.
05
Failure behaviour
If a data source is unreachable, the last known values are used and labelled as such. If constraints cannot be met, the load runs as it would have without us. The system never leaves someone cold to save money. The deadline is a hard constraint, and cost is what gets optimised inside it.
06
Data handling
Device control requires an authorisation the user grants and can revoke. Optimisation needs consumption and schedule data, not identity, and it runs per household rather than on a pooled profile. This page will carry the full data protection description before any pilot goes live.
07Security
We touch the grid. We behave like it.
We move kilowatt-hours.Anyone taking our place would move the same ones.So the place is small, bounded, and tested from the outside.
The diagram, read again as a security diagram
- 01Human intentby design
A sentence, an appointment, a habit. Nothing else comes in.
- 02Constraint extractionby design
The language model has access to no tool. Its output is a closed schema: a few fields, and nothing that is not a field.
- 03Explicit constraintsby design
The validation boundary rejects anything outside the bounds. An impossible deadline, a duration off the template, a contradicted exclusion: refused, and said.
- 04Deterministic optimiserby design
Same inputs, same plan, every time. Every decision can be replayed and read by a person.
- 05Device controlby design
Commands go through the manufacturers' interfaces, with limited access that the home grants and can withdraw. No firmware, no local network.
- 06Verification and fallbackby design
Without us, the device runs as before. And across the portfolio, starts are spread out: never every home at the same hour.
The two questions we are asked
If Agail is unavailable
by designThe device follows its original programme. It depends on us to do better, never to work.
If someone takes our place
by designThey can only move a load within the bounds a home has accepted. And never every home at the same hour.
Tested from the outside: Intuity
Intuity is a French offensive security company, founded in Paris in 2018. Penetration testing, configuration and organisation audits, cyber expertise. Its pentesters hold OSCP and CEH certifications; the company carries the France Cybersecurity and ExpertCyber labels.
Agail is in partnership with Intuity for the security of its software: penetration testing of the application, an audit of how data is handled, customer data included, and a cyber expert alongside us over time.
Its co-founder and chief executive, Maxime Labbé, is a partner in Agail. We say so.
Reports and attestations can be shared under a non-disclosure agreement.
Data
- We collect what it takes to decide: consumption, schedule, device state. Not identity.
- The optimisation runs home by home, not on an aggregated profile.
- A home withdraws our access at its device's manufacturer, at any moment. We stop commanding that instant.
- Hosting location, retention periods, subprocessors: details available on request, under a non-disclosure agreement.
Incidents
- Every command is checked against the constraints before it leaves, and logged after.
- A deviation triggers the fallback: devices follow their original programme while we look.
- A customer is told about an incident that concerns them, with what we know and what we are doing.
- Threat model, development lifecycle, incident procedure: in the pack, under a non-disclosure agreement.
Energy suppliers are essential entities under NIS2 and must assess the security of their providers. This section and the pack under a non-disclosure agreement are built to answer that assessment.
Questions
Where is the data?
The hosting location, the retention periods and the list of subprocessors are in the pack under a non-disclosure agreement, with the full description of how data is protected. What we keep: consumption, schedule, device state. Not identity.
What is the most you can do to a device?
Shift the moment it runs, within the bounds the home has accepted: a deadline, a duration, a comfort floor, a firm exclusion. Nothing else. No firmware, no settings, no local network.
What happens if you are unavailable, or compromised?
Unavailable: the device follows its original programme. Compromised: a command cannot leave a home's bounds, and starts stay spread out across the portfolio. The place we occupy is small by design.
Can the language model send a command?
No. It has access to no tool and produces only a closed schema of constraints. That schema crosses a validation boundary, then a deterministic optimiser decides. The model never touches the switch.
Have you been penetration tested, and by whom?
We are in partnership with Intuity, a French offensive security specialist carrying the France Cybersecurity and ExpertCyber labels: penetration testing of the application, an audit of how data is handled, a cyber expert alongside us. Reports can be shared under a non-disclosure agreement.
How does a home withdraw your access?
At its device's manufacturer, by revoking the authorisation it gave us, or by asking us. Either way we stop commanding that instant, and the device goes back to its original programme.
Report a vulnerability
Write to us at contact@agail.fr. We acknowledge receipt and keep you posted until it is fixed.
We take no action against good-faith research that respects households' data and leaves us the time to fix.
Our security.txt08Our advantage
And when there are millions of us?
If millions of homes receive the same signal and react the same way, the cheapest hour becomes the new peak. Our control engine orchestrates the fleet as a whole: every home keeps its savings, without the sum of those optimisations putting the market or the grid under strain. The method that allows it is the heart of our intellectual property, set out under a non-disclosure agreement.
See the chart