Trove
Clean-room institutional knowledge for AI agents.
Trove helps teams turn private work context into governed AI knowledge: personal assistance for source owners, sanitized team knowledge for everyone else, and explicit retrieval boundaries for chat and MCP agents.
Source-owner controlled
Personal, team, and blended retrieval
Default chat mode
Blended answer with quiet provenance underneath.
Private context
Sanitized team
Policy proof
The hard part is not search. It is earning permission.
The most valuable knowledge lives in personal work context: account history, implementation lessons, stakeholder nuance, and small discoveries that never become official documentation. Trove makes that knowledge useful without making it broadly inspectable.
For employees
Source owners preview what Trove keeps, what it discards, and what it would publish before opening a source more broadly.
For organizations
Admins get policy evidence, remediation controls, and key options without private-source browsing or productivity dashboards.
Built first for teams whose best answers are trapped in the field.
Sales Engineering, Solutions Engineering, support, and product teams accumulate the highest-value operational knowledge in private or semi-private channels. Trove gives that knowledge a path into AI systems without flattening every conversation into a searchable company archive.
Reuse similar objections, integrations, and product gotchas.
Agents can retrieve sanitized patterns from previous customer work while keeping account names, people, commercial terms, and private context behind the proper boundary.
Let a source owner ask about their own current work.
Private context can answer named-deal or named-account questions for the person who connected it, without publishing those details to the team corpus.
Give MCP tools a safer knowledge layer to expose.
Trove's personal, team, and blended scopes let assistants call the right retrieval boundary instead of relying on broad enterprise search or raw source chunks.
One assistant. Three explicit trust boundaries.
The MVP starts with a basic chat interface and matching MCP scopes: personal, team, and blended. Users can ask naturally while Trove keeps retrieval boundaries visible in the product and precise in the policy layer.
User question
What can I reuse from similar customers without exposing my account?
Combines the user's private account context with approved team patterns. The normal answer stays conversational; hidden provenance records which scopes were used.
Uses raw private details only for the authenticated source owner. It cannot publish those details back into the team corpus.
Uses sanitized artifacts, safe redacted traits, and raw team sources only when the requester is authorized. Follow-up suggestions are collaboration routing, not employee analytics.
Sanitization is a publication gate, not a redaction pass.
Trove publishes derived knowledge artifacts, not cleaned-up copies of private messages. The default source mode is sanitized sharing to the team; raw sharing is always explicit.
Connect Gmail
Sign-in stays separate from data-source consent. A user can connect multiple accounts under one Trove identity.
Preview a small batch
Owners see original excerpts, sanitized candidates, relevance calls, and entity replacements before broad ingest.
Filter for purpose
The clean room keeps business-relevant artifacts and discards personal, transient, embarrassing, or dignity-risk content.
Hide entities and traits
Customers, people, domains, titles, and accounts become linked redacted traits instead of raw identifiers.
Attack the result
White-hat agents try to re-identify private context in preview, pre-publication, and high-risk answer assembly.
Publish current artifacts
Approved artifact versions enter the team index with provenance, policy versions, and remediation paths.
Proof attached to every shared artifact
- Publication mode and source-owner consent
- Sanitizer and pipeline profile version
- Redacted entity and role traits
- Source evidence reference without raw access
- Privacy validation and remediation status
- Immutable provenance for generated answers
What Trove refuses to become
Employee monitoring, manager mailbox search, productivity scoring, raw private-source browsing, or a compliance backdoor into originals.
Trust claims backed by proof artifacts.
Trove is designed so security reviewers, admins, and source owners can verify the promises: sign-in is not data access, admins cannot read private sources, sanitized team knowledge is derived, and answers remain grounded.
Source-owner control
Each source has a per-pipeline policy: no_share, default sanitized_team, or explicit raw_team. Owners can revoke access and remove derived artifacts.
No private admin browse path
Team and org admins manage policy, connectors, validation, and remediation without receiving private-source read access.
Three authenticated MCP endpoints
/personal, /team, and /blended expose explicit retrieval scopes with hidden provenance on every answer.
CMK and private data plane options
Customers can use Trove-managed storage, customer-managed keys, or a future customer-owned data plane for higher-trust deployments.
Pilot path from trust model to agent-ready knowledge.
- Identity and consent Google sign-in, multi-account linking, source consent ledger, source ownership, and per-pipeline publication mode.
- Gmail preview ingest Recent limited batch, Gmail-style filters, private attachment handling, and source-owner before/after review.
- Clean-room sanitizer Relevance, dignity protection, entity hiding, trait extraction, white-hat validation, artifact versioning, and team publication.
- Chat, MCP, and transparency Personal/team/blended chat, three MCP endpoints, source-owner dashboard, admin evidence view, and policy proof tests.
- Enterprise hardening CMK, audit export, rollback/reprocess, operational trust runbooks, additional connectors, and private data plane support.
Questions Trove should answer before anyone connects a source.
A clean-room knowledge product needs to be understandable before it asks for trust. These are the lines Trove is designed around.
Is Trove employee monitoring software?
No. Trove rejects productivity scoring, manager mailbox search, raw private-source browsing, and silent organization-wide access to employee communication.
What does Trove expose to AI agents?
Authenticated personal, team, and blended retrieval scopes. Team access uses sanitized knowledge artifacts unless raw sharing was explicitly authorized.
Who is Trove for first?
Sales Engineering and Solutions Engineering teams with field expertise spread across email, Slack or Teams, CRM notes, call transcripts, support escalations, and product gotchas.
What is the canonical Trove site?
The canonical public product site is trovepipeline.com. vanRoojen LLC is the publisher, but Trove is not a vanroojen.com subdomain or internal product page.