hushworks

An AI agent that helps first-time founders find a storefront, check it against city records, and contact the landlord, without ever seeing their private financial details.

Comment 1

Here's the updated "About the project" text with the Prior work section removed. In Devpost, select everything in that field, delete it, and paste this:

## Inspiration
Walk down Mission Street and you'll see papered-over windows everywhere. Many people who already live here, including a lot of immigrants, look at those windows and think: *what if I opened my bakery there?* Then they hit a wall. City records are scattered across a dozen sites, grant programs open and close without notice, and every AI tool that offers help wants your savings, revenue and ID numbers first, while reading listings and web pages that anyone can write.

We asked: **can an AI agent do real work for a founder without ever holding the secrets it's supposed to protect?**

## What it does
**Hushwork** guides a first-time founder from "I have an idea" to "I know what to do next":

1. **Describe your idea in your own words.** "A chai spot with a bookstore and a clothing store" becomes a live search of San Francisco's business registry for *chai*, *bookstore* and *clothing*. No forcing your idea into a category.
2. **Pick neighborhoods** on a 3D map (Day / Night / Aerial), or let Hushwork suggest them, always showing the rule it used. It's not a ranking.
3. **Compare neighborhoods in plain English**, using real city records. Rent, foot traffic and vacancy are shown as **unknown**, because no public data exists, so we don't guess.
4. **Check a storefront's claims against city records.** At 2234 Mission St, the broker says "available now"; three business registrations with no end date say *check first*. One click opens zoning, permits and planning records for that exact lot.
5. **Money and help.** Verified grants, loans and free help (SF.gov grants and loans, Kiva, Working Solutions, which includes ITIN holders, La Cocina, SF SBDC), a private budget slider, and a citywide rent estimate from a published market report.
6. **Your 5 next steps**, including questions to bring to a qualified immigration adviser. Hushwork never decides eligibility.
7. **Let the AI contact the landlord, safely.** Claude investigates and drafts the inquiry. You approve the exact message.
8. **Ask Hushwork**: a chat guide grounded in the same tools.

## The privacy architecture
Rather than asking an AI to keep secrets, we built the system so it never has them.

- **Private vault:** budget, revenue, SSN and lease status live in trusted server code. Claude only sees placeholders like `{{max_monthly_rent}}`.
- **Egress gate:** deny by default. Each placeholder is checked against grants scoped to *field × recipient × purpose × expiry*. Destinations come from a server registry, so the agent can't invent one.
- **Exact-message consent:** approval is bound to a SHA-256 hash of recipient + purpose + the exact text. Change one character and the send is blocked. Single use.
- **Private eligibility checks:** grant rules run in trusted code; the AI only learns ✓, ✗ or ?.
- **Redaction:** dollar amounts and ID numbers typed into the chat are hidden before the model sees them.
- **Audit log:** every decision is recorded with field names only, never values.

**The attack test:** a second listing hides an instruction telling the AI to send the founder's SSN and max rent to a stranger. In our live run, Claude ignored it, but we don't rely on that. We also attack the gate directly. Result: **0 secrets in the AI's context, 0 messages reach the attacker.**

## How we built it
Node.js and Express, the Claude API (tool use), MapLibre GL with OpenFreeMap tiles and Esri imagery, and DataSF (Registered Business Locations, Building Permits). Rent context comes from the Kidder Mathews SF Retail Market Report (Q3 2026). Every program and contact was verified by hand from official pages on Oct 22, 2026.

**70 automated tests**, including a live test against Claude, cover authorized sends, injection, recipient/purpose/expiry/revocation bypasses, one-character payload edits, approval reuse, and "no vault value ever appears in model context or logs."

## Challenges
- **Honesty versus usefulness.** The easy version invents rent, foot traffic and "walk scores." We refused: every number links to its source, and missing data says *unknown*.
- **Messy public data.** Wrong column guesses, throttled APIs, and business names that don't match a category. We switched to searching the founder's own words.
- **Model refusal is not security.** A model ignoring an injection is luck; the gate blocking it is design. The UI reports the two separately.

## What we learned
Privacy for AI agents is an architecture problem, not a prompt problem. And for first-time founders, the most valuable thing an AI can say is often *"we don't know that yet, and here's how to find out."*

## What's next
Full city records for every storefront, help filling out grant applications, revenue estimates only from verified local data, and separate sessions per user.

## Inspired by
Simon Willison's dual-LLM pattern and Google DeepMind's CaMeL research on defending agents against prompt injection.

Built With

Share this project:

Updates

Submission history