Your problem stays yours.

ThinkerWave Engine is a desktop application that runs locally. Your problem, the description, the spreadsheets, the documents you attach, lives on the machine you install it on. With your own model key (BYOK), model calls go only to the AI provider you configure, using credentials you hold, so your data goes to that provider and never to us.

Two options work differently, and we would rather say so plainly. On a Managed plan, the model calls go to the managed models we provide, so the content of those calls passes through ThinkerWave. The free browser version runs in ThinkerWave’s cloud. For sensitive work, use the desktop app with your own key.

A run is orchestrated on your machine. The engine reads the data you point it at from local disk and writes its output there. The model inference itself runs on the provider you configure, under your own credentials, so the substance of your problem goes to that provider and is never transmitted to ThinkerWave.

This is a deliberate design choice for the institutions ThinkerWave Engine is built for, where the decision itself is sensitive, and "who else can see this" is part of the risk.

The engine calls large language models using API credentials that you provide and store locally. Those calls go to the provider you configure, and only there, over the provider’s encrypted API. You keep the account, the spend visibility, and the ability to revoke access at any time.

How that provider handles the content of API traffic is governed by your agreement with them, not with us. We recommend choosing a provider and plan whose data-handling terms match the sensitivity of your work.

Every run keeps a complete record of what the engine tried, what it discarded, and why. That trail is stored with the run, on your machine, it exists so your own team, reviewers, or regulators can audit the reasoning. It is a feature for your governance, not a channel back to us.

thinkerwave.ai is served over HTTPS. The site collects what you enter into the contact or team-access forms, which is transmitted over TLS to our own submission endpoint, recorded, and emailed to us. When you click a download button, the site records which platform you chose and which button you used, with no cookie and nothing that identifies you. The site sets no advertising or analytics trackers. See the Privacy page for the full detail.

ThinkerWave is early. We make no formal certification claims here, no SOC 2, ISO 27001, or similar attestation, because we have not completed those audits, and we would rather say so than imply a status we have not earned. If your procurement process needs specific security documentation, ask us directly and we will tell you plainly what we can and cannot provide today.

If you discover a security issue in the product or this website, email security concerns to vikas@thinkerwave.com with enough detail to reproduce it. We will acknowledge responsibly reported issues and work with you in good faith to resolve them. Please do not publicly disclose an unresolved issue.

This page will be updated as our practices evolve. Last updated 31 August 2026.