Connected Systems, user-controlled integrations under PCHP

TL;DR: Connected Systems are the external applications, enterprise CRM systems, retail platforms, and productivity services granted secure, user-authorized access to your holdings under PCHP consent, and they live on your own data plane inside your pod: Hussh is the control plane that brokers each exchange but holds none of what flows through it.

Relations

• One
• PCHP
• BYOA
• Source Library
• Three-layer architecture

Overview

Connected Systems represent external third-party applications, enterprise CRM systems, retail platforms, and productivity services that are granted secure, user-authorized access to your personal knowledge graph. Managed through the central One Dashboard, this integration pattern shifts the authority over third-party integration from corporate silo databases to your own holdings.

Unlike traditional integration patterns (where applications silently synchronize database records in backend channels), Connected Systems use PCHP (Personal Consent Handshake Protocol) to establish explicit, cryptographic, zero-knowledge, duration-bounded handshakes for every exchange. Each Connected System is something you added and can revoke, not something a vendor wired into a shared database behind your back.

Where Your Integrations Actually Live

Every Connected System lives on your own data plane, inside your pod. Your private agent, One, runs in that pod: a small container in your own cloud (BYOC), with the keys that unlock your holdings on your own device (BYOK). The tokens, session state, and synchronized records for a Connected System are held there, next to the agent that uses them, and nowhere else.

Hussh is the control plane, not the custodian of your holdings. Hussh operates your pod on your behalf and brokers each exchange, but it holds none of your information. It keeps only public metadata (an identifier and your pod's public key), it relays sealed ciphertext between the parties to an exchange, and it authorizes consent. There is no Hussh vault of your records and no Hussh backup-of-record standing behind a Connected System. Plaintext exists only inside your pod and on your device. Everything the control plane and the network see is encrypted.

The durable backup of what a Connected System reads or writes is your own, in your own cloud, unlockable only with material that never leaves your device. Hussh is the enabler for the exchange, not the holder of what is exchanged.

The One Dashboard

The One Dashboard acts as the primary cockpit for your Personal Operating Layer. It is a secure, user-owned, Apple-frame-aligned web and mobile surface that:

• Summarizes active, pending, and revoked sharing across every Connected System.
• Provides a centralized view of all of your Connected Systems in one place.
• Hosts the Consent Audit Timeline, offering granular visibility into the exact times and reasons a Connected System read or wrote any of your personal records.
• Employs dynamic layout containers and pure-CSS responsive tables for absolute readability across desktop and mobile screens.

Because the dashboard is a control-plane surface, it shows you the shape of every grant (who, what, why, for how long) without the control plane ever needing to see the plaintext behind it.

Core Architectural Invariants

1. User-Held Secrets and Zero-Knowledge Encryption. The access credentials, session tokens, and encrypted external field state required to authenticate with a Connected System are encrypted on your device using Secure Enclave-backed keys or AES-256-GCM zero-knowledge envelopes, and held inside your own pod. The keys that unlock them never leave your device, so the control plane cannot read them even in principle.

2. PCHP Consent Bounds. A Connected System cannot pull or push anything without an active PCHP grant. Each grant is single-use, signed, scoped, and revocable, and it names the exact fields, the purpose (for example, personal shopping recommendations or a CRM contact lookup), and the expiration time of the exchange. The grant rides with the exchange; there is no standing, open-ended pipe.

3. No Direct Silo Sync. Third-party integrations reach your holdings through your own agent runtime on your data plane, not through corporate backend channels. Every synchronized record therefore stays subject to your own on-device policy, and the control plane only ever brokers sealed ciphertext between the endpoints.

4. Audit and Revocation. Every interaction is logged in your user-visible Consent Audit Timeline. You can revoke any Connected System instantly, which immediately purges the local integration caches inside your pod and tears down the remote token handshakes. Revocation is a first-class action, not a support request.

What This Means

Connected Systems are the practical shape of "Own your AI. Own your data. Own your compute." Your integrations run on compute you own, against holdings you hold, under grants you issue and revoke. Hussh makes the exchange possible and keeps it honest, and holds none of what moves through it. The control plane is the switchboard, your pod is the vault, and the two never trade places.

Sources

• Hussh Research Repository
• Public control-plane framing: Hussh is the control plane that brokers consented exchanges; your holdings live on your own data plane (BYOC) with keys on your own device (BYOK), and the control plane holds only public metadata and relays sealed ciphertext.