Evidence Report · Software Valuation

Curo

Privacy-first encrypted email platform — full webmail, external account sync (Gmail / IMAP / Outlook), native calendar & booking, zero-knowledge E2EE messaging, AI triage & voice intelligence, Ad Studio, and LemonSqueezy billing. Deployed live at curomail.com.

$2.1M – $5.3M Traditional build cost
·
27.3 person-years Engineering effort
·
Built in ~5 weeks Calendar span (Jun 14 – Jul 18, 2026)

The Defensible Quartet

Traditional Build Cost

$2.1M – $5.3M

Low: $2,089,125  ·  Mid: $3,683,250  ·  High: $5,278,500
What a normal web-software shop charges to plan, architect, and build a product of this scope.

Engineering Effort

27.3 person-years

Mid estimate, two independent models in agreement (productivity model + COCOMO II post-architecture). Represents the human capital compressed into a ~5-week sprint.

Team & Schedule Replaced

~18 × 18.6 mo

18 engineers working for ~19 months — the conventional staffing to produce this output on a normal delivery schedule.

Build Speed

~17× faster

Shipped in ~5 calendar weeks vs the 18.6-month conventional schedule. No corners cut — 49 regression tests, 717 test runs, 218 defects tracked.

The Real Number

27.3 engineering-years delivered under 1 operator — the sustained ~18-person team you'd otherwise staff, run by one person supervising Steve. ~17× faster than the conventional 18.6-month schedule.

0 incidents — every action backed up, owner-scoped, approval-gated

Traditional cost avoided: $2.1M – $5.3M (supporting figure — the headline is the leverage, not the dollar).

The Hard Evidence — no estimates, counts straight from git and the codebase

Source: git log, cloc, project console DB — reproducible on demand.
Code (LOC, non-blank, non-comment) 100,751
↳ Python 71,806
↳ HTML 22,755
↳ JavaScript 28,945
↳ CSS 5,019
↳ JSON / config 5,161
↳ Docs / specs 2,681
Files 541
Git commits 552
Distinct edit-days 27
Lines inserted / deleted 122,658 ins  /  19,036 del
Real calendar span 2026-06-14 → 2026-07-18  (5 weeks)
Contributors 1
Defects tracked / resolved 218 tracked  /  145 resolved (67%)
Regression tests 49 tests
Test runs (total) 717

What's Actually in It — feature enumeration from the source

Multi-tenant AI chief-of-staff for email — triages every inbox message, surfaces only what needs the user, drafts replies in the user's own learned voice, layered with a security / relationship / commitment intelligence stack. FastAPI + SQLAlchemy 2.0 · 65 model classes · ~90 internal routes · 83 test files · 44 SEO landing pages. Pre-launch, targets curomail.com.

Triage & Voice Engine

  • AI triage — classify_email() scores 1(critical)–10(ignore), assigns category, drafts reply when warranted (ported from AK's proven single-tenant categorizer — "the moat")
  • Deterministic pre-AI filters kill junk (bounces, mailer-daemon, phishing lures) at zero token cost before any LLM call
  • Voice Engine — deterministic linguistic analysis (sentence length, greeting/sign-off habits, contraction/emoji rate, formality, hedging vs directness, recurring idioms) from actual Sent mail, then feeds an LLM
  • Voice Card, voice constellation/map/insights, tells, scenarios, sample-reply, OG share card
  • Per-relationship voice classification, shareable public voice pages
  • Curo's LLM calls run on Curo's own metered key — hard-separated from any internal subscription session (ToS-compliant by construction)

Reply Drafting & Compose

  • Reply / send / compose endpoints
  • Forward-with-a-note

Narratives

  • Turns a mailbox into story arcs with a true chronological per-arc timeline
  • Backed by a full-history both-directions reader (distinct from the Voice Engine's recent-Sent sample)

Inbox Mechanics

  • Triage inbox / bulk / thread / stats (42 routes in the single largest route file)
  • Snooze, archive, bundle / group senders
  • Collections — folders / labels
  • Contact autocomplete with index rebuild
  • Daily digest (+ test-send)
  • Server-side search

Mailbox Connectivity

  • Gmail REST (OAuth, no google-api-python-client dependency)
  • Microsoft Graph (no msal dependency)
  • Generic IMAP — any standard mail server
  • All funneled through one ingest service — decrypt → fetch → dedup → triage → persist, fully tenant-scoped
  • Backfill-history import with eligibility check
  • Per-mailbox signatures, mark-read policy, keep-unread

Calendar & Meetings

  • Provider-blind connector framework — live Google (incremental syncToken) + Microsoft (delta link) connectors
  • Generic CalDAV — iCloud / Fastmail / Nextcloud, no app registration
  • Unified calendar_events table with per-account overlay color (Outlook-style)
  • Native events + reminders, external multi-account sync
  • Meetings / Calendly-style bookable links + .ics invites (7 routes)
  • Booking pages
  • PLANNED (roadmap C2–C4, plan-gated, not built) — accept/decline invites, create-event-from-email, conflict detection, scheduling reply drafts, mutual free-slot proposals, pre/post-meeting AI briefs

Security & Privacy Stack

  • Fernet (AES-128-CBC+HMAC) EncryptedString column — OAuth refresh tokens, IMAP/SMTP passwords, voice snippets encrypted at rest (23/23 real creds verified decrypt clean)
  • Zero-Access Vault — Tier-2 crypto: per-user data key wrapped by a passphrase-derived KEK (scrypt); server cannot decrypt once client-side WebCrypto lands (honestly disclosed as not-yet-complete)
  • End-to-end encrypted secure messages + Trust Center — Proton/Tutanota-style zero-knowledge send, revoke, public token view
  • OpenPGP mail-to-mail encryption to a contact's public key (Power+ gated)
  • 2FA — TOTP (RFC 6238) + recovery codes + WebAuthn hardware keys
  • E2EE keypair exchange for Curo-to-Curo auto-E2EE
  • Deterministic prompt-injection heuristic runs on every inbound email pre-LLM, feeds a SecurityFlag table for an owner-only "proof of N real attempts" view
  • HTTPS-only, TLS1.2/1.3, HSTS, Cloudflare-fronted, full security-header set
  • Postgres localhost-only, scram-sha-256, non-superuser role

AI Relationship-Intelligence Sweeps

  • Ghosting Radar — detects sent-last-no-reply threads; dismiss / draft-followup / snooze
  • Commitment Ledger — single-source extraction of promises from mail, auto-fulfillment detection across every reply/forward/send and every incoming mail; LLM spend only fires on a plausible match; Notification integration
  • AI Screener — first-contact gate (HEY-style): approve / block unknown senders before the inbox
  • Private Auto-Unsubscribe — scan + one-click, privacy-preserving (no list-server ping exposing the user)

Billing (LemonSqueezy)

  • LemonSqueezy Merchant-of-Record — never touches card data
  • Free / Pro ($18, 5 mailboxes) / Power ($44, 8 mailboxes) / Team ($24/seat)
  • Quantity-priced add-ons
  • HMAC-SHA256 webhook, fails closed
  • Plan→feature gate table; owner never downgraded by a billing event

Team Workspaces

  • Membership, roles (owner / admin / member)
  • Shared triage rules steering every member's classification

Signup Risk / Abuse Gating

  • Wave-1 local checks + Wave-2 scored risk tier

Owner Console

  • AK-only cockpit (47 routes)
  • Live spend by provider / model / operation via a granular per-LLM-call UsageEvent ledger
  • Unit economics — cost/user, cost/mailbox, cost/1k emails, margin projections
  • Tenant drill-down, technical health (broken mailboxes, stale syncs, cache)
  • Config panel — hard-gated server-side AND at nginx

Ad Studio & Marketing

  • Owner-only ad-cut CRUD + export (13 routes) + MP4 render pipeline
  • Presentation Editor for the live front-page walkthrough
  • Landing-page A/B test with server-side funnel
  • Founder Codes / invites admin

Demo & Onboarding

  • One-click per-plan demo accounts (real code paths, seeded/neutered)
  • Onboarding wizard lead capture, waitlist, support/contact intake

Planned — Localization

  • PLANNED — en / es / fr / fr-CA / pt-BR / uk, model-routed per locale; RTL scoped; Russian gated behind AK's personal decision given Kharkiv history — plan only, not built
  • PLANNED — native per-country mail infra deferred

How We Costed It — methodology

Model. The same model with the same constants is applied to every project in this portfolio — there are no per-project complexity multipliers and no schedule compression applied. The generator is console/backend/tools/evidence_merge.py.

Low bound. Productivity model — 100,751 lines of production code ÷ 25 finished LOC per developer-day ÷ 21.7 work-days per month = 185.7 person-months (15.5 person-years). The 25 LOC/day figure is the conservative industry baseline for finished, tested, reviewed code (McConnell, Code Complete); it excludes generated scaffolding and build artifacts.

High bound. COCOMO II post-architecture — PM = 2.94 × (100.75 KLOC)1.0997 = 469.2 person-months (39.1 person-years). Applied nominally, with no effort-adjustment multipliers, so the ceiling is not inflated.

Mid (reported). The arithmetic mean of the two models: 327.4 person-months = 27.3 person-years. This is the figure quoted throughout this report.

Rate assumption. $135,000/year fully-loaded blended developer (salary, benefits, overhead) = $11,250 per person-month. Applied uniformly to all three effort bounds: low $2.09M, mid $3.68M, high $5.28M.

Calendar. Git-verified: 2026-06-14 → 2026-07-18 = 1.1 months of real calendar. COCOMO's schedule equation gives the calendar a conventional team would need: TDEV = 3.67 × 327.40.28 = 18.6 months at a sustainable 17.6 engineers. Speed advantage = 18.6 ÷ 1.1 = 17.0×.