+
+
SECURITY & DEPLOYMENT

Your perimeter. Your rules.

ARI is self-hosted and its source code is available, so security is verifiable, with an architecture open to inspection. Defense-in-depth from the database up, deployed wherever your compliance requirements demand.

SELF-HOSTED SOURCE CODE AVAILABLE RUNS FULLY LOCAL AI INTEGRATED
DEPLOYMENT

Deploy where your compliance lives

01

Personal Computer

Run ARI locally on your own Mac, Windows, or Linux machine. Your workspace and your data live on hardware you can touch.

02

On-premises

Deploy to your own hardware in your own data center. Ideal for regulated industries with strict residency rules.

03

Cloud

Deploy to Vercel or your own cloud account — AWS, GCP, Azure — inside your existing network controls, IAM, and monitoring.

CONTROLS

Everything your security review will ask for.

The full security architecture lives in the source-available core — inspect every layer before you trust it.

Layered Data Isolation

Per-request user scoping in the app, backed by RLS policies on every Postgres table.

Hardened Authentication

TOTP two-factor auth, Argon2id password hashing, and rate-limited login endpoints.

Audit Logging

API and key-usage logs built in, with a dedicated Audit Logging module on Team plans.

RBAC & Permissions

Admin and user roles with per-account permissions for users, modules, settings, and API keys.

Bring Your Own Models

Choose OpenAI, Anthropic, Gemini, or OpenRouter — or keep it fully local with Ollama.

Data Export & Backups

Export, verify, and restore your entire database — scheduled backups included.

Encryption & Hashing

TLS at your edge, Argon2id for passwords, AES-256-GCM for stored API keys.

Source Code Available

Inspect, audit, and extend the entire codebase. No black boxes.

DATA FLOW

Know exactly what leaves

Every request stays inside your boundary: your reverse proxy, your app servers, your database, your model endpoints. There are no third-party analytics and no vendor with a key to your data. The only phone-home is a small startup telemetry ping — one Settings toggle turns it off, and the source is available so you can verify all of it.

01Requests terminate at your proxy — TLS keys never leave your infra.
02User scoping enforced on every request, backed by RLS policies on every Postgres table.
03AI calls route only to the providers you configure — cloud APIs, local Ollama, or none at all.
YOUR PERIMETER
YOUR VPC / ON-PREM
REVERSE PROXY · TLS
ARI APP · RBAC
POSTGRES · RLS
YOUR MODELS
NO THIRD-PARTY ANALYTICS · NO VENDOR KEYS · TELEMETRY YOU CAN TURN OFF

Put your security team
in the driver's seat.

Audit the code, run it in your own perimeter, and verify every claim on this page yourself.