ARI is self-hosted and its source code is available, so security is verifiable, with an architecture open to inspection. Defense-in-depth from the database up, deployed wherever your compliance requirements demand.
Run ARI locally on your own Mac, Windows, or Linux machine. Your workspace and your data live on hardware you can touch.
Deploy to your own hardware in your own data center. Ideal for regulated industries with strict residency rules.
Deploy to Vercel or your own cloud account — AWS, GCP, Azure — inside your existing network controls, IAM, and monitoring.
The full security architecture lives in the source-available core — inspect every layer before you trust it.
Per-request user scoping in the app, backed by RLS policies on every Postgres table.
TOTP two-factor auth, Argon2id password hashing, and rate-limited login endpoints.
API and key-usage logs built in, with a dedicated Audit Logging module on Team plans.
Admin and user roles with per-account permissions for users, modules, settings, and API keys.
Choose OpenAI, Anthropic, Gemini, or OpenRouter — or keep it fully local with Ollama.
Export, verify, and restore your entire database — scheduled backups included.
TLS at your edge, Argon2id for passwords, AES-256-GCM for stored API keys.
Inspect, audit, and extend the entire codebase. No black boxes.
Every request stays inside your boundary: your reverse proxy, your app servers, your database, your model endpoints. There are no third-party analytics and no vendor with a key to your data. The only phone-home is a small startup telemetry ping — one Settings toggle turns it off, and the source is available so you can verify all of it.
Audit the code, run it in your own perimeter, and verify every claim on this page yourself.