Maranode runs AI models on your own servers and automatically generates the compliance evidence your auditors need — GDPR, HIPAA, SOC 2, and more. Nothing leaves. Nothing goes undocumented. Fully open source and free to use.
Designed for environments where running AI on sensitive data requires proof, not promises. If you run GDPR, HIPAA, or SOC 2 audits — this is what your auditor will ask for.
Patient data never leaves the machine. Per-department workspace isolation, AES-256-GCM encrypted RAG store, HIPAA access log exports, crypto-shred on patient data deletion requests.
Client matter isolation with separate encryption keys. GDPR Article 30 records auto-generated. Article 17 deletion with signed certificate. Legal hold controlled by compliance officer, not IT.
Air-gapped inference for trading, risk, and regulatory data. Data classification enforcement (PUBLIC / CONFIDENTIAL / RESTRICTED / PHI). Microsoft Purview, Forcepoint, Symantec DLP connectors.
ISO 27001 event logs, TPM 2.0 PCR-bound keys, TEE detection (Intel TDX, AMD SEV-SNP). Attestation report available to remote third-party auditors via signed API endpoint.
Models approved through a gated registry before the daemon will load them. Air-gapped token transfer for offline approval. Behavioral baseline checks against known-good model vectors on every load.
Splunk TA, Elastic ingest pipeline, Microsoft Sentinel KQL rules, IBM QRadar AQL — ready to deploy. Tamper-evident signed events, not best-effort logs.
Ollama and LM Studio are excellent tools for running models locally. They are not built for proving, to an outside auditor, what happened. These are the features that make that possible.
Every answer carries a signed Ed25519 receipt binding the model SHA-256, input hash, output hash, quantization, decode parameters, and a timestamp. A standalone binary maranode-verify checks any receipt offline with no daemon required. A third party can verify with Python and no Maranode binary at all. This turns "we say the answer came from this model" into a cryptographic fact.
Every workspace has its own AES-256-GCM key (DEK). Honoring a GDPR Article 17 request destroys the DEK — ciphertext on disk becomes mathematically unreadable with no disk scrub. A signed deletion certificate is written into the HMAC chain and exportable as a one-page compliance document.
A compliance officer holds a keypair separate from IT. Placing a hold freezes an audit segment — nothing can prune or modify it. Releasing the hold requires the compliance officer's signature. IT alone cannot lift a hold. This survives a regulatory investigation.
The daemon re-probes its own egress posture on an interval and writes each result into the audit chain. If isolation cannot be confirmed, the runtime refuses inference and records why — so the air-gap timeline is provable for the whole audit period.
SHA-256 proves the weights are unchanged; a behavioral baseline goes further. It runs signed known-answer test vectors on every model load and compares outputs. A model modified to behave differently on trigger inputs fails the check. Drift is recorded; the runtime can refuse to serve.
Ships with a Splunk Technology Add-on, Elastic ingest pipeline, Microsoft Sentinel KQL rules, and IBM QRadar AQL. The differentiator is what you feed the SIEM: signed, HMAC-chained events. Tampering is detectable before the event ever reaches your SIEM.
A model must be submitted, reviewed, and approved before the daemon will load it. Signed approval tokens transfer across an air gap as files. Revoke any time and the event is recorded. No model runs without an explicit signed token.
Workspace keys, audit HMAC keys, and admin credentials can be sealed to TPM 2.0 PCR policy — they only materialize when the machine runs the expected state. Intel TDX and AMD SEV-SNP are detected automatically; prompts and responses can be encrypted at the API layer.
Declare an incident, end active sessions, and freeze the audit log cryptographically in one command. A forensic snapshot captures runtime state. Break-glass credentials are single-use, force a mandatory audit event, and are the only path to emergency access.
Features marked in green are exclusive to Maranode — not available in any other local AI runtime. All features below are implemented and working in the current release unless noted.
base_url, existing code worksPOST /v1/embeddings, OpenAI shapeaudit replaymaranode audit isolation-report — full probe history with time boundsmaranode verify network + iptables -L + tcpdump, no Maranode trust requiredmaranode audit backup / restore with workspace logsGET /v1/attestation/report for binary hash + PCR + chain statusaudit verify-sourcesbreak_glass_used audit eventmaranoded + maranode CLI; no Python, no database server, no sidecarscatSIGHUP or maranode admin config-reload, no restart/ui (in active development)Backend selected automatically at startup: Metal → CUDA → ROCm → Vulkan → OpenVINO → Ryzen AI → CPU. Override with device = in config or MARANODE_DEVICE.
The isolation is enforced at the kernel level and verifiable with standard Linux tools — no Maranode binary required. Use iptables -L and tcpdump directly.
The OUTPUT chain default policy is DROP from the moment the daemon starts. Even if a library deep in the stack tries to phone home, the kernel drops the packet. And unlike a config flag you can misread, you can see this state yourself.
The daemon re-probes this posture periodically and chains each result into the audit log. So "the air-gap held during the audit period" becomes a timeline you can hand to a third party, not a claim they have to trust.
Ubuntu 22.04+, Debian 12, RHEL / Rocky / Alma 9, Alpine 3.19+, Fedora 39+, Arch, macOS. Docker images available for all GPU variants.
Apache 2.0. Pre-alpha — core runtime and all features are working. Hardening and third-party audit are ongoing.