Maranode runs AI models on your own servers and automatically generates the compliance evidence your auditors need — GDPR, HIPAA, SOC 2, and more. Nothing leaves. Nothing goes undocumented. Fully open source and free to use.
Designed for environments where running AI on sensitive data requires proof, not promises. If you run GDPR, HIPAA, or SOC 2 audits — this is what your auditor will ask for.
Patient data never leaves the machine. Per-department workspace isolation, AES-256-GCM encrypted RAG store, HIPAA access log exports, crypto-shred on patient data deletion requests.
Client matter isolation with separate encryption keys. GDPR Article 30 records auto-generated. Article 17 deletion with signed certificate. Legal hold controlled by compliance officer, not IT.
Air-gapped inference for trading, risk, and regulatory data. Data classification enforcement (PUBLIC / CONFIDENTIAL / RESTRICTED / PHI). Microsoft Purview, Forcepoint, Symantec DLP connectors.
ISO 27001 event logs, TPM 2.0 PCR-bound keys, TEE detection (Intel TDX, AMD SEV-SNP). Attestation report available to remote third-party auditors via signed API endpoint.
Models approved through a gated registry before the daemon will load them. Air-gapped token transfer for offline approval. Behavioral baseline checks against known-good model vectors on every load.
Splunk TA, Elastic ingest pipeline, Microsoft Sentinel KQL rules, IBM QRadar AQL — ready to deploy. Tamper-evident signed events, not best-effort logs.
Ollama and LM Studio are excellent tools for running models locally. They are not built for proving, to an outside auditor, what happened. These are the features that make that possible.
Every answer carries a signed Ed25519 receipt binding the model SHA-256, input hash, output hash, quantization, decode parameters, and a timestamp. A standalone binary maranode-verify checks any receipt offline with no daemon required. A third party can verify with Python and no Maranode binary at all. This turns "we say the answer came from this model" into a cryptographic fact.
Every workspace has its own AES-256-GCM data encryption key (DEK). Honoring a GDPR Article 17 deletion request destroys the DEK — ciphertext on disk becomes mathematically unreadable without any disk scrub. A signed deletion certificate is written into the HMAC chain and exportable as a one-page compliance document with audit sequence number, actor, HMAC, and erasure statement.
A compliance officer holds a keypair separate from IT. Placing a hold freezes an audit segment — nothing can prune or modify it. Releasing the hold requires the compliance officer's signature. IT alone cannot lift a hold. This is the difference between a feature and a control that survives a regulatory investigation.
The daemon re-probes its own egress posture on an interval and writes each result into the audit chain. If isolation cannot be confirmed, the runtime refuses inference and records why. So you can show an auditor a timeline proving the air-gap held for the entire audit period — not just at installation.
SHA-256 proves the weights on disk are unchanged. A behavioral baseline goes further: it runs signed known-answer test vectors on every model load and compares outputs. A model whose weights were subtly modified to behave differently on trigger inputs will fail the baseline check. Drift is recorded in the audit chain. The runtime can refuse to serve a drifted model.
Ships with a ready Splunk Technology Add-on, an Elastic ingest pipeline, Microsoft Sentinel KQL detection rules, and IBM QRadar AQL. The differentiator is not the connector — it is that what you feed the SIEM are signed, HMAC-chained events. Tampering is detectable before the event reaches your SIEM.
A model must be submitted, reviewed, and approved before the daemon will load it. Signed approval tokens can be transferred across an air gap as files. Revoke at any time, and the event is recorded. Change-management hooks connect to external systems. No model runs without an explicit signed token.
Workspace keys, audit HMAC keys, and admin credentials can be sealed to TPM 2.0 PCR policy — they only materialize when the machine runs the expected software state. Intel TDX and AMD SEV-SNP are detected automatically; prompts and responses can be encrypted at the API layer so the host operator cannot read them in memory.
Declare an incident, end active sessions, and freeze the audit log cryptographically in one command. A forensic snapshot captures runtime state. Break-glass credentials are single-use, force a mandatory audit event, and are the only path to emergency access — IT cannot bypass the log silently.
Features marked in green are exclusive to Maranode — not available in any other local AI runtime. All features below are implemented and working in the current release unless noted.
base_url, existing code worksPOST /v1/embeddings, OpenAI shapeaudit replaymaranode audit isolation-report — show auditor the full probe history with time boundsmaranode verify network + iptables -L + tcpdump, no Maranode trust requiredmaranode audit backup / restore with workspace logsGET /v1/attestation/report for binary hash + PCR values + chain statusaudit verify-sources detects tampered docsbreak_glass_used audit event — emergency access is always loggedmaranoded + maranode CLI; no Python, no database server, no sidecarscatSIGHUP or maranode admin config-reload, no restart needed/ui (in active development)Backend selected automatically at startup: Metal → CUDA → ROCm → Vulkan → OpenVINO → Ryzen AI → CPU. Override with device = in config or MARANODE_DEVICE.
The isolation is enforced at the kernel level and verifiable with standard Linux tools — no Maranode binary required. Use iptables -L and tcpdump directly.
The OUTPUT chain default policy is DROP from the moment the daemon starts. Even if a library deep in the stack tries to phone home, the kernel drops the packet. And unlike a config flag you can misread, you can see this state yourself.
The daemon re-probes this posture periodically and chains each result into the audit log. So "the air-gap held during the audit period" becomes a timeline you can hand to a third party, not a claim they have to trust.
Ubuntu 22.04+, Debian 12, RHEL / Rocky / Alma 9, Alpine 3.19+, Fedora 39+, Arch, macOS. Docker images available for all GPU variants.
Apache 2.0. Pre-alpha — core runtime and all features are working. Hardening and third-party audit are ongoing.