Private AI. In a Box You Control.
The SAFi Appliance is an AI system engineered to run local AI models governed by an organizational policy. It comes pre-loaded with three open-source reasoning models (Qwen.3.8 27B, Qwen.3.6 35B-3B MoE, and Gemma4 26B-A4B) and three ready-to-use IT agents: Sysadmin, Security Engineer, and Software Engineer.
All vendor-baked censorship and arbitrary safety refusals have been stripped from the models. Runtime safety is strictly governed by your organization's policies instead, giving you total sovereignty over your AI with zero cloud egress.
- 64GB Unified Memory Debian Appliance (Zero Cloud Egress)
- 3 Pinned Models: Qwen.3.8 (27B), Qwen.3.6 (35B-3B MoE) & Gemma4 (26B-A4B)
- Turnkey Sysadmin, Security & Dev Agents
- Policy-Governed Alignment (Zero Vendor Censorship & False Refusals)
- Cryptographic Hash-Chained Audit Ledger
Deployment & Operations
How the appliance works
Up and running in less than 15 minutes. The appliance is shipped ready for you to connect to your network and log in, with all models and agents pre-configured to work out of the box. Read the step-by-step Quick Start Guide.
Plug & Play Setup
Connect power and Ethernet. The appliance configures automatically via DHCP or a static IP, immediately serving your private web dashboard and API endpoint on your local network.
Web Browser or Terminal Access
Open the web interface from any browser on your network with zero workstation setup. For developers and sysadmins who work in the shell, the optional safi-cli utility connects your terminal directly to the appliance.
Isolated Execution Sandboxes
When running command-line tasks, tools execute inside unprivileged Linux Bubblewrap sandboxes locked strictly to your chosen project directory, with zero access to root files, SSH keys, or host credentials.
Audience & Philosophy
Who the appliance is for
The SAFi Appliance is built for IT directors, sysadmins, security analysts, and developers who need AI leverage but cannot, or choose not to, send operational data to public cloud models due to regulatory requirements, compliance mandates, or internal privacy standards.
Workforce Multipliers
The IT agents built into the SAFi Appliance can increase your or your team's productivity by 10x or more. The software engineer agent can read code at almost 200 words per second and write code at about 25 words per second. The sysadmin agent can troubleshoot and perform admin tasks at lightning speed, and the security engineer agent can run security audits, penetration tests, and other tasks in minutes. This transforms your team from syntax or command gurus to agent operators, dictating and managing outputs.
Strict Privacy & Compliance
The SAFi Appliance was specifically built for organizations and business owners who want to take advantage of AI but are concerned with privacy, IP theft, or regulatory compliance. The appliance is engineered to align with regulatory frameworks such as HIPAA, SEC / FINRA, the EU AI Act, and ISO 42001. SAFi does not just promise compliance: it provides the cryptographic audit trail that examiners, compliance officers, and legal counsel require.
The IT Agent Triad
The Agents
The tools the agents use are tools you are already familiar with.
You can access and use the SAFi Appliance agents in two ways: through the web portal where you can chat and perform basic web-based agentic work, or through PowerShell in Windows and the Terminal in Linux and macOS.
Because the agents use native tools such as Bash and PowerShell, there is no need to configure MCP servers or anything else. All permissions and the behavior of the agents are controlled with a policy you control from the admin web portal.
Agents Using PowerShell and Terminal Tools
All tool execution runs on your local client, controlled by the governance engine in the SAFi Appliance. When you open an agent in PowerShell or Terminal, it opens up as a thin client that connects to the appliance in an isolated sandbox and only has write permissions in the directory you open it in.
The Sysadmin Agent
Hands-On Sysadmin Automation
The Sysadmin Agent assists you with infrastructure work such as upgrading servers, troubleshooting problems, and fleet maintenance. If you have access to a system through the command line, the agent can execute tasks on it. Define your infrastructure once in a local inventory.json file, and the agent knows how to access and manage those resources using its built-in sys-exec tool under strict policy guardrails.
- Operates Windows, Linux, and cloud infrastructure using native Bash, PowerShell, SSH, and Ansible tooling.
- Production-ready for enterprise Linux distros, Windows Server, Active Directory, and Microsoft 365.
- Automates service diagnostics, log triage (journalctl, Windows Event Viewer), and fleet maintenance routines.
- Tackles operational ticket backlogs without requiring public cloud AI subscriptions.
The Security Engineer
Vulnerability Scans & Hardening
Because the AI models shipped with the appliance have been stripped of arbitrary vendor rules and are instead governed by a policy that you author and control, you can deploy the Security Engineer for your exact operational needs. Run authorized penetration tests, vulnerability scans, and security audits that public cloud models refuse to do.
- Private CVE triage: Ingests Nessus and Qualys scan exports locally without uploading internal hostnames, IPs, or vulnerability maps to the cloud.
- Web & OS server hardening: Audits Nginx, Apache, SSH, and systemd units directly against CIS Benchmarks.
- Firewall & network audits: Reviews iptables, UFW, NAT tables, and cloud security group configs for accidental exposure.
- Credential hunting: Catches hardcoded API keys, exposed
.envfiles, and improper file permissions across repositories.
The Software Engineer
Write Code 20x Faster
The Software Engineer agent can read code at about 200 words per second and write code at about 20 words per second. The context window is engineered to always track what you are building, adapting dynamically as you navigate and edit your codebase.
- Inspects, refactors, and modernizes internal scripts, webhooks, and automation glue code across tech stacks.
- Generates comprehensive unit, integration, and regression test harnesses.
- Performs automated code reviews and builds technical documentation from source.
- Confined strictly to the active repository workspace with zero access to private host credentials.
Build Custom Agents for Your Stack
The IT agents get your team working on day one, but you are never limited to just three roles. Define and deploy as many custom, role-specific agents as your workflow needs using the admin web portal.
Local Foundation Weights
The AI models
These models have been carefully chosen and tested to run smoothly on the SAFi Appliance hardware. If you are running complex tasks where precision is necessary, we recommend the Qwen 27B. For rapid text generation, quick queries, or high-throughput tasks, use the Gemma4 (26B-A4B). We continuously benchmark new models as they are released to the market and will make vetted updates available to our clients whenever they improve system performance.
Qwen.3.8 (27B)
Developed by Alibaba's frontier AI research team, this dense model delivers code comprehension and multi-step Bash execution comparable to top-tier models like Claude Opus 4.8. This model is the default engine for sysadmin, cybersecurity, and software engineering tasks.
Qwen.3.6 (35B-3B MoE)
Built on modern Mixture-of-Experts architecture, this model activates only the most relevant expert parameters per token. This makes it exceptionally fast for documentation, rapid text generation, and lightweight infrastructure and scripting workflows.
Gemma4 (26B-A4B)
Built on Google's open foundation architecture, this model is engineered for deterministic instruction following, clean structured formatting, and disciplined tool execution.
Zero False Refusals for IT Tasks
Public cloud models often refuse valid operations like vulnerability scans, firewall audits, or script diagnostics due to generic safety filters. All models on the appliance have vendor refusal vectors removed, ensuring legitimate commands run without artificial blocks while remaining governed by your internal policy.
Continuous Upgrades & Open Weights
We continuously evaluate emerging open-weight releases and provide updated model packages. You are never locked in: load any GGUF or native local model into the appliance whenever you choose.
Silicon & Performance
The Hardware
Our goal is to keep the appliance price accessible while delivering the high throughput required for interactive agent workflows.
The Unified Memory Advantage
Traditional GPU servers cost $25,000 to $80,000, draw over 1,000 Watts, and require datacenter air conditioning. The SAFi Appliance uses high-bandwidth unified memory, delivering fast local inference in a whisper-quiet Mini-PC that draws under 120 Watts from any standard wall outlet.
Guaranteed Hardware Floor
Vendor-agnostic capability contract
- Unified Memory: 64GB guaranteed minimum high-bandwidth unified memory. Shared dynamically across compute and inference cores with zero VRAM offload bottlenecks.
- Compute & Acceleration: 16-Core / 32-Thread high-efficiency processor with dedicated hardware acceleration for local tensor and matrix math.
- Storage: 1TB high-speed PCIe Gen4 NVMe SSD pre-loaded with Debian OS, verified models, and cryptographic audit database.
- Enterprise Networking: 2.5 GbE Ethernet port + Wi-Fi 7. Plugs directly into your isolated management VLAN.
- I/O & Display: Dual high-speed USB4 / Type-C ports, HDMI, and DisplayPort for direct local console access.
- Power & Acoustics: Sub-120W peak power consumption. Compact aluminum Mini-PC engineered for whisper-quiet desktop or server shelf placement.
- Hardware Warranty: 1-Year hardware replacement warranty included with advance dispatch.
Pre-Installed Software Stack
Production-ready from first boot
- Hardened SAFi OS: Debian-based appliance system with kernel tuning, hardware acceleration, and Bubblewrap sandboxing.
- 3 Pre-Loaded AI Models: Qwen.3.8 (27B), Qwen.3.6 (35B-3B MoE), and Gemma4 (26B-A4B) benchmarked and quantized on NVMe.
- First-Boot Setup: Simple console prompts for network configuration, followed by web browser and CLI endpoints.
- Local HTTPS: Automated SSL/TLS certificates generated locally with internal CA.
- Identity & Auth: Native Active Directory / LDAP and SCIM 2.0 provisioning.
- True Air-Gap: Pull the network cable: all models, agents, and governance tools run 100% locally.
Hardware Guarantee: Specifications listed above represent our guaranteed capability floor. We select and calibrate the silicon to guarantee performance parity, and we reserve the right to ship equivalent or better hardware as components evolve.
Enterprise Control & Audit
The Governance
Governance in SAFi is not an afterthought or a filter, but is the natural result on how the system works.
Your Policies as the Reference Point
In SAFi, every agent action is governed by an explicit policy written and owned by your organization. The Policy controls the identity and actions the agent is allowed to take.
The appliance includes ready-to-use default policies for the Sysadmin, Security Engineer, and Software Engineer agents. You can tune these rules or create new role policies at any time using the web admin portal.
SAFi is an open framework designed for full auditability and vendor independence. You can inspect the core governance engine on the GitHub repository or visit selfalignmentframework.com.
Controlled Execution
The AI can never run commands on your servers directly. It can only propose actions, which must pass your policy rules and approvals before anything executes.
Model Independence
Your policies, agent roles, and history belong to you, not a cloud vendor. Upgrade or swap AI models at any time, and your governance rules stay intact.
Built-In Threat Defense
Screens incoming prompts and commands for attacks, prompt injections, and sensitive data exposure before processing them, keeping your systems safe.
Complete Audit Trail
Every action, tool call, and policy decision is permanently recorded in a tamper-proof local log, giving compliance officers and auditors the exact proof they need.
Enterprise Oversight & Regulatory Compliance
Designed for regulated enterprises: SEC 17a-4 & FINRA 3110 (tamper-evident WORM audit records), HIPAA & CMMC (zero cloud egress behind local firewalls), and EU AI Act & ISO 42001 (continuous audit trails and human supervisory oversight).