End-to-end encryption
The Vault encrypts messages and files with AES-256-GCM before they leave your server. The key stays with you.
Security & architecture
Sovereignty isn’t a feature. It’s the foundation.
Self-hosting means control over operation. Tool allowlists, exact-input approvals and persistent audit events make actions traceable. Cloud models and external connectors receive the data you send to them.
Self-hosted
Astoris runs on your server. Sensitive SQLite contents are encrypted; metadata and legacy JSON originals are not fully encrypted. Back up the data directory together with the master key.
Tailscale login
Sign in by password or over your Tailscale mesh. No open port to the internet — only your devices get in.
Server-side tool rules
Only offered tools may execute. Approvals bind exact inputs and the associated configuration. Actions already started are not automatically replayed after a restart.
Layer by layer, under your control.
How Astoris fits together — from your private network to the choice of which model answers.
Network Your Tailscale mesh Only your devices
Access HTTPS · Login (password / Tailscale) Encrypted connection
Workspace Workspace · Company OS · Decisions Runs and approvals
Storage SQLite · Audit events · Vault (AES-256-GCM) Persistent state
Model Local (vLLM / Ollama) · or cloud (Anthropic / OpenAI) You decide per task
Local, in the cloud or on your own GPU — you choose. An example from the high end: the model qwen3.5-35b delivers around 54 tokens per second on an NVIDIA DGX Spark (GB10). That hardware is optional — a cloud free tier or Ollama on a Mac is plenty for fluid streaming.
Your AI. Your hardware. Your rules.
Open-Core and auditable. Build an engine room you can trust.
Security questions? info@astoris.org