Private AI
Your server.
Your model.
Cerberon runs where your code and data already live. Use the AI provider you trust, a model you host yourself, or no AI at all.
Request to AI provider
SAST triage ยท masking: Redact
Before masking (stays on your server)
db_url = "postgres://app:Hx92kQ@10.20.4.7:5432/orders"
notify("ops@acme-internal.com")What the provider receives
db_url = "postgres://app:[REDACTED]@[INTERNAL_IP]:5432/orders"
notify("[EMAIL]")What it does
- Self-hostedOne Linux server or a Windows 11 workstation. Code, credentials, findings and reports stay on it.
- Any providerOpenAI, Anthropic, Google, Azure OpenAI, OpenRouter, or any OpenAI-compatible endpoint.
- Your own modelPoint it at a model on your own network.
- Privacy gateSecrets, tokens, internal addresses, host names and emails redacted or tokenised before sending.
- Works without AIWith no AI provider set, the 3,676 rules, secret scanning and dependency checks still run entirely on your host.
- Air-gappedInstall from an offline bundle on a host with no internet access.
What you get
- A list of exactly what each scan sent
- Masked reports and share links
- Every outbound connection documented
- An audit trail of every setting
Built with
- AES-256-GCM sealed credentials
- Masking before any AI call
- Audit log up to 10 years
How it works
- InstallOn your hardware or your own cloud account.
- Choose the modelA provider, your own endpoint, or none.
- Set the privacy gateRedact, tokenise or off.
Documentation
Read the details
Setup, every option and the API, on docs.cerberon.dev.
Common questions
Can I use Cerberon without any AI provider?
Yes. Rule and secret scanning need no AI. Agent-assisted scans are opt-in.
See it on your own systems.
A 30-minute demo on your targets, or install it yourself and start scanning this afternoon.