An open standard for trustworthy self-hosted AI.

Most "AI for business" products are marketing claims dressed as technology. "Secure" means they encrypt the connection. "Private" means they won't sell your data, probably. SHAITS answers what those claims don't: where your data sits, who can see it, what happens when the vendor disappears, and whether it works offline. 125-point score across 5 categories. Cloud products cannot qualify.

Read the spec on GitHub View registry
Why SHAITS exists

Five questions SOC 2 won't answer.

Compliance frameworks tell you who's compliant. They don't tell you whether your AI vendor's architecture actually matches what they're selling. SHAITS puts specific, reproducible answers on the record.

  1. Where does my data physically sit?
  2. Who else can see it?
  3. What happens when the vendor disappears?
  4. Can I export everything and leave?
  5. Does it work if my internet dies?
The 5 categories

125 points, 18 criteria, 5 lenses.

Each criterion has a testable spec with point tiers (10/5/0 or 8/4/0). Every test has a defined automation method: anyone can reproduce any score.

A
40pts
Self-HostingMandatory · fail = unqualified
Where data physically sits. Cross-tenant isolation. Air-gap capability. Whether the vendor can access your data.
A1 Physical Data Location · A2 Data Isolation · A3 Air-Gap · A4 Data Sovereignty
B
25pts
Transparency
Source attribution on responses. User-accessible audit logs. Visible system prompts. Known model per response.
B1 Source Attribution · B2 Audit Logging · B3 Prompt Transparency · B4 Model Transparency
C
20pts
Portability
One-command data export. Open standard protocols. Documented backup/restore that actually works on a fresh machine.
C1 Data Export · C2 Open Protocols · C3 Backup/Restore
D
20pts
Privacy
Zero telemetry by default. Encryption at rest. Secret management via OS keychain or HSM, not plaintext config.
D1 Zero Telemetry · D2 Encryption at Rest · D3 Secret Management
E
20pts
Reliability
Full feature parity offline. Graceful degradation when cloud dies. Per-source freshness timestamps users can verify.
E1 Offline Inference · E2 Graceful Degradation · E3 Freshness Tracking
Tiers

Four outcomes. No middle ground.

🥇
Gold
100-125
Production-ready. Fits regulated and high-trust deployments without reservations.
🥈
Silver
75-99
Solid for most use cases. Minor gaps disclosed in the audit.
🥉
Bronze
50-74
Workable with caveats. Specific gaps spelled out in the audit.
⛔
Unqualified
<50 or mandatory fail
Doesn't meet the bar. Not published to the registry.
Verification

Three paths to certification.

Self-audit for free. Get an independent review when you're ready to ship a badge. Continuous monitoring for enterprise compliance.

01
Automated self-audit
Not released yet (see /registry): audit_runner.py will run against your repo and produce a JSON report per criterion and a shareable badge. Until then, score yourself by hand against the published spec.
Free
02
Manual expert review
Independent auditor validates claims against code. Issues certification valid 12 months. Listed on public registry with full audit report.
$500-$2K
03
Continuous monitoring
Automated re-tests on every release. Regression alerts. Custom compliance reports mapping SHAITS → HIPAA, SOC 2, industry frameworks.
$5K-$20K/yr
Why cloud products cannot qualify
Category A is the point, not an oversight.
  • ChatGPT Teams / Enterprise: fails A1 (cloud-only)
  • Microsoft Copilot: fails A1, A3
  • Google Gemini for Business: fails A1
  • Claude Teams: fails A1

Cloud products may have excellent security, privacy policies, and SOC 2 certifications. They may be the right choice for many customers. But they do not meet the definition of "actually self-hosted," and SHAITS exists to make that distinction precise. By our criteria, the big AI players don't even qualify.

Describe your business. Get the one-page plan.

It says what to build first, what it connects to, and the fixed price. Free, from the founder, within 48 hours.

Or book the call

Fifteen minutes, no deck. If we are not the right team, you will hear that on the call and get a name of who is.

Prefer to talk first: book a call with Slava Phone: (929) 640-6940 Email: office@simple4u.io Based in Brooklyn, NY. We work with clients anywhere; in New York we come to you.

Your message reaches the founder directly.

Book a Call