SHAITS v1.0 · Released 2026-04-21

An open standard for trustworthy self-hosted AI.

Most "AI for business" products are marketing claims dressed as technology. "Secure" means they encrypt the connection. "Private" means they won't sell your data — probably. SHAITS answers what those claims don't: where your data sits, who can see it, what happens when the vendor disappears, and whether it works offline. 125-point score across 5 categories. Cloud products cannot qualify.

Five questions SOC 2 won't answer.

Compliance frameworks tell you who's compliant. They don't tell you whether your AI vendor's architecture actually matches what they're selling. SHAITS puts specific, reproducible answers on the record.

  1. Where does my data physically sit?
  2. Who else can see it?
  3. What happens when the vendor disappears?
  4. Can I export everything and leave?
  5. Does it work if my internet dies?

125 points, 18 criteria, 5 lenses.

Each criterion has a testable spec with point tiers (10/5/0 or 8/4/0). Every test has a defined automation method — anyone can reproduce any score.

A
40pts
Self-HostingMandatory · fail = unqualified
Where data physically sits. Cross-tenant isolation. Air-gap capability. Whether the vendor can access your data.
A1 Physical Data Location · A2 Data Isolation · A3 Air-Gap · A4 Data Sovereignty
B
25pts
Transparency
Source attribution on responses. User-accessible audit logs. Visible system prompts. Known model per response.
B1 Source Attribution · B2 Audit Logging · B3 Prompt Transparency · B4 Model Transparency
C
20pts
Portability
One-command data export. Open standard protocols. Documented backup/restore that actually works on a fresh machine.
C1 Data Export · C2 Open Protocols · C3 Backup/Restore
D
20pts
Privacy
Zero telemetry by default. Encryption at rest. Secret management via OS keychain or HSM, not plaintext config.
D1 Zero Telemetry · D2 Encryption at Rest · D3 Secret Management
E
20pts
Reliability
Full feature parity offline. Graceful degradation when cloud dies. Per-source freshness timestamps users can verify.
E1 Offline Inference · E2 Graceful Degradation · E3 Freshness Tracking

Four outcomes. No middle ground.

🟢
Gold
100-125
Trust without reservation. Production-ready for regulated industries.
🟡
Silver
75-99
Trustworthy for most use cases. Minor gaps disclosed.
Bronze
50-74
Workable with caveats. Specific gaps noted in audit report.
Unqualified
<50 or mandatory fail
Does not meet the standard. Not published to registry.

Three paths to certification.

Self-audit for free. Get an independent review when you're ready to ship a badge. Continuous monitoring for enterprise compliance.

01
Automated self-audit
Run audit_runner.py against your repo. Produces JSON report per criterion. Shareable badge. Open source, reproducible.
Free
02
Manual expert review
Independent auditor validates claims against code. Issues certification valid 12 months. Listed on public registry with full audit report.
$500-$2K
03
Continuous monitoring
Automated re-tests on every release. Regression alerts. Custom compliance reports mapping SHAITS → HIPAA, SOC 2, industry frameworks.
$5K-$20K/yr
Why cloud products cannot qualify
Category A is the point, not an oversight.
  • ChatGPT Teams / Enterprise — fails A1 (cloud-only)
  • Microsoft Copilot — fails A1, A3
  • Google Gemini for Business — fails A1
  • Claude Teams — fails A1

Cloud products may have excellent security, privacy policies, and SOC 2 certifications. They may be the right choice for many customers. But they do not meet the definition of "actually self-hosted," and SHAITS exists to make that distinction precise. By our criteria, the big AI players don't even qualify.

Submit your agent for review.

Open source agents get free self-audit tooling. Commercial agents get expert review. First public certifications land Q2 2026 — Simple4u self-audits go first.

Read the spec on GitHub
Book a Call