Network security Pre-production · v0.1.0 · simulation-only response

AI that reads your security evidence. Signed humans decide what happens next.

PrivaShield collects Suricata alerts and Zeek connection logs on your own hardware, redacts card numbers, SSNs and credentials as they arrive, and scores them with deterministic, regression-tested detection engines. A local LLM can explain what it finds, but the model never acts. Every response is a simulation, and it runs only when a signed policy allows it and a second person approves.

Commercial license

$49 one-time

One payment licenses PrivaShield for your business permanently, with no subscription. Your license ID and download link appear right after checkout and are emailed to you. Personal, non-commercial use is free.

Buy a license · $49 one-time
Security analysts reviewing threat evidence at their screens
Reviewing privacy and security signals

The one rule the system enforces

AI is advisory-only

A local Ollama-backed model reads detection evidence and explains it. It can recommend but can't change anything.

Every response is gated and simulated

Every response action and firewall change is a simulation, and it's refused unless the active Ed25519-signed policy allows it and a second named person approves it. Every refusal is logged.

Policy changes are signed

Policies are Ed25519-signed envelopes, verified again every time they're used. Activating one needs approval from a second, separately authenticated person; rolling back to an earlier approved revision is recorded. The signing key never touches the server.

The split is built into the architecture, so there is no setting to forget. The AI layer has no path to a privileged action that skips a cryptographically signed, two-person approval.

What runs underneath

Sensors

Suricata (EVE JSON) alerts and Zeek connection logs from your own capture interface, through a crash-safe collector that doesn't skip or duplicate events across restarts. You add a Suricata ruleset with suricata-update. Responses are simulations: PrivaShield never blocks traffic or touches hosts.

Deterministic detection, tested like code

DLP, anomaly, ransomware, malware and correlation engines run against a 16-case versioned evaluation set on every change in CI, alongside 100+ automated tests including security-boundary tests.

Tamper-evident audit log

An append-only file chained with HMAC-SHA256 under a key kept off the audit volume, plus a separately stored signed checkpoint: edits, insertions, re-chaining and deleted entries are detected on verify. Someone holding the key, or able to roll back both volumes, could still forge it, so ship checkpoints off-host.

Local LLM, your infrastructure

Threat analysis runs through a self-hosted Ollama model. Nothing about the advisory layer requires sending telemetry to a third-party cloud AI vendor.

Five-role RBAC

Viewer, analyst, operator, administrator and auditor, plus a sensor role that can only submit events. The installer generates every secret and sets local auth and production mode, and the API refuses to start with auth off. Only token digests are stored.

Self-hosted, source-available

Runs on your own infrastructure via Docker Compose: Postgres, NATS, Ollama, the API, dashboard, WAF and both sensor stacks. Free for personal use; business use needs a commercial license. Versions before 0.1.0 remain Apache-2.0.

How it compares

PrivaShield vs. WazuhA mature open-source SIEM with its own local AI vs. a narrower platform built around signed, advisory-only AI governance

Where it stands today

PrivaShield's README states it is not production-ready as a privileged-enforcement control. External identity-provider integration is still on the roadmap. The download ships a CycloneDX SBOM, and backup/restore qualification is done. Build provenance is implemented but won't be exercised until the first release tag. The packaged installer turns on local authentication and production mode, and the API refuses to start with authentication off.

Product facts

Who it's for
People who want network detection and AI-assisted triage on their own hardware, with any response gated by a signed policy and a second person's approval.
What it does for you
Suricata alerts and Zeek connection logs collected, redacted (card numbers, SSNs, credentials) and scored by deterministic detection engines, with a local model explaining what it finds.
What runs, and where
Self-hosted with Docker Compose on your own infrastructure: Postgres, NATS, Ollama, the API, dashboard, WAF and both sensor stacks.
AI model
A self-hosted Ollama model, advisory only. It explains evidence and can recommend, but it can't change anything, and no third-party cloud AI is needed.
What you need
  • Docker Compose on infrastructure you run
  • A capture interface for the Suricata and Zeek sensors
  • A Suricata ruleset, added with suricata-update
Who checks the results
People. Every response action needs the active signed policy to allow it and a second named person to approve it, and every refusal is logged.
Price and billing
$49 one-time per business, with no subscription or renewal. Personal, non-commercial use is free.
License
One business, permanently, for this major version. The terms are the LICENSE file inside the download. Versions before 0.1.0 remain Apache-2.0.
Delivery
Your license ID and download link appear right after checkout and are emailed to you. Each purchase includes 25 downloads.
Known limits
  • Pre-production. Its README states it is not production-ready as a privileged-enforcement control.
  • Responses are simulations only: it never blocks traffic or touches hosts.
  • External identity-provider integration is still on the roadmap.
  • Build provenance is implemented but not yet exercised; that happens at the first release tag.
  • Someone holding the audit key, or able to roll back both volumes, could still forge the audit log.
Version
0.1.0, pre-production, as stated on its release badge
Release updates

Get an email when a new version of PrivaShield ships.

PrivaShield is made by Merit AC. Using it at a business is covered by its commercial license in our terms. Questions: contact us.