Enterprise Security.
Consumer Simplicity.
PROMETHEUS OS was designed from the ground up with privacy as the architecture — not as a checkbox.
Your Data Never Leaves
"Prometheus OS never transmits your data on its own initiative. There is no registration server, no telemetry, no crash reporting and no analytics. When you configure a cloud provider, your prompts go to that provider — because you chose it, to the endpoint you chose, with the key you supplied."
The software runs entirely on your machine. There is no registration server receiving your details, no background service phoning home, and no hidden data pipeline. When you connect a cloud AI provider, your prompts travel to that provider — because you configured it, not because Prometheus decided to send them.
Built to Run Without the Internet
● All processing on-machine. Zero network calls. Works completely air-gapped.
You choose the provider. You set the API key. You decide what is sent. PROMETHEUS OS never sends data independently on your behalf.
Everything Stored Locally. Encrypted.
Every category of data PROMETHEUS OS handles is stored locally on your machine. Here is exactly where each type lives:
Security Control Catalog
The Security Console in the app lists all 42 security controls alongside 10 compliance presets, each shown with its actual enforcement status — including the controls that bind only the UI layer.
Binds the agent and headless scheduled jobs
Structural — no toggle, cannot be turned off
Real, but bind the UI layer only
Reserved for controls not yet enforced
Implemented vs. active. The policy engine distinguishes whether a control exists from whether a user has switched it on. The Security Console surfaces both — a distinction almost no vendor draws.
How Each Control Actually Works
Policy engine
- Authoritative in the main process, loaded at boot before any job can fire
- Enforced at six chokepoints: model calls, network egress, all 183 tools, message shaping, permissions, and MCP connections
- Binds headless scheduled jobs — a 2am job with no window open is governed identically to a click in the UI
- Fails closed: an unreadable policy file falls back to last persisted state, then to documented defaults — never to allow
The renderer is a view and editor of policy, never its owner.
Audit chain
- Append-only JSONL segments, each record linked to its predecessor by SHA-256 HMAC
- Record bodies encrypted AES-256-GCM using seq|prev as authenticated data — a record cannot be repositioned or spliced
- Head anchor written to a separate directory — deleting the log does not delete the witness
- Verification reports the first break with a specific status (TAMPERED, SEQ_GAP, ORDER_BROKEN, …)
Tamper-evident, not tamper-proof. An attacker holding the vault key with write access to both log and anchor can forge a consistent chain.
Egress firewall
- Three modes: off, guarded, locked
- Guarded blocks private ranges, link-local, and cloud metadata endpoints including 169.254.169.254
- Locked is default-deny with an explicit allowlist; loopback always permitted so local model runners keep working
- SSRF blocking sits in guarded, not only locked, because the agent ingests untrusted web content
Every verdict carries dnsRebindingChecked: false. Rules evaluate the hostname before resolution, so a DNS rebind is not caught.
Prompt-injection containment
- Applied wherever untrusted text reaches the model — web page reads and MCP tool descriptions
- Layer 1 neutralises eight emission formats deterministically; a page or tool description cannot emit an action
- Layer 2 fences content as DATA with its source named; Layer 3 flags known injection phrasings and taints the run
- With confirm_after_web_content on, destructive tools require human approval for the remainder of that run
Layer 1 removes the deterministic exploit. A model can still be argued into a harmful action by plain prose matching no pattern.
Process hardening
- sandbox: true on the app window and every browser webview guest
- contextIsolation: true, nodeIntegration: false throughout; preload requires only electron
- Content-Security-Policy set on the app session; browser-partition pages keep their own CSP deliberately
- Permission handlers cover geolocation, notifications, clipboard, microphone, WebMIDI, WebSerial, HID and USB
Both request and check handlers are installed, so a permission granted earlier does not survive the control being switched on.
Supply chain
- Zero runtime dependencies — dependencies: {} in package.json; the entire runtime surface is Electron 43 plus Node built-ins
- No npm package can be compromised into your install, because there are none
- Published SBOM; the credential vault uses no native module, so no build toolchain is involved
PII redaction
- Applied at the model chokepoint on the way out, so headless jobs are covered
- Redacts structured identifiers: SSN, Luhn-validated payment cards, API keys, bearer tokens, JWTs, IBANs, email, phone, IPv4, DOB
- Audit records the counts only — never the values removed
Free-text personal data has no structure to match. This is a control against leaking identifiers, not a guarantee of anonymity, and not HIPAA Safe Harbor de-identification.
Anomaly detection
- Two independent signals with user-defined thresholds: policy denials in a window, and destructive-tool bursts in one run
- Notify-and-record by default; auto-pause is a separate opt-in
- Records carry whether the run was unattended
Data protection
- History encryption uses one data key wrapped in three independent envelopes: machine key, admin password, one-time recovery code
- Encryption refuses to enable unless at least two envelopes verify first — it cannot lock you out of your own data
- Retention marks and grace-periods rather than deleting: 90 days plus a 30-day grace, restorable throughout
- Export Everything works at all times — locked, unlocked, mid-migration — and is never blocked by any security control
Thirteen Frameworks, Mapped Honestly
"Mapped" = a control exists for that framework requirement. "Binds headless" = it also governs unattended scheduled jobs, not just the UI.
| FRAMEWORK | MAPPED | IMPLEMENTED | BINDS HEADLESS |
|---|---|---|---|
| HIPAA | 24 | 24 | 16 |
| SOC 2 | 22 | 22 | 14 |
| PCI-DSS | 18 | 18 | 12 |
| ISO 27001 | 16 | 16 | 12 |
| GDPR | 12 | 12 | 10 |
| NIST CSF | 12 | 12 | 9 |
| CIS v8 | 7 | 7 | 5 |
| CCPA | 6 | 6 | 5 |
| EU AI Act | 3 | 3 | 3 |
| ISO 42001 | 3 | 3 | 3 |
| SOX | 3 | 3 | 3 |
| ISO 27018 | 2 | 2 | 2 |
| NIST AI RMF | 2 | 2 | 2 |
Required disclaimer: Framework mappings describe control coverage, not certification. No claim of SOC 2, ISO 27001, HIPAA, PCI-DSS or GDPR compliance is made or implied. Compliance is a property of an organisation and its processes, not of software.
Inspect It Yourself
PROMETHEUS OS is built on open architecture principles. You are not asked to trust us — you can verify us. Every network call the application makes is visible. Every data access is auditable.
You Choose Your AI. We Don't Choose For You.
Every AI provider in PROMETHEUS OS is isolated by design. Your interactions with one provider are never visible to another, and PROMETHEUS OS never autonomously selects or switches providers without your instruction.
Designed for Professionals
Prometheus OS runs on your hardware, answers to your policy, and can be configured never to touch the internet. From a founder with one laptop to a regulated enterprise — same software, same controls, nothing leaving the building.
Founders & Solo Operators
You are the CEO, the IT department and the security team. Prometheus gives you controls a company would need staff to configure, with nothing to administer and no vendor holding your cap table, customer list or unfiled IP.
No account to create · nothing phones home · works on day one
Small Business & Startups
Your customers ask how you handle their data long before you can afford a compliance hire. The answer here is short: it stays on our machines. One flat annual licence per seat — no tiers, no usage metering, no surprise invoice.
Local models mean zero per-token spend on routine work
Growing Teams
Deploy per seat on Windows, macOS or Debian, each install independently governed by its own policy engine — including the scheduled jobs that run with nobody watching. Central posture management arrives with Flynn.
28 controls bind unattended jobs, not just the open window
Enterprise & Regulated
No vendor production access, no multi-tenancy, no shared database — because there is no vendor server. Your security review is largely pre-written: published SBOM, documented threat model, CAIQ self-assessment, and a control catalogue with honest enforcement status. Multi-seat and self-hosted server deployment is Flynn.
22 controls mapped to SOC 2 · 16 to ISO 27001 · coverage, not certification
Legal
Privilege is not something to trust to a vendor. Enable local-only mode and privileged communications never leave the machine. Every provider you connect stays isolated from every other.
Tamper-evident audit chain for ethics and billing review
Medical & Clinical
Paired with a local model and local-only mode, Prometheus runs fully air-gapped — no clinical data reaches an external server. Identifier redaction runs on the way out, covering unattended jobs too.
24 controls mapped to HIPAA · not Safe Harbor de-identification
Financial Services
Client records and position data stay on your hardware. No third-party cloud processes your proprietary analysis, and card numbers are Luhn-validated before redaction so real order references survive.
18 controls mapped to PCI-DSS · 3 to SOX
Accounting & Tax
Client books, returns and supporting documents never leave your systems. Configuration changes are written to the audit chain, so you can show what the software was permitted to do in any given period.
Retention marks and grace-periods — it never silently deletes
Software & Engineering
Proprietary source stays local. The build ships with zero runtime dependencies, so there is no npm supply chain to compromise — and no telemetry, crash reporting or analytics of any kind.
Electron 43 + Node built-ins · published SBOM
HR & People Operations
Investigations, accommodations and compensation records are the most sensitive documents most organisations hold. Keep them on your own hardware and require human approval before the agent acts on any of it.
Destructive actions gated behind explicit confirmation
Journalists
Local models mean source communications never touch a provider. Prometheus keeps an audit record of its own activity by design — that record stays on your machine, encrypted, and cannot be silently rewritten.
Export Everything works even while locked
Research & Life Sciences
Multi-round research with real citations, a durable local corpus and per-run cost accounting. Unpublished work is never indexed, never used for training, and never leaves the machine unless you send it.
Five export formats · offline corpus search
Therapy & Private Practice
Session notes and intake records are among the most protected data there is. Run entirely on a local model and nothing is submitted to any provider — no processor agreement needed, because there is no processor.
Idle lock, lock-on-blur and session timeout
Insurance & Claims
Claim files carry medical records, financial detail and identity documents in one place. Structured identifiers are redacted at the model chokepoint, and the audit log records the counts removed — never the values.
SSN, cards, IBAN, DOB, phone, email, IPv4, tokens
Consultants & Agencies
You sign a different NDA with every client. Each provider runs in its own isolated context, switching providers carries no history across, and per-agent model pinning stops work drifting to an endpoint you did not choose.
An explicit provider choice is absolute on every path
IT & Security Teams
42 controls with their true enforcement status shown in-app, including the ten that bind only the UI. The console separates what the product implements from what this machine has actually switched on.
Egress firewall: off · guarded · locked
Also built for
Anyone accountable for information that is not theirs to leak.
Compliance note. Prometheus OS maps controls to SOC 2, ISO 27001, HIPAA, GDPR, PCI-DSS and eight further frameworks. That describes control coverage, not certification — compliance is a property of an organisation and its processes, not of software. No claim of compliance is made or implied. You remain responsible for your own obligations, and the strongest isolation available is local-only mode with a local model.