How PAI works

Your private AI workstation, anywhere

To use PAI, shut down the computer and start it from your PAI USB stick instead of booting Windows, macOS, or Linux. You can temporarily turn any computer into a private AI machine, or safely use a computer that isn't yours.

PAI is a ~2 GB download and takes a few minutes to flash. It boots on most x86-64 machines made in the last ten years and runs entirely in RAM. You can start again on the host operating system after shutting PAI down.

You don't have to worry about the host having viruses, because PAI runs independently from the installed operating system and never uses the internal hard disk. PAI cannot, however, protect you if you install it from a compromised computer, or if the hardware itself is malicious (for example a hardware keylogger).

• Warnings: PAI is safe but not magic
• Download and flash PAI
• System requirements and recommended hardware

Amnesia

PAI always starts from the same clean state, and everything you do disappears automatically when you shut down PAI.

Without PAI, almost everything you do on a computer leaves traces:

• Chat prompts and AI responses, saved in cloud history
• Files you opened or created, even after you deleted them
• Passwords, even if you use a password manager
• Every device and Wi-Fi network you connected to

PAI never writes anything to the host hard disk and only runs from the memory of the computer. Memory is fully cleared when you shut down, erasing all possible traces — including AI conversations, which exist only in RAM while PAI is running.

Encrypted persistence (opt-in)

You can choose to save some of your files and configuration to an encrypted partition on the USB stick: your AI model weights, chat history, SSH keys, Wi-Fi passwords, wallets, and additional software. The persistent partition is optional, LUKS2-encrypted, and you always decide what is persistent — everything else stays amnesic.

• Set up encrypted persistence
• Install additional software

Local models, no cloud

Every major AI service — ChatGPT, Claude, Gemini — sends your prompts to remote servers where you have no control over who reads them, how long they are stored, or who they are shared with.

PAI eliminates that trust chain. All inference happens locally viaOllama, which runs Llama, Mistral, Phi, Gemma, and 100+ other open-weight models entirely on your hardware. No API keys, no accounts, no prompts leaving the machine.

The built-in Chat app talks to Ollama over localhost only. The firewall blocks every inbound connection, and Ollama is not reachable from the network. When you shut PAI down, the model is unloaded from RAM along with every conversation you had with it.

• Try the Chat app
• Download and run models with Ollama

Hardened by default

PAI ships with a restrictive default posture. Your network identity and outbound traffic are protected by several layers you don't have to configure:

• MAC address randomized on every boot — the host machine presents a fresh hardware identity each session, so Wi-Fi operators can't link you across visits.
• UFW firewall, default-deny inbound — nothing on the local network can reach services running on PAI, including Ollama and the PAI UI.
• No telemetry, no analytics, no auto-updates phoning home — PAI does not make a single network call unless you initiate it.

Tor for everything (opt-in)

Run sudo pai-privacy on and all outbound traffic — including DNS — is routed through the Tor network. This hides your IP from whatever server you're talking to, and hides what you're doing on the network from your ISP or local observer.

Unlike Tails, PAI does not force Tor by default. PAI's focus is private AI, and most AI inference never needs the network at all. Tor is one command away when you do need it.

Digital toolbox

PAI includes a curated selection of applications to work on sensitive material and communicate securely — ready to use and configured with safe defaults:

• Chat — local LLM chat UI, talks to Ollama over localhost only
• Ollama — run and manage 100+ open-weight models offline
• Firefox ESR — with uBlock Origin and hardened defaults
• Terminal (foot) — zsh, tmux, and common dev tools pre-installed
• Electrum & Monero wallets — pre-configured with sane privacy defaults
• Sway + Waybar — a keyboard-first Wayland tiling desktop

Applications that try to reach the internet without going through Tor are blocked when Tor-only mode is on. The firewall enforces the policy; individual apps cannot opt out.

Transparency to build trust

All the source code, build scripts, and configuration for PAI is public, so independent researchers can verify that PAI really works the way we say it does. PAI is built on Debian 12, which itself is scrutinized by a global community of maintainers.

PAI is released under the GNU General Public License v3.0. You can audit the code, modify it, redistribute it, or fork the whole project.

• Source code on GitHub ↗
• Verify your ISO against signed checksums
• Full security model and threat model

Top security for free

Nobody should have to pay to use AI privately. PAI is free software, free to download, and free to share. It is built and maintained by volunteers; if you want to help, contribute code, documentation, translations, or a donation on GitHub.