SecureMind
A privacy-aware AI workspace for models, Knowledge, memory, cost, and sensitive-data risk.
You run it, and you own it
SecureMind is free, open-source software that you run yourself. There is no paid or managed version. Copy the code from this repository and run it on your own computer with Docker, or in your own AWS account. The copy is yours: your data stays in your install, and you can change it or take it in a different direction under the license below.
The author also runs a private, invitation-only copy for friends and reviewers, and a sample site with made-up data that needs no account.
Detection runs before chat is sent and again when Knowledge is ingested. That reduces exposure. It does not guarantee complete removal of sensitive data, and it is not a compliance program. You review what is sent and what you store.
Where to read
Models
| Where | What runs with nothing else configured |
|---|
| Docker Compose | Ollama (llama3.2:3b chat, nomic-embed-text embeddings) |
| Your AWS account | No model, until Bedrock is enabled for that account or an admin saves a vendor key |
Groq, Gemini, OpenAI, Anthropic, and Grok run only after a key is saved. Bedrock runs only when that account is allowed to invoke it. A saved key is not selected for you.
What to expect
- Detection is pattern-based and can miss values. There is no path that restores a replaced value.
- One operator directory. It is not multi-tenant hosting.
- Two-step verification with an authenticator app is optional on the hosted edition and recommended for admins. The local Docker sign-in does not support it. See docs/mfa.md.
- Built and tested on a Windows computer with Chrome, Docker Desktop and an AWS account in us-east-1. Use it from a desktop browser. The layout fits phone and tablet widths, but macOS and Linux installs, Apple Silicon, other browsers and real phones have not been tested. Compose builds the image on your own machine, so it is not tied to one processor type.
- Citations come from Knowledge you ingested. Conversation history is not a source.
- The hosted data store is DynamoDB. Local Docker uses Postgres with pgvector.
On-prem
Docker Compose on this computer. Postgres, local sign-in, and Ollama come up together. Chat uses the models Compose installs. Cloud model APIs and Bedrock are optional.
Prerequisites
- Git
- Docker with Compose v2. The command is
docker compose, with a space.
- About 8 GB of free disk. The first start downloads container images plus
llama3.2:3b and nomic-embed-text.
- Enough free memory for a 3B chat model. 8 GB of RAM on the machine is a practical floor.
- Port
3000 free. The database, local sign-in and Ollama stay inside Docker and publish no ports (the contributor setup below publishes them on localhost).
No AWS account is needed. A model API key is not required, but it is strongly recommended: the built-in local models use your own computer's resources and, unless it is very powerful, they are slow. Groq has a free tier and is a good first key. On AWS, use Bedrock or a key, since there is no local model.
Who it is for
SecureMind is intended for small to mid-sized teams. One install serves one organization: 1 to 25 people is the recommended range, and it can serve up to about 100 people with a few adjustments (an AWS concurrency limit, a realistic budget, and two-step verification for admins). Separate organizations should each run their own install. See Operating an installation in the technical guide.
Run
git clone https://github.com/OrieBound/securemind.git
cd securemind
docker compose up --build
Confirm
Open http://localhost:3000 and create the first owner with an email and password you choose. There is no demo account. The first start can sit on the model download for a while. Later starts reuse those models.
The first owner also needs a one-time setup code. The install prints it in the terminal where you ran docker compose up, in a line that starts with init-1 and says First-run setup code. If you cannot find it, open a second terminal in the same folder and run:
docker compose logs init
The code is the text after First-run setup code (needed once, to create the Owner):. The code is not a password. You only need it once, to create the first owner.
If you have run SecureMind before from another folder called securemind, Docker reuses that install's data and shows the sign-in page without a first-owner option. To start fresh, add a different name: docker compose -p securemind-new up --build, and use the same -p securemind-new in later commands such as docker compose -p securemind-new logs init.
Docker builds the app from this repository on your computer; there is no image to download from the author.
Stop
docker compose down # keep your data and models
docker compose down -v # deletes the database, uploads, and models
Ports, backups, and optional keys: docs/deploy/on-prem-docker.md.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
