Amastan · Pilot RC1 · System Specifications

Amastan AI-SWG — System Specifications

Hardware, network, capacity by user scale, security properties, and documentation set for architects and procurement.

Product: Amastan AI Secure Web Gateway
Release: Pilot RC1
Audience: IT architects, security engineers, procurement
Updated: 2026-08-23

1. Product summary

Amastan is a self-hosted AI Secure Web Gateway. It inspects outbound web traffic, applies allow / block / optional Remote Browser Isolation (RBI) decisions, and keeps verdicts and logs on infrastructure you control.

Verdicts: Allow · Block · Isolate (RBI)

2. What the platform includes

Area	What you get
Web filtering	Allow / block / optional safer remote browse (RBI)
AI assist	Helps judge unknown or grey-zone websites
Management	Operator console (React Admin UI), Keycloak-ready OIDC
Identity	LDAP / Active Directory for user-aware policy
Data on site	Policy cache, decision logs, optional vector / object stores as configured
Observability	Prometheus, Grafana, Loki / Promtail
Optional licensed	DLP, Shadow IT / unofficial cloud apps, email-link controls

3. Deployment model

Appliance-oriented Docker Compose / HA stack
Lab and pilot images distributed as KVM/QEMU qcow2 (sanitized pilot build)
Single-site today; multi-site fleet on roadmap

4. Recommended sizing (lab & by named users)

Lab / pilot profiles

Profile	vCPU	RAM	Disk	Notes
Lab eval	8+	32 GB	200+ GB	Functional demo + QA
Small pilot	16	64 GB	500 GB+	Light production-like load
HA pilot	2× nodes	64 GB each	500 GB+ each	Dual-node HA pattern

Capacity by named users (system-test planning)

Named users	Peak concurrent (est.)	Nodes	vCPU / node	RAM / node	Disk / node
500	~50–100	1 (HA optional)	12–16	48–64 GB	500 GB
2,000	~200–400	2 (HA)	16	64 GB	1 TB
4,000	~400–800	2 (HA)	24	96 GB	1.5 TB
10,000	~1,000–2,000	2–3	32	128 GB	2 TB
20,000	~2,000–4,000	3–4	32–48	128–192 GB	4 TB

Exact sizing depends on concurrent users, TLS intercept policy, RBI rate, and ML model mix. Validate with a scoped load test during the pilot before procurement lock-in.

5. Network & ports (typical lab)

Service	Port (host)	Purpose
HTTP(S) proxy	80 / 443	User web traffic
Sidecar API	8010	Classify / health (internal)
Admin UI	8080	Operator console
Identity	Keycloak (as deployed)	Admin / directory

Harden exposure before production; do not publish management ports to the internet.

6. Identity & integrations

LDAP / Active Directory federation
Directory users & endpoint agent path (Windows)
SIEM-oriented export (syslog / object storage / webhooks as configured)
Azure AD / SAML / OIDC hardening on roadmap

7. Security properties

On-prem verdicts and audit trail
Policy allowlist / blocklist / overrides / SNI bypass controls
Tamper-evident audit chain (as implemented in pilot)
Optional licensed modules: DLP, email security, shadow IT discovery

8. Pilot appliance artifact

Item	Value
Image	`ai-swg-v1.0.1-pilot-rc1-sanitized.qcow2`
Format	qcow2 (KVM/QEMU)
Integrity	SHA-256 published with download entitlement
Access	Request via official site contact (not anonymous public mirror)

9. Documentation set

Document	Contents
User / Client Guide	First login, dashboard, day-2 operator flows
Admin Guide	Deployment, HA, identity, policies, capacity, roadmap
System Specifications	This document
CISO One-Pager	Executive brief (EN / FR / AR)

10. Roadmap (high level)

Production hardening and stronger IdP (Azure AD / SAML / OIDC)
Harder filter bypass resistance; safer AI-tool use (ChatGPT / Copilot)
Private access (ZTNA), multi-site fleet, richer SIEM / audit packs
Sector packs (banks, government, education, partners)

Next step: Request a pilot · email kabdi.kalboddine@gmail.com