Doushi is like Lovable, but for Machine Learning. Instead of writing hundreds of lines of code or setting up servers, you simply describe what you want to predict in natural language and upload your dataset (CSV, Excel, Parquet). Doushi cleans your data, finds the best AI model, and gives you an instant live API.

Do I need data science or machine learning experience?

Not at all. Doushi is designed for software engineers, product managers, and founders as well as data professionals. You can chat with the AI in plain English to ask questions about your model, understand why predictions are made, or test live samples directly in conversation.

How do I test my model before using it in production?

Every model comes with an interactive live simulator. You can drag sliders and adjust sample inputs right in your browser to see how predictions change in real time, along with plain-English explanations of why.

How does the hosted REST API work?

When you are satisfied with your model, deploy it with one click. You get a secure HTTPS endpoint and an API key to integrate into your application immediately.

Is my data safe and private?

Yes, 100%. All servers and storage infrastructure are hosted in Germany (Frankfurt, EU) in full compliance with strict European data protection standards (GDPR / DSGVO). Your datasets and model weights are encrypted in transit and at rest in isolated sandbox environments, used exclusively to train your specific models, and never shared, sold, or used to train public AI models. You retain full intellectual property ownership of all your data and models.

Platform & Security 2 min read

Docker Sandbox Security & Architecture

Deep dive into doushi.ai container isolation architecture, Linux cgroups, ephemeral memory limits, zero outbound network access, and German ISO 27001 data center operations.

Security Guarantee: All model training, data preprocessing, and evaluation runs inside ephemeral, unprivileged Docker containers isolated from host infrastructure. Containers have zero outbound internet connectivity and are destroyed upon task completion.

Architectural Overview

               HTTPS (TLS 1.3)
[User Client] ────────────────► [API Gateway (Frankfurt)]
                                        │
                                        ▼ (gRPC internal)
                              [Job Orchestrator]
                                        │
                         ┌──────────────▼──────────────┐
                         │   Ephemeral Docker Sandbox  │
                         │   - User: UID 1001 (No Root)│
                         │   - System Root: Read-Only  │
                         │   - Memory Cap: 4 GB        │
                         │   - Egress: Disabled        │
                         │   - Storage: Tmpfs (RAM)    │
                         └──────────────┬──────────────┘
                                        │
                                        ▼
                         [Serialized Model Artifacts]
                         (Sandboxed container shredded)

Security Boundaries & Hardening Controls

1. Non-Root Execution (`UID 1001`)

Training containers run under an unprivileged non-root user (appuser, UID 1001:GID 1001). Even in the event of an attempted container breakout vulnerability, the process possesses no root privileges on the Linux host.

2. Read-Only Root Filesystem

The container root filesystem (/) is mounted strictly as read-only. Temporary files, intermediate dataframe arrays, and model checkpoints are written exclusively to memory-backed tmpfs mounts that vanish when the container halts.

3. Outbound Network Isolation (Air-Gapped Sandbox)

The Docker network driver for training containers is set to --network none.

Outbound socket creation is blocked at the Linux kernel level.
No training script or imported dependency can phone home or exfiltrate customer records.

4. Linux Kernel cgroups & Seccomp Profiles

CPU & Memory Constraints: Each job is limited to 4 vCPUs and 4 GB RAM. If a rogue dataset consumes memory past the ceiling, the container terminates safely without affecting neighbor processes.
Seccomp Filters: Dangerous system calls (ptrace, sys_admin, mount, reboot) are blocked by a custom seccomp profile.

German / EU Hosting & ISO 27001 Certification

All servers are housed in Tier-3 data centers located in Frankfurt am Main, Germany:

ISO 27001 certified physical security, biometric access controls, and redundant power grids.
SOC 2 Type II certified operational policies and audits.
Full compliance with the European Union General Data Protection Regulation (GDPR / DSGVO).

For complete privacy terms and Data Processing Addendums, visit our Privacy & Security page.

← Previous TopicAutomated Data Cleaning & Feature Engineering Next Topic →Exporting Python Code & Standalone Models

Need help with your dataset or API integration?

Contact Support GitHub Community