What's Under the Hood
How your Sarudo instance is put together — what runs on your dedicated server, which services are Sarudo-managed, and which integrate with accounts you own.
What Runs Where
Your Sarudo instance is a dedicated Linux server with your own database, your own file storage, and your own configuration. On that server we run the Sarudo agent itself (a long-running process that handles Telegram messages), a FastAPI tool server exposing the endpoints documented throughout this site, a PostgreSQL database with pgvector for semantic search, a SearXNG metasearch engine for web search, a headless Chromium for local browser automation, and an Nginx reverse proxy. All of this is yours — nothing is shared with other Sarudo clients, no database multi-tenancy, no cross-customer data flow. If we stood up a hundred Sarudo instances tomorrow, they would be a hundred independent servers with a hundred independent databases.
The "dedicated infrastructure" promise in the Security & Privacy article is not marketing — every one of the services above runs exclusively for you, on your server, with your data.
The AI Model Stack
Your AI employee is powered by a stack of language models running under the hood — there is a primary model for reasoning and writing, and a fallback chain that takes over if the primary hits an issue. This stack is managed by Sarudo. You do not configure it, you do not bring your own API keys, and you do not pay for model usage — it is all included in the Sarudo subscription. The rationale is that swapping models is not something you generally want to be doing manually: the right model for a given role changes every few months as the providers update, and letting Sarudo keep the stack current means you always get whatever is best right now without having to think about it.
Included — no setup needed. Every model your AI employee uses is provisioned and paid for by Sarudo. You never see an API-key prompt for a model provider, you never pay a per-token bill, and you do not need to care what the current model lineup is.
Other Bundled Services
Beyond the LLM stack, a few other services are bundled with your Sarudo instance so they just work on day one — no separate signup, no API key handoff. Unsplash and Giphy power the Image Search capability (hero photos and reaction GIFs for blog drafts and social posts). Browserbase powers the cloud browsing escalation for bot-hostile sites (LinkedIn, X, Facebook/Instagram outside Publer, Glassdoor). Publer powers the nine-network social posting layer. SearXNG is self-hosted and handles web search. DataForSEO is the backend for the SEO research tools — this one is a client-provisioned account because it is per-client billed, but the integration itself is pre-wired. The "no setup needed" callouts scattered around this documentation all refer to this set.
What You Still Connect
The services that remain client-provisioned are the ones tied to your identity or your money. Your Twilio account (for phone numbers that are yours and per-minute call charges). Your Stripe account (payouts go to your balance, not through Sarudo). Your email account (the from-address on sent email is yours; deliverability follows your domain's reputation). Your Notion, Airtable, or Google Workspace (your own workspaces, with your access controls). Your lead-enrichment API keys (Apollo, Clearbit, Hunter — enrichment credits bill to your plans with each provider). DataForSEO (pay-per-task billing tied to your research activity). These are connected during onboarding, either during the human 30-day timeline or when a specific task first requires them.
The dividing line is simple: if it has to be yours because the outside world sees it as yours (a phone number, an email address, a payment destination) or because it costs per-use and should bill to your budget, it is a connection you set up. Everything else is already wired.
Updates and Upgrades
Your Sarudo instance is maintained by the Sarudo team, not by you. New capabilities, bug fixes, and reliability improvements are deployed to every client instance through a safe upgrade procedure that includes a pre-flight backup and automatic rollback on failure. You do not run migrations, you do not patch services, you do not approve kernel updates. If a specific upgrade needs your attention (a breaking change in an integration API, for example, or a migration that touches configuration you own), you will hear about it directly — otherwise the updates happen transparently and your AI employee simply gets better over time without asking you to do anything.