Safer internet — by design.

Small offices & clinics

Controlled outbound destinations for staff, shared devices, and visitor networks.

Guest Wi-Fi & public spaces

Safer browsing for visitor networks, libraries, waiting areas, and shared community spaces.

Schools & training

Controlled access designed for focused use and reduced exposure.

Elderly & assisted living

Controlled browsing without requiring users to make complex security decisions.

Homes & families

Consistent protection for devices on the same Wi-Fi network.

Older PCs still in use

SafePi can help older computers browse more safely by allowing only explicitly trusted web destinations.

SafePi does not replace operating system updates or antivirus software.

1) Proxy filtering (SafePi Basic)

In Basic mode, SafePi provides allowlist-based protection for normal web browsing by allowing only explicitly trusted web destinations through the local proxy.

Basic mode requires a small per-device setup: set the SafePi proxy IP and port in your device's network settings.

SafeDNS Filtering is an optional, separate DNS-level protection layer powered by the open-source Pi-hole® engine. Without the SafePi Shield Router, each device — or your existing router — must be configured to use SafePi as its DNS server for SafeDNS Filtering and DNS-based features such as SafeSearch Guard to apply.

With the SafePi Shield Router, devices connected to the Safepify network use SafePi DNS automatically, so no per-device DNS configuration is required.

2) Maintained trust model

SafePi includes a Safepify-maintained default allowlist covering common global services, selected infrastructure needed for legitimate services to work, and services relevant to the country where SafePi is used. For example, a SafePi used in Finland can receive support for Finnish services such as Finnish banks, without automatically including country-specific services intended for Estonia.

Administrators can add device-specific custom domains from the SafePi web interface. These custom approvals are merged into the final active allowlist shown on the device.

For advanced control, SafePi supports Git-based SafeList Sync. When enabled, the Git SafeList replaces the maintained Safepify base allowlist for that device, while device-specific custom approvals can still be added locally.

Optional policy rules can schedule different Git SafeLists, apply stricter browsing windows, filter explicit results from common search engines, limit YouTube to a more restricted viewing mode, or switch the device into block-all mode outside approved times. Policy and SafeList changes are audited for inclusion in the Security & Transparency report.

3) Local management

SafePi is managed through a local web interface available only within your network (LAN) at http://safepi.local. It is not exposed to the internet.

Administrators can review blocked requests in real time, adjust allowlists, enable or disable optional features, and manage subscription plans from the interface.

A dedicated setup page at http://safepi.local:8080/setup provides clear instructions for configuring proxy settings on devices.

SafePi updates

SafePi components — including backend logic and the web interface — are updated automatically to improve functionality and compatibility over time.

Updates are applied locally on the device and do not require cloud control. Operating system updates are managed separately.

SafeSearch Guard

SafeSearch Guard locks Google, Bing, and YouTube to safe search mode network-wide. Users on the network cannot turn it off — it is enforced at the DNS level, not just suggested.

With the SafePi Shield Router, every device that joins the Safepify network is covered automatically. Without the router, SafeSearch works for any device or router that uses SafePi as its DNS server.

Requires SafeDNS Filtering to be enabled. Available with SafePi Plus.

Google SafeSearch · Filtering on 🔒 · Verified on Safepify network · google.com/safesearch

SafeVPN Guard (kill switch)

When Mullvad VPN is active, SafeVPN Guard ensures that if the VPN connection drops, all outbound traffic stops immediately — no silent leaks to your real IP.

Implemented locally on SafePi via nftables. No router required. Available with SafePi Plus.

Scheduled SafeLists

With Git-based SafeList Sync, SafePi can use policy rules to change protection automatically depending on time and need.

For example, a device can allow approved websites during opening hours and switch to block-all mode outside those hours.

schedules:
  - name: opening_hours
    days: [mon, tue, wed, thu, fri]
    time: "09:00-17:00"
    allowlist: allowlist.txt
  - name: default
    allowlist: none

Policy rules can also filter explicit search results, limit YouTube to a more restricted viewing mode, or select different Git SafeLists for different situations. Policy and SafeList changes are audited for inclusion in the Security & Transparency report.

PIN-protected changes (Parent Guard)

Optional PIN protection can restrict sensitive actions, helping prevent unauthorized configuration changes.

Useful in family, public, and assisted-living environments.

Live visibility

SafePi provides clear visibility into network activity so administrators can understand why requests were allowed or denied.

In Basic (proxy) mode, SafePi shows live proxy denies. In SafeDNS Guard mode, SafePi shows live kernel drops.

If SafeDNS Filtering is enabled, SafePi also shows live DNS denies.

A dedicated statistics view summarizes blocked requests, allowed traffic, and the most active devices on the network.

SafePi Live Display

Connect any HDMI TV or monitor to SafePi and get an always-on status screen showing protection activity in real time — no login, no app, no configuration required.

The display shows active protection layers, blocked traffic, device activity, a 24-hour timeline, and outbound VPN exit location at a glance.

Designed for waiting rooms, front desks, and shared spaces where visible protection builds confidence — for staff and visitors alike.

SafePi Live Display · All protection layers active · 24h blocked timeline

Page Doctor & diagnostics

The built-in Page Doctor analyzes blocked requests and can suggest which domains may be required for a page to function correctly, helping restore legitimate services while keeping the allowlist minimal.

When investigating unknown destinations, SafePi can also display additional IP intelligence such as hosting provider information and infrastructure signals.

Direct support from the interface

Send a support request directly from the SafePi interface — no separate email or ticket system. Messages go straight to the Safepify team.

Available with SafePi Plus.

Plans & billing

Optional subscription plans can be managed from the interface, including upgrades and cancellations.

Billing is handled through a secure payment provider.

Local by design

The SafePi management interface is available only within your local network (LAN) and is not exposed to the internet.

SafePi does not rely on traditional login accounts or stored credentials. Access is limited to the local network, and sensitive actions can be protected with an optional PIN (Parent Guard), reducing unnecessary attack surface.

SafePi Plus

€14.99 / month

• SafeSearch Guard — locks Google, Bing & YouTube network-wide
• SafeVPN Guard — kill switch for Mullvad VPN
• Git-based SafeList sync
• Scheduled SafeList policies
• PIN protection (Parent Guard)
• Direct support via the SafePi interface

SafeSearch Guard works on any device using SafePi as DNS. With the Shield Router, every device on the Safepify network is covered automatically.

SafePi Shield

€39.99 / month

Requires SafePi Shield Router

• Everything in Plus
• SafeDNS Guard — full network-level enforcement
• Fail-closed protection — unknown destinations blocked by default
• Prevents DNS and VPN bypass
• SafePause — cut all client internet access instantly from the dashboard

Do I need to configure every device?

With SafePi Basic, proxy protection requires the SafePi proxy IP address and port to be configured on each device that should use it.

SafeDNS Filtering and DNS-based features such as SafeSearch Guard require devices to use SafePi as their DNS server. Without the Shield Router, this can be configured on individual devices or, where supported, centrally on your existing router.

With the SafePi Shield Router, devices connected to the Safepify network are directed through SafePi automatically, so no per-device proxy or DNS configuration is required.

What happens if SafePi blocks a legitimate website or service?

SafePi prioritizes predictable, controlled internet access over unrestricted internet access. A legitimate website or application can therefore occasionally depend on a domain or backend service that has not yet been approved.

SafePi provides live deny information and Page Doctor to help identify what was blocked and keep additional approvals as limited as possible. SafeDNS Guard is intentionally stricter than Basic proxy mode and may expose more of these service dependencies.

Is SafePi a replacement for a firewall or antivirus?

No. A traditional firewall primarily controls who may initiate connections into your network. SafePi complements this by controlling where protected devices are allowed to initiate connections to.

SafePi also does not replace operating system updates, endpoint protection, secure passwords, or other normal security practices.

What is the difference between SafeDNS Filtering and SafeDNS Guard?

SafeDNS Filtering is optional DNS-level filtering powered by the open-source Pi-hole® engine. It blocks many advertising, tracking, and other unwanted domains using DNS blocklists.

SafeDNS Guard is the stricter Shield feature. It applies allowlist-based policy at the network level, restricts destinations that have not been explicitly trusted, and reduces common bypass paths such as external DNS and direct connections. SafeDNS Guard requires the SafePi Shield Router and a SafePi Shield subscription.

Why use an allowlist instead of only blocking known bad sites?

Blocklists depend on identifying a destination as unwanted or malicious before blocking it. An allowlist reverses the decision: destinations that have not been trusted are denied by default.

This reduces the set of destinations a protected device can contact, but it also means that new legitimate services may occasionally need approval.

Can applications bypass SafePi Basic?

Some can. SafePi Basic protects traffic that uses the configured proxy. Applications and system services that ignore proxy settings can communicate outside that path, and QUIC/HTTP-3 and direct IP connections are not covered by traditional proxy filtering.

SafeDNS Guard with the Shield Router is intended for environments where stricter network-wide enforcement and fewer bypass paths are required.

Does SafePi inspect page contents or send browsing data to Safepify?

SafePi's filtering and logging are performed locally on the SafePi device. The management interface is available only on the local network.

SafePi receives updates to the Safepify-maintained default allowlist, which is adapted to the country where SafePi is used. This is separate from SafeList Sync: the optional Plus feature synchronizes the customer's own Git-based allowlist to SafePi, and Safepify does not manage the contents of that customer-maintained SafeList. Browsing history, page contents, and traffic data are not sent to Safepify as part of the filtering service.

Do I need a subscription?

No. SafePi Basic is a one-time hardware purchase and its Basic protection works without a monthly subscription.

Plus and Shield are optional service levels for additional features. Shield is required for SafeDNS Guard and requires the SafePi Shield Router.

Can I keep my existing router?

Yes. SafePi Basic does not require the Shield Router. If you add a SafePi Shield Router, it creates a separate Safepify Wi-Fi network alongside your existing network rather than requiring you to replace or reconfigure your main router.

Who is SafePi intended for?

SafePi is designed for environments where controlled and understandable internet access is more important than unrestricted connectivity — including small offices and clinics, guest and public networks, schools, assisted-living environments, and homes.

It is particularly suited to networks where a local administrator wants to decide which destinations are trusted and have visibility into what is being denied.