Safer internet — by design.
SafePi is a local network security product developed by Safepify Oy. It helps make browsing safer by allowing access only to explicitly trusted destinations.
SafePi Basic already provides strong everyday browsing protection as a one-time purchase. Subscriptions are optional add-ons for SafeSearch enforcement, advanced control, and stricter network-level enforcement.
If a destination isn't trusted, the connection is blocked. Filtering happens locally on your network, keeping protection predictable and fully under your control.
SafePi is designed for homes, shared networks, and other environments where safety, clarity, and reliability matter more than managing security on every individual device.
- ✔ Strong everyday protection with SafePi Basic — no subscription required
- ✔ Automatic protection updates — with optional custom rules for advanced environments
- ✔ Local-first operation (LAN-only interface)
- ✔ Page Doctor explains blocked requests and suggests minimal approvals
- ✔ Optional SafeSearch Guard — locks Google, Bing, and YouTube network-wide
- ✔ Optional Shield Router for zero-config full-network protection
- ✔ Optional Mullvad VPN integration with kill switch
- ✔ Optional DNS filtering (powered by the open-source Pi-hole® project): blocks many advertising, tracking, and known unsafe domains using community-maintained blocklists
Local-first protection
Your data stays on your device
SafePi is designed so filtering and logging happen locally on the SafePi device inside your own network — not in a cloud dashboard.
Local processing
All filtering and logging happens locally on the SafePi device on your network.
LAN-only management
The management interface is only accessible from inside your LAN.
No cloud dependency
No cloud account or login is required for core protection.
- ✔ Browsing history, page contents, and traffic data never leave your network
- ✔ SafePi receives allowlist updates but does not send your traffic data outbound
- ✔ Local-first operation with LAN-only management
- ✔ Designed for GDPR-conscious deployments where local processing and data minimization matter
- ✔ Safepify Oy is a Finnish company
Built for networks that need safer browsing
SafePi is designed for environments where browsing should be safe and predictable — without relying on cloud-managed policy platforms or complicated setup on every device.
Homes & families
Consistent protection for devices on the same Wi-Fi network.
Elderly & assisted living
Strong protection without requiring users to make complex security decisions.
Schools & training
Controlled access designed for focused use and reduced exposure.
Guest Wi-Fi & public spaces
Safer browsing for visitor networks, libraries, waiting areas, and shared community spaces.
Small offices & clinics
Reduced phishing exposure for staff and visitors on shared networks.
Older PCs still in use
SafePi can help older computers browse more safely by allowing only explicitly trusted web destinations.
SafePi does not replace operating system updates or antivirus software.
Filtering happens directly on your network, and the management interface is only accessible from within it.
How it works
SafePi sits between your devices and the internet and applies a simple but strict rule: allow what is trusted, deny what is unknown.
SafePi can operate in Basic (proxy) mode or in SafeDNS Guard mode together with the SafePi Shield Router.
1) Proxy filtering (SafePi Basic)
In Basic mode, SafePi provides strong everyday protection for normal browsing by allowing only explicitly trusted web destinations through the local proxy.
Basic mode requires a small per-device setup: set the SafePi proxy IP and port in your device's network settings.
2) Maintained trust model
SafePi includes a maintained allowlist covering common global services, nationally relevant domains, and selected infrastructure needed for many legitimate services to work properly.
Administrators can add device-specific custom domains from the SafePi web interface. These custom approvals are merged into the final active allowlist shown on the device.
For advanced control, SafePi supports Git-based SafeList Sync. When enabled, the Git SafeList replaces the maintained Safepify base allowlist for that device, while device-specific custom approvals can still be added locally.
Optional policy rules can schedule different Git SafeLists, apply stricter browsing windows, filter explicit results from common search engines, limit YouTube to a more restricted viewing mode, or switch the device into block-all mode outside approved times. Policy and SafeList changes are audited for inclusion in the Security & Transparency report.
3) Local management
SafePi is managed through a local web interface available only within your network (LAN) at http://safepi.local. It is not exposed to the internet.
Administrators can review blocked requests in real time, adjust allowlists, enable or disable optional features, and manage subscription plans from the interface.
A dedicated setup page at http://safepi.local:8080/setup provides clear instructions for configuring proxy settings on devices.
Basic vs SafeDNS Guard
SafePi Basic makes decisions at the domain level through the proxy. This is often enough for normal browsing and many legitimate services.
SafeDNS Guard is stricter. It enforces policy at the network level and may occasionally require approval of legitimate backend infrastructure used by apps.
This stricter model reduces common bypass paths while keeping approvals visible and manageable.
When to choose SafeDNS Guard instead
SafePi Basic already provides strong protection for normal web browsing. Some applications and system services, however, may bypass proxy settings. In addition, QUIC / HTTP-3 traffic and direct IP connections are outside the scope of traditional proxy filtering.
For environments that need stricter network-wide enforcement with fewer bypass paths, SafePi offers SafeDNS Guard.
The Safepify network — safe by default, easy to manage
The SafePi Shield Router creates a separate Safepify Wi-Fi network alongside your existing one. Devices that connect to it are protected automatically — no proxy setup, no DNS changes, nothing to configure.
Your existing Wi-Fi network is never touched. If SafePi needs maintenance, devices can simply switch back to your main network — no lockout, no disruption.
This makes the SafePi Shield Router safe to deploy even in environments where touching the main router is not an option.
Managed, visible, and diagnosable
SafePi is built to be easy to operate day-to-day while still providing clear visibility into what is being allowed or denied.
SafePi updates
SafePi components — including backend logic and the web interface — are updated automatically to improve functionality and compatibility over time.
Updates are applied locally on the device and do not require cloud control. Operating system updates are managed separately.
SafeSearch Guard
SafeSearch Guard locks Google, Bing, and YouTube to safe search mode network-wide. Users on the network cannot turn it off — it is enforced at the DNS level, not just suggested.
With the SafePi Shield Router, every device that joins the Safepify network is covered automatically. Without the router, SafeSearch works for any device or router that uses SafePi as its DNS server.
Requires DNS filtering (Pi-hole) to be enabled. Available with SafePi Plus.
SafeVPN Guard (kill switch)
When Mullvad VPN is active, SafeVPN Guard ensures that if the VPN connection drops, all outbound traffic stops immediately — no silent leaks to your real IP.
Implemented locally on SafePi via nftables. No router required. Available with SafePi Plus.
Scheduled SafeLists
With Git-based SafeList Sync, SafePi can use policy rules to change protection automatically depending on time and need.
For example, a device can allow approved websites during opening hours and switch to block-all mode outside those hours.
schedules:
- name: opening_hours
days: [mon, tue, wed, thu, fri]
time: "09:00-17:00"
allowlist: allowlist.txt
- name: default
allowlist: nonePolicy rules can also filter explicit search results, limit YouTube to a more restricted viewing mode, or select different Git SafeLists for different situations. Policy and SafeList changes are audited for inclusion in the Security & Transparency report.
PIN-protected changes (Parent Guard)
Optional PIN protection can restrict sensitive actions, helping prevent unauthorized configuration changes.
Useful in family, public, and assisted-living environments.
Live visibility
SafePi provides clear visibility into network activity so administrators can understand why requests were allowed or denied.
In Basic (proxy) mode, SafePi shows live proxy denies. In SafeDNS Guard mode, SafePi shows live kernel drops.
If DNS filtering is enabled, SafePi also shows live DNS denies.
A dedicated statistics view summarizes blocked requests, allowed traffic, and the most active devices on the network.
SafePi Live Display
Connect any HDMI TV or monitor to SafePi and get an always-on status screen showing protection activity in real time — no login, no app, no configuration required.
The display shows active protection layers, blocked traffic, device activity, a 24-hour timeline, and outbound VPN exit location at a glance.
Designed for waiting rooms, front desks, and shared spaces where visible protection builds confidence — for staff and visitors alike.
Page Doctor & diagnostics
The built-in Page Doctor analyzes blocked requests and can suggest which domains may be required for a page to function correctly, helping restore legitimate services while keeping the allowlist minimal.
When investigating unknown destinations, SafePi can also display additional IP intelligence such as hosting provider information and infrastructure signals.
Direct support from the interface
Send a support request directly from the SafePi interface — no separate email or ticket system. Messages go straight to the Safepify team.
Available with SafePi Plus.
Plans & billing
Optional subscription plans can be managed from the interface, including upgrades and cancellations.
Billing is handled through a secure payment provider.
Local by design
The SafePi management interface is available only within your local network (LAN) and is not exposed to the internet.
SafePi does not rely on traditional login accounts or stored credentials. Access is limited to the local network, and sensitive actions can be protected with an optional PIN (Parent Guard), reducing unnecessary attack surface.
Safe by default
SafePi includes a maintained allowlist covering common global services, nationally relevant domains, and selected internet infrastructure needed for many legitimate services to work properly.
Allowlist approach
- Unknown domains are denied by default
- Known risky destinations can be excluded from default policies
- Administrators can extend access by adding trusted domains
SafePi applies allowlist rules locally. You can add or remove domains using the LAN-only web interface.
Optional DNS filtering
DNS filtering uses the open-source Pi-hole® engine to block many advertising, tracking, and other unwanted domains — without changing what you allow.
Pi-hole® is a trademark of Pi-hole LLC. SafePi is not affiliated with or endorsed by the Pi-hole project.
SafeDNS Guard
SafeDNS Guard upgrades SafePi from proxy filtering to network-level enforcement. Policy is applied at the router level — not just inside a browser or individual application.
Devices simply connect to the protected Safepify network provided by the SafePi Shield Router. No proxy configuration. No per-device software. No changes to your existing router.
Strict by design — without over-allowing
Most security tools try to block "bad" websites. SafeDNS Guard takes a different approach: it allows only trusted sites — and nothing else.
Modern websites depend on shared infrastructure such as content delivery networks. SafeDNS Guard handles this safely by separating:
- Trusted sites you approve (your actual destinations)
- Infrastructure helpers needed to make those sites work
SafeDNS Guard learns only what belongs to the site — not the shared infrastructure behind it.
Infrastructure is allowed only to keep sites working — but it is never treated as trusted itself.
This prevents accidental expansion of trust to large shared platforms.
Enforced, not suggested
- DNS policy is enforced across the network
- Direct IP connections can be restricted
- If a destination is not explicitly allowed, it does not pass
- Third-party VPN clients and external DNS resolvers typically fail by default, unless their required endpoints are explicitly trusted
This helps prevent silent bypasses where a device routes around policy by switching DNS or tunneling out.
Strict — and practical
SafeDNS Guard automatically handles many real-world service dependencies. When a trusted domain is allowed, SafeDNS Guard can automatically permit verified subdomains and their resolved IPs with expiry.
This helps legitimate services keep working even when infrastructure changes in the background.
Only shared cloud or CDN infrastructure that cannot be confidently tied to the trusted service may require manual review.
Clear visibility when you need it
In SafeDNS Guard mode, network-level blocks are shown in live kernel drops, where destinations are resolved into human-readable hostnames.
From there, administrators can review and add approvals when appropriate.
Page Doctor focuses on proxy-based analysis. SafeDNS Guard has its own dedicated enforcement view.
Approval history
SafeDNS Guard includes a paginated approvals view showing each allowed IP and hostname, including why it was added and when it expires.
Every entry can be copied or removed instantly. Keep policy minimal and reversible.
SafePause
SafePause lets you cut all client internet access instantly from the dashboard — with a single button. DNS filtering and local logging keep running. SafePi stays up and visible. Only outbound client traffic is blocked.
Useful for scheduled downtime, incidents, or enforced offline periods. Re-enable with the same button when ready. Requires the SafePi Shield Router. Available with SafePi Shield.
Built for controlled environments
SafeDNS Guard is designed for homes, schools, guest Wi-Fi, assisted living, and small organizations where consistent enforcement matters.
The SafePi Shield Router directs traffic through SafePi so policy remains enforced across the network while staying manageable for the administrator.
Optional privacy features
SafePi supports optional integration with Mullvad VPN for encrypted outbound traffic. With SafeVPN Guard, a kill switch ensures that if the VPN connection drops, all internet traffic stops immediately — preventing silent IP leaks.
VPN usage is optional and configurable from the local interface. SafeVPN Guard is available with SafePi Plus.
Security transparency
See exactly what SafePi does
SafePi generates a human-readable security report from your own network activity. The report explains what was blocked, why it was blocked, and whether suspicious behavior was detected — without showing browsing histories, page contents, passwords, or packet captures.
Anonymized sample report · 24h period · Proxy mode
"Most blocked activity observed during this period appears related to advertising, analytics, telemetry, or third-party web infrastructure."
The sample report was generated from a real SafePi deployment and automatically anonymized before export. Local IP addresses, device names, and identifying metadata were removed or generalized.
Pricing
Choose your SafePi hardware
Hardware works on its own. Optional subscriptions can be enabled later from the SafePi interface.
SafePi is not just a router setting. It is a dedicated local security gateway with allowlist-based browsing protection, live visibility, Page Doctor diagnostics, automatic SafeList updates, local reporting, and optional stricter network-level enforcement.
Unlike ordinary router parental controls, SafePi is built around a deny-unknown model: unknown destinations are blocked by default, changes are visible, and protection can be documented through a Security & Transparency report.
SafePi Basic
€299
One-time device purchase
No subscription required for core protection
- SafePi security gateway device
- Strong everyday browsing protection
- Allowlist-based filtering
- Automatic allowlist updates
- Local web interface (LAN-only)
- Real-time logs + Page Doctor
- Optional Mullvad VPN integration
- Optional DNS filtering (powered by the open-source Pi-hole® project)
- Optional upgrades available later
SafePi Complete System
€348
SafePi device + Shield Router
- SafePi device included
- SafePi Shield Router included
- Separate Safepify Wi-Fi network — existing router untouched
- No per-device setup required
- Ready for SafeDNS Guard and SafeSearch Guard
- Automatic full-network protection
Connect to Safepify. Everything is protected. Nothing to configure.
Buy Complete SystemSafePi Shield Router
€120
For existing SafePi device owners
- Creates a separate Safepify Wi-Fi network
- Routes all traffic through SafePi automatically
- No per-device setup required
- Existing router and network untouched
- Enables SafeDNS Guard, SafeSearch Guard, and SafePause
Optional feature plans
Subscriptions are optional. SafePi Basic works without any monthly plan.
SafePi Plus
€14.99 / month
- SafeSearch Guard — locks Google, Bing & YouTube network-wide
- SafeVPN Guard — kill switch for Mullvad VPN
- Git-based SafeList sync
- Scheduled SafeList policies
- PIN protection (Parent Guard)
- Direct support via the SafePi interface
SafeSearch Guard works on any device using SafePi as DNS. With the Shield Router, every device on the Safepify network is covered automatically.
SafePi Shield
€39.99 / month
Requires SafePi Shield Router
- Everything in Plus
- SafeDNS Guard — full network-level enforcement
- Fail-closed protection — unknown destinations blocked by default
- Prevents DNS and VPN bypass
- SafePause — cut all client internet access instantly from the dashboard
SafePi Shield uses SafeDNS Guard together with the SafePi Shield Router to protect the entire network. The router ensures all traffic flows through SafePi, preventing bypass via direct connections or external DNS. SafePi Basic and SafePi Plus operate in proxy mode and do not require the router.
Support
Need help with SafePi or a blocked website? Send a message and we'll respond as soon as possible.
Setup guidance is also available on your local network at http://safepi.local:8080/setup.
Built in Finland, for Finnish networks
Carl-Christian Grönholm
Founder, Safepify Oy · Finland
I built SafePi because I couldn't find a network security product that was honest about what it actually does, kept data local, and didn't require an IT department to operate.
I also wanted better protection for my own family network — including my 87-year-old mother, who still uses online banking and email independently.
SafePi is the kind of protection I wanted in my own home.
🇫🇮 Safepify Oy · Business ID: 3612963-1