Air-gapped
A complete platform with no path to the outside world.
What it is #
An air-gapped deployment is not a connected platform with the cable pulled out. It is a platform whose dependencies all resolve locally by design. Model weights come from the private hub's content-addressed artefact store rather than an external host, secrets come from the instance's own vault, names resolve through platform-run DNS, and the app supply chain — packaging, signing, attestation and the registry — sits inside the boundary with everything else.
That is what makes the sealed case genuinely work rather than nearly work. Inference keeps serving, apps keep running, agents keep building, and the audit ledger keeps recording, with no route out. New model weights, platform releases and app artefacts cross the boundary as signed, attested media under a transfer process you own and witness.
Who it is for
- Your security case rests on the environment having no external connectivity at all.
- You handle material whose exposure is not a risk you are willing to price.
- You need AI capability in a facility where a network cable is a finding.
- You want to prove, not assume, that nothing calls home.
This is not a connected platform with the cable pulled out. Every dependency resolves locally by design.
What you get #
The whole platform runs here. These are the parts this pattern changes the shape of.
Inference with no upstream #
Models are imported once and served from the platform's own artefact store. There is no runtime dependency on any external model host, so generation keeps working fully isolated.
Local identity and secrets #
Sessions, bearer tokens and capability tokens are minted inside the boundary, and the operator-managed vault unseals itself without an external service.
A governed way in #
Artefacts arrive signed and attested, with a bill of materials, and are admitted by an explicit ceremony rather than an automatic pull.
Evidence that stays inside #
Metrics, traces, dashboards, alerts and the data-access audit ledger all resolve locally, so operators can see the platform without exporting anything.
The operating model #
Nobody should discover who owns a failure while it is happening. This split is explicit before anything is signed, and it is the part of a deployment decision that outlives the architecture.
- You operate
- The facility, the boundary, cleared operators, and the transfer ceremony that admits or exports anything at all.
- The operator handles
- Platform reconciliation, tenant composition, model placement, local backups and restore, entirely offline.
- We supply
- Signed platform releases, model artefacts and provenance material for you to admit on your own schedule.
- You keep
- Everything else, including keys, audit records and the decision to admit each artefact.