Air-Gapped AI: Running a Governed Assistant With No Data Leaving the VPC

Some environments can't send data to an outside service at any volume, for any reason — defense, critical infrastructure, the most regulated corners of finance and health. For them, the cloud-AI model is a non-starter, and 'we encrypt it in transit' misses the point: the requirement is that nothing leaves at all. Air-gapped AI meets that requirement by running the entire system inside your own perimeter. (We use "air-gapped" in the practical sense of no outbound path to any external service; a strict, physically-isolated air gap is the extreme end of that same idea.)

When "encrypted in transit" isn't enough

For most organizations, sending data to a vendor over an encrypted connection is an acceptable risk. For some, it isn't — not because the encryption is weak, but because the data leaving the boundary is itself the thing they can't allow. In a classified network, a critical-infrastructure control environment, or a bank's most sensitive enclave, the acceptable amount of data crossing to an external service is zero. No SLA or encryption claim changes a zero into an allowance.

What air-gapped actually requires

Air-gapped AI means every part of the system that touches data runs inside your perimeter, with no dependency on an outside service to function:

• Inference — the models run in your environment, so prompts are never sent out to be answered.
• Retrieval — the knowledge and the search over it live inside the boundary.
• Governance — security, access control, and the audit ledger all operate locally.

If any of those reaches out to a hosted service to work, it isn't air-gapped — it's a cloud system with extra steps.

Governed, not just isolated

A crucial point: air-gapped doesn't mean ungoverned. Isolation removes the external-exposure risk, but the internal risks — an assistant leaking data across access boundaries, a prompt injection, an unlogged decision — don't disappear just because the environment is disconnected. So the full governance stack has to run inside the gap too. Air-gapped AI is a governed control plane that happens to run entirely offline, not a raw model dropped into a secure network.

The trade-offs, stated honestly

Running everything locally has real costs worth naming. You provision and maintain the infrastructure the models run on. Model choice is bounded by what you can host rather than every hosted API. Updates arrive through your controlled process rather than automatically. These are deliberate trade-offs, accepted because the alternative — data leaving the boundary — is unacceptable for the environment. For most organizations they'd be needless; for these, they're the price of operating at all.

Self-hosted as the foundation

Air-gapped is the strict end of a spectrum that starts with self-hosting. Because the control plane is designed to run inside your own environment, tightening that to a fully disconnected deployment is a matter of degree, not a different architecture. The same platform that runs in your VPC can run with no outbound path at all — which is why 'own the boundary' is the foundation that makes 'no data leaves' achievable.

Let nothing leave the boundary. See how a governed control plane runs inference, retrieval, and audit entirely inside your perimeter — a capable assistant that never phones home. Book a walkthrough.