A standard SaaS contract assumes your data can leave the building. For defense, classified government, regulated healthcare, finance and critical infrastructure, that assumption is the problem. We install the same proven software stack with zero outbound connectivity, signed offline updates and a chain-of-custody you can hand to an auditor.
An air-gapped system is one with no network path — physical or logical — to anything outside the trust boundary. No internet. No corporate VPN. No vendor "support tunnel" that quietly checks in once a day. The only thing crossing the gap is what your security officer signs off on, when they sign off on it, on media they choose.
It's the configuration banks use for HSM enclaves, that classified networks use for SIPRNet, that nuclear plants use for safety systems. Done right, it makes most modern threats irrelevant: ransomware can't dial home, exfiltration can't reach the internet, and supply-chain compromises can't auto-update themselves into your environment.
The trade-off is operational. Air-gapped systems are harder to install, harder to update, and harder to monitor. That's the work we do.
Most teams don't actually need a SIPRNet-grade air gap. We offer three deployment postures and help you pick the one that matches your real threat model. You can move between them later as needs change.
Standard private deployment. Your VPC, your region, your DNS — but with normal outbound traffic for updates, mail relays and SSO.
No vendor traffic, no telemetry. Egress is limited to a small, allow-listed set of internal services — typically your IdP, mail gateway and update proxy.
The literal configuration. The protected network has no route to the internet, no route to your corporate LAN, and the only ingress is a sealed jump host with strict change control.
If your operating environment lists "no outbound traffic" as a control, or your legal team has redlined "vendor access" out of every contract for the last three years, the rest of this page was written for you.
Programs operating on networks where SaaS is categorically prohibited. Helpdesk, ticketing, classroom and ERP on the right side of the diode.
ITAR · CMMC · IL4 — IL6 · SIPRNet-adjacentSovereign-cloud or on-prem deployments where data residency is a statute, not a setting. Configurable for FedRAMP-aligned, EU-only or GCC-only operation.
FedRAMP-aligned · UK Official-Sensitive · EU sovereignHospitals, payers, clinical research, GMP manufacturing. PHI never traverses an internet link it shouldn't, and audit logs are ready before the regulator asks.
HIPAA · HITECH · 21 CFR Part 11 · GxPRegulated business lines, brokerages, payment processors, and any team whose risk register has "third-party SaaS data egress" near the top.
SOX · PCI DSS · MiFID II · DORAEnergy, water, transport, manufacturing — anywhere an IT system sits next to operational technology and an air gap is the safety control.
NERC CIP · IEC 62443 · NIS2Privileged client data, M&A data rooms, sensitive litigation. Strict tenancy guarantees with no cross-tenant inference and no third-party LLMs by default.
ABA Model Rule 1.6 · SRA · attorney-client work productInstitutes holding student records, exam material, controlled-unclassified research (CUI) and grant-funded data with sovereignty clauses.
FERPA · CUI · export-controlled researchPublic sector and SOEs in countries with data-localisation laws. We deploy into your national cloud (or hardware) without ever leaving the jurisdiction.
GDPR Art. 28 · CN PIPL · IN DPDP · KSA NDMO · UAE DPLAn air-gapped install is not a different product — it's the same Zammad, Odoo and AI workloads (and Classverse, July 2026) we deploy everywhere else, fitted into a network with strict ingress and zero egress. The work is in the chain of custody, not the software.
We sit with your security officer to map the trust boundary, define the gap (physical, logical, or both), and pick the deployment posture. Output: a one-page topology you can show your CISO.
~1 weekWe build a deterministic install bundle with pinned versions, SBOM, and SHA-256 + GPG signatures. Tested end-to-end in a mirror environment that matches yours bit-for-bit.
SHA-256 · GPG · SBOMBundle moves through your sanctioned data-diode or sealed jump host. Your team verifies signatures on the receiving side. Nothing installs until you say so.
Two-person ruleCIS-benchmark baselines, role-segregated SSO from your local IdP, encrypted storage, least-privilege admin accounts. All deployment automation runs inside the gap.
CIS · STIG-alignedRunbooks, access matrix, change history, SBOM, and the signed offline-update process — printed and on encrypted media. You operate. We're a phone call away, by your choice.
Evidence packCompliant by configuration, not by promise.
We don't sell certifications — we configure the deployment to align with the frameworks your auditor uses.
If yours isn't here, a 20-minute call with us and your security officer is usually the fastest path.
Talk to a human →Most teams leave a 30-minute call knowing whether Level 02 is enough or they actually need Level 03 — and how much each would cost. No deck, no slide-ware. Bring your security officer.