// Research / Trust, PII & Safety
On-prem LLM deployment that finishes when the network is unplugged.
Most LLM stacks assume outbound HTTPS at install time. Yours can't have it. We deliver signed install bundles, an offline model registry, FIPS-validated crypto, and runbooks that don't depend on a DNS lookup.
// What we see
The stack works in dev. Then the network gets cut.
01
The install assumes outbound HTTPS
Helm pulls from Docker Hub, wheels from PyPI, the model loader hits Hugging Face. On the air-gapped network it sits at 0%, then errors - the fix is rearchitecting the bundle.
02
Updates become a quarterly fire drill
Pulling a new model means sneakernet drives, re-signing bundles, and a four-hour change window. Teams default to never updating - until the security team finds a CVE in a transformer dependency.
03
Audit logs go to a vendor cloud
Traces ship to Datadog, LLM telemetry to a SaaS dashboard - off-network at install time, unacceptable at audit time. Retrofitting your SIEM becomes a two-month project.
// Case Study
We trained EasyDocs' invoice extraction model
EasyDocs is the platform provider - they ship document management software to their own customers. We trained the fine-tuned NLP model that runs inside it, auto-extracting VAT numbers, totals, and addresses from invoices and learning from every user correction. Deployed on their servers, no external dependencies.
98%
field-level extraction accuracy
<300ms
inference time per invoice
On-prem
deployment with no external dependencies
// What we do
Three things that decide whether the air-gapped install ships.
Most on-prem failures aren't model-quality failures. They're install-bundle failures, update-cadence failures, and audit-trail failures. We design from the assumption that nothing reaches the internet.
Signed install bundles, zero egress
One fully signed artifact - the install verifies provenance and finishes with zero outbound packets.
- cosign + TUF root signing
- Every dependency pinned by hash
- OS packages, wheels, OCI images, model weights mirrored locally
Updates without internet
Signed delta bundles carried across the gap - update cadence becomes routine.
- Deltas for models, code, and CVE patches
- Local registry verifies signature before applying
- Automatic rollback on health-check failure
Audit logs into your SIEM, not a vendor cloud
Every inference, model load, and key access lands where your responders already look.
- Splunk, Elastic, QRadar, or your existing parser
- Append-only with hash chaining
- Tamper detection wired to your runbook
// Method fit
Air-gapped isn't the right deployment for every privacy concern.
skip it if
Your data can stay in a private VPC
If your security team accepts AWS/GCP/Azure, a managed LLM (Bedrock, Vertex, Azure OpenAI) gives the compliance posture without on-prem ops.
Your concern is third-party API exfil
If the problem is customer text going to OpenAI, an egress-side PII redactor addresses it without standing up GPUs.
PII Redaction & LLM Data PrivacyYour model needs change weekly
Air-gapped update cadence is days-to-weeks. If you're iterating on the model weekly, the friction dominates - stabilize model selection first, deploy on-prem second.
use it if
On-prem fits when data sovereignty or accreditation is non-negotiable, the network can't reach the internet, you need FIPS-validated crypto and SIEM-native audit, and your models are open-weight or your-weights.
// How we work
BoM first. Bundle next. Hand off the runbooks.
Every air-gapped engagement starts with the constraints that are expensive to undo - hardware envelope, accreditation target, network topology. The model and the install plan come after those are written down.
01
BoM and accreditation review (week one)
Hardware sized against target throughput, bundle aligned to your accreditation paperwork (FedRAMP, IL4, ISO 27001, sectoral). A signed BoM your CISO approves before any image is built.
02
Build and verify in your environment
All work runs in your network, on your hardware, with your operators paired in. Every artifact is signed before crossing the gap. Your team owns the runbooks by week three.
03
Hand off the operating model
Install bundle, offline registry, SIEM forwarders, runbooks for incident / patch / model rotation, and a quarterly support cadence with documented SLAs. Slack for 30 days after delivery.
// Expert insight
“Air-gapped is not a checkbox - it's an architecture choice that affects every dependency you pull. Most teams discover at install time that their stack assumes outbound HTTPS. We start from the assumption that nothing reaches the internet, and the deployment finishes the same day.”
Karol Gawron
Head of R&D @ bards.ai
// Why bards.ai
98% extraction accuracy, fully on-prem, already shipped.
Air-gapped projects punish ramp-up time - there's no Stack Overflow tab on the secured network. We've learned the constraints at EasyDocs, in defense-adjacent environments, and in regulated finance.
Production on-prem deployments
EasyDocs runs our document-AI stack fully on-prem at 98% extraction accuracy - the same signing, registry, and audit pipeline we ship every customer.
16+ open-source models we own end-to-end
bardsai/eu-pii-anonymization-multilang and 15 more on Hugging Face - no dependence on someone else's hosted API for the critical path.
Badges-at-the-door experience on every seat
Every person on your engagement has shipped to secured environments and worked a change-control board - in defense-adjacent environments and regulated finance.
// FAQ
Common questions about air-gapped deployment
Technical work usually runs 4-6 weeks (bundle hardening, BoM signoff, runbook authoring, paired install). Total wall-clock is dominated by your accreditation timeline. Environments with ATO precedent for similar stacks land closer to 4 weeks; greenfield accreditations stretch to 10.
Depends on the model and throughput. Llama 3 70B at moderate concurrency: 4-8 H100s or equivalent A100/MI300X per replica. Smaller fine-tuned models or PII workloads: a single L40S or A10 per service. We deliver a sized BoM after a discovery call - vendor-neutral, two or three options at different price points.
Signed delta bundles. We publish a new version on our side, sign it, your operator brings it across the gap on whatever media policy allows. The local registry verifies the signature, applies the delta, and rolls back automatically on health-check failure. Cadence is typically quarterly with out-of-band patches for CVEs.
FIPS 140-2 validated crypto across the stack, by default. IL4/IL5 is an environment classification, not a software certification - we've deployed components into IL4-aligned networks and have BoM documentation that fits FedRAMP-style paperwork. For IL5 specifically we work with the customer's accreditor on the gaps.
// Related services
Adjacent problems we solve
- Learn more
Trust, PII & Safety
PII Redaction & LLM Data Privacy
Neural PII detection in 20+ languages with reversible tokenization and audit logs - the LLM never sees what it doesn't need.
- Learn more
Trust, PII & Safety
LLM Guardrails & Safety
We measure where Llama Guard drops on your fine-tune, train custom classifier heads that answer in under 10ms, and red-team both chat and agent surfaces.
- Learn more
Trust, PII & Safety
EU AI Act & GDPR Compliance
Risk classification, technical documentation, and post-market monitoring produced from your CI/CD - in place before the August 2026 deadline.
// Let's ship it
Working LLMs behind a sealed network.
Send the network constraints, hardware envelope, models, and audit posture - a sized BoM and a deployment plan come back, usually within a business day.
- Engagements from
- $40K
- Typical range
- $40K-$150K
- Duration
- 4-8 weeks
Fixed-fee proposal after the first scoping call. Scope drivers: hardware envelope, multi-tenancy, accreditation depth, greenfield SIEM/HSM integrations. Hardware is separate..
Karol Gawron
Head of R&D @ bards.ai