Air-gapped deployment of open-source apps, operated

Open-source and source-available apps on disconnected sites: signed releases through your controlled transfer, the Pilae Agent on a locally hosted model, and the console inside your perimeter.

Start with one workload Book a 30-minute briefing

Connection: None outbound, by design
Releases: Signed, delivered through your transfer process
Agent model: Hosted locally, inside the perimeter
Plan: Enterprise

Operated, without a line to the outside

Some networks never touch the internet. The apps on them still need upgrades, security fixes, backups and someone who answers when they fail. Pilae brings all of that inside the perimeter and leaves the gap intact.

Nothing leaves the site

Application data, logs, metrics and the audit trail stay on your machines. No telemetry is sent out, because there is no route for it.

Signed releases

Every app release, recipe and agent update is packaged and signed by Pilae. Machines inside the perimeter refuse anything whose signature does not verify.

Your transfer process

Releases cross the gap the way your security team decides: removable media, a data diode or a one-way transfer station, with checksums for each package.

The agent, on a local model

The Pilae Agent runs inside the perimeter on a model hosted on your own GPU machines. It plans, waits for approval and records, exactly as it does elsewhere.

The console inside

A dedicated instance of the control plane runs on your site: apps, machines, deployments, backups and audit, for your team and for our engineers on site.

Backups on your second site

Encrypted daily backups go to storage you own at a second location inside the perimeter. Restore tests run every month and are recorded in the console.

The gap stays closed

An air gap is a decision your organisation made for a reason. We do not ask you to open it for our convenience. The apps, the control plane, the Pilae Agent and the model it plans with all run on your machines, and every piece of software reaches them through the transfer process you already trust.

Each release is signed by Pilae and carries its checksums. Your transfer officer can verify a package before it crosses, and the machines inside verify it again before they install it.

Where your own teams build software inside the gap, the tools for it run there too: GitLab for code and pipelines, Harbor as the registry for images that have crossed and been scanned, and OpenBao for the secrets and certificates your services need. We operate them like any other app on the site.

The same operations, inside the perimeter

Disconnected does not mean unmaintained. The agent reads the release notes that arrive with each package, checks them against your configuration, writes a plan with a rollback and waits for your approval, the same way it works on premises with a connection. Backups are taken before every change and restored every month as a test.

When the agent needs a model, it uses one hosted on your own GPU machines. That is the same approach we use for private AI on your servers, and it means your prompts and logs never leave the site.

Built for sites that answer to someone

Defence suppliers, research facilities, critical infrastructure operators and public administrations often run networks that must stay disconnected. Our operations are built to ISO 27001 controls, and our security page describes them in detail. Air-gapped deployment is part of the Enterprise plan, and pricing is on request, as our pricing page explains. Tell us about your site and we will scope it.

How an air-gapped deployment runs

Scope
We agree the apps, the machines, the transfer process, the access rules and the maintenance windows with your IT and security teams.
Build
We prepare signed installation bundles for your apps, the control plane, the agent and its local model, and verify them with your team.
Install
Our engineers install on site or through your jump host, harden the machines and hand over the console inside the perimeter.
Transfer
Each release and security fix is signed, listed with its checksums and passed through your transfer process on the agreed schedule.
Operate
The agent plans each change on its local model, your approvers say yes, and the change is applied in your window and recorded.

What your contract includes

Security releases: Critical fixes for the apps we operate are packaged, signed and made ready for your transfer process within the time your plan specifies.
Availability: The 99.9% monthly availability commitment with service credits, where the hardware and access arrangements meet the agreed specification.
Incident response: Around-the-clock incident response, through on-site presence, your jump host or the channel your security team approves.
Engineer: A named Pilae engineer who knows your site, its transfer process and its access rules.
Audit trail: Kept inside the perimeter and exportable to your SIEM on the same site.
Exit: A written exit plan, with your data, configuration, recipes and runbooks handed over in open formats.

The apps behind it

Open WebUI

A chat interface over models you host, so prompts and the documents people paste into them never leave your network.

Replaces ChatGPT Team, Microsoft Copilot

Nextcloud

Files, calendars and shared documents for the whole organisation, on storage you can point at in a room you control.

Replaces Google Drive, Dropbox, SharePoint

Keycloak

Single sign-on for everything else you run, with your own directory as the source of truth and no per-seat bill between you and it.

Replaces Okta, Microsoft Entra ID

Harbor

A private container registry that scans and replicates your images and caches Docker Hub, run in Switzerland, the EU or your own datacentre.

Replaces Docker Hub, Amazon ECR, Azure Container Registry

OpenBao

Secrets, certificates and encryption keys for your applications, run on your own hardware or in a Pilae region, with the unseal keys held by you rather than by us.

Replaces HashiCorp Vault, HCP Vault Dedicated, AWS Secrets Manager

GitLab

Git repositories, merge requests, CI/CD pipelines and registries in one application, run on your own hardware or in Swiss and EU regions, with runners on machines you place.

Replaces GitHub Enterprise Cloud, GitLab.com, Azure DevOps

Mattermost

Team chat, channels and calls on a server in the country you choose, with the message history stored in your own database.

Replaces Slack, Microsoft Teams

Outline

A fast, well-structured team wiki and knowledge base, on a server you choose, signed in through your own identity provider.

Replaces Notion, Confluence

Vaultwarden

A password manager for the whole organisation, compatible with the Bitwarden apps, on a server you choose and with vaults only your people can decrypt.

Replaces 1Password, LastPass

Questions

Can Pilae operate apps in a fully air-gapped network?

Yes. Air-gapped deployment is part of the Enterprise plan. The apps, the control plane, the Pilae Agent and its model all run inside your perimeter, and nothing needs an outbound connection.

How do updates and security fixes reach an air-gapped site?

Pilae packages and signs each release, lists its checksums, and hands it over through the transfer process your security team defines. Machines inside the perimeter install only packages whose signature verifies.

Which AI model does the agent use without internet access?

An open-weight model hosted on GPU machines inside your perimeter. We size the hardware during scoping. No prompt, plan or log line leaves the site.

How do Pilae engineers work on the site?

On site, or through a jump host you control, with a named account per engineer. You decide when access is open, and every session is recorded in the audit trail inside the perimeter.

How are alerts handled if nothing can leave the network?

Probes run every 60 seconds inside the perimeter and alert your on-site team through your own channels. Where your security rules allow a one-way alert path, Pilae engineers receive them too. We agree the arrangement during scoping.

Do third-party services receive any data from an air-gapped site?

No. External services need a connection to the outside, so they play no part in an air-gapped deployment, and the machines are yours rather than Pilae Cloud machines. Your data stays on your site.

Platform

Run open-source apps on a network that stays closed.

Thirty minutes with an engineer to go through your site, your transfer process and the apps you need.