Air-Gapped AI
AI that works where the internet doesn't exist.
Some networks never touch the outside world: classified enclaves, ITAR programs, critical infrastructure control rooms. NetRay deploys and operates language models inside them, with an MLOps discipline built for environments where 'just download the update' is not a sentence anyone can say.
Air-gap changes everything about operations
In a connected deployment, model updates, security patches, and telemetry flow automatically. Behind an air gap, every one of those becomes a deliberate physical act: media prepared outside, scanned, signed, carried in, verified, and promoted. Most AI vendors have never operated this way. We have; our PCBSpot product runs in defense electronics facilities and has never made an external call.
The discipline that makes it work is a signed offline registry: every model, container, and dependency enters the enclave as a cryptographically verified artifact with a documented chain of custody, and gets promoted through staging exactly like connected MLOps, minus the network.
What runs well behind the gap
Everything that matters for enclave work: document Q&A over restricted corpora, technical manual assistants for maintainers, extraction and summarization pipelines, and coding assistants for developers who work inside the boundary. Open-weight models make all of it possible; the model never needs to phone home because there is no home to phone.
- Retrieval assistants over classified or export-controlled document sets
- Maintenance and depot-repair copilots (the PCBSpot pattern)
- Air-gapped coding assistants for cleared development teams
- Batch extraction pipelines over decades of scanned technical documents
The offline MLOps loop
Model improvement does not stop at the gap; it slows to a governed cadence. Evaluation sets live inside the enclave. Candidate models are benchmarked outside on unclassified proxies, then verified inside on the real data before promotion. Drift monitoring runs entirely locally and reports through your existing enclave review process.
Fine-tuning can happen inside the boundary too: LoRA adapters trained on enclave GPUs against enclave data, so even the training signal never leaves.
Compliance posture
The architecture is designed alongside ITAR, CMMC, and DFARS obligations from day one: personnel access aligned to your program requirements, documentation packages your security officers can actually use, and evidence trails for every artifact that crossed the boundary. We describe categories and patterns publicly; program specifics stay where they belong.
Straight answers
How do model updates work with no network?
Through a signed transfer process: artifacts are prepared and hashed outside, moved on approved media through your existing cross-domain procedure, verified against signatures inside, then staged and promoted. It is slower than a connected pipeline by design, and fully auditable at every step.
Can models be fine-tuned inside the enclave?
Yes. LoRA and QLoRA fine-tuning run comfortably on enclave GPU hardware, so training data with no path out of the boundary can still improve the model. Full fine-tunes are possible with larger enclave clusters.
What hardware footprint does an air-gapped deployment need?
Typically one to four GPU servers depending on model size and user count, plus standard storage for the model registry and retrieval indexes. It racks into existing enclave infrastructure; no exotic hardware is required.
Do you have people who can work in these environments?
We design engagements around your facility and personnel requirements, including configurations where our engineers prepare and verify everything outside while your cleared staff execute inside with our runbooks. Talk to us about the specific constraints; this is a conversation we have often.
Bring AI inside the boundary.
Describe the constraint (we're comfortable with 'I can't tell you much'). We'll walk you through the air-gap deployment pattern and what it needs from your side.
Discuss an air-gapped deploymentFree AI workshops available. A founder reads every message.