Secure & Air-Gapped AI

DataWise designs and builds AI systems for organizations whose data cannot leave the building: defense, critical infrastructure, and security-sensitive enterprises. For one such organization we architected a zero-egress AI enclave, private networking end to end, self-hosted LLMs and vision models on an MLOps foundation, and built and demonstrated a fully isolated AI assistant running inside the closed network with nothing leaving it. Modern AI without internet dependence is an engineering discipline, and it is ours.

Can modern AI really run inside a closed network?#

Yes, and the largest security organizations in the world already run it that way. Microsoft deployed a fully disconnected GPT-4 environment for the US intelligence community, live for top-secret analysis, as reported by Bloomberg. France adopted sovereign, self-hosted GenAI across its armed forces via the Mistral framework, deploying it on national infrastructure, and the US Army’s CamoGPT reached 75,000 users on government-hosted infrastructure. Sovereign, self-hosted AI has moved from preference to procurement requirement. DataWise builds at this standard for Israeli organizations: self-hosted open-weight LLMs, retrieval over internal documents, and vision object-detection, all running on infrastructure inside your perimeter. No API calls out, no telemetry out, no model updates phoning home. The trade-off is real engineering work, model serving, GPU infrastructure, and MLOps inside the enclave, and that is exactly the work we architect and deliver.

What did DataWise actually build for a security-sensitive organization?#

Two layers. First, the architecture: a zero-egress AI enclave specified end to end, private networking, an MLOps foundation for deploying and updating models without external connectivity, self-hosted LLMs, and vision object-detection. Second, the proof: DataWise built and demonstrated a fully isolated, self-contained AI assistant inside the closed network: chat with organizational knowledge, retrieval over internal documents, deep-research workflows, and document and diagram generation, everything running inside the perimeter, nothing leaving it. The demonstration matters because in this domain, paper architectures are cheap; a working assistant your analysts can question is what earns the decision.

What can run inside the enclave?#

• Conversational access to organizational knowledge: an assistant that answers from your internal documents, with retrieval, not from the open internet.
• Deep-research workflows: multi-step research over internal corpora, with document and diagram generation.
• Vision object-detection: image and video analysis on self-hosted models.
• The MLOps layer: deployment, versioning, and monitoring of models with no external connectivity.
• What does not run: anything requiring an external API. If a capability cannot be self-hosted at acceptable quality, we say so during characterization rather than smuggling in an exception.

Controlling egress short of a full air gap#

“Egress” describes two different problems, and most organizations arrive holding only one of them. The security question is what leaves your perimeter: the questions sent to a model, the documents attached to them, and the retrieval index built from your internal content, when the model is not yours. The cost question is what leaves your cloud: the per-gigabyte charges that apply when data crosses out of a region or over to another provider, the line item that turns a decision that looked purely technical into a recurring bill. Both are the same architectural decision wearing two hats: where inference runs relative to where the data already sits.

An air gap is the maximum answer to both. Nothing leaves, so nothing can be exposed and nothing can be billed on the way out. Most organizations are not air-gapped and do not need to be, and for them egress is a control to be designed rather than a wall to be built. The instruments are the ones we already use inside the enclave: run inference next to the data instead of moving the data to the inference; keep the retrieval index and its embeddings inside the perimeter, because that index is a copy of your corpus and travels under the same rules as the corpus; use private endpoints so traffic that must cross a boundary never crosses the public internet; and know exactly what a third-party model provider retains, because a contract clause is not an engineering control.

What that means in practice: the answer to “how much data leaves, and where does it go” should be a number derived from the design before anything is built, not something discovered in an invoice or an audit. We size it during characterization, in both directions: what the security boundary forbids, and what the egress path would cost if the design permitted it. Sometimes the answer is a full enclave. Sometimes it is a cloud deployment with inference co-located and the index held inside. That decision follows from your constraints, not from our preference.