Air-gapped deployment means the AI assistant runs with zero external network access: the language model, embeddings, vector store and file storage all run inside your perimeter, and nothing is sent to any cloud service. DocsGPT supports this posture fully. A large Central European bank runs it this way on its existing NVIDIA T4 GPUs.
zero egress · local llm · local embeddings · local vector store · internal idp · telemetry off
Last updated:
Cloud
Managed
On-premises
Air-gapped
Cloud: Arc53 operates a multi-tenant service and the LLM runs at a cloud provider. Managed: Arc53 operates a dedicated instance in your chosen region; the LLM runs at a cloud provider, on a local engine on the instance, or with your own key (BYOM). On-premises: you operate DocsGPT inside your network; the LLM runs locally, or (hybrid) prompts cross the boundary to a cloud provider you choose. Air-gapped: zero external network; LLM, embeddings, vector store and storage all run inside your perimeter.
Zero external network: LLM, embeddings, vector store and object storage all run inside the customer's perimeter.
Air-gapped
Zero external network: LLM, embeddings, vector store and object storage all run inside the customer's perimeter. Nothing crosses the perimeter, in either direction.
local llm · local embeddings · local vector store · minio · internal idp
Not air-gapped
DocsGPT runs inside your network but calls a cloud LLM provider you choose: prompts and retrieved passages leave to the provider. That is a hybrid on-premises deployment.
→ /deploy/on-premises
Not air-gapped
A self-hosted install configured with an OpenAI, Anthropic or other cloud key sends prompts to that provider. Local platform, cloud model — not air-gapped.
→ /deploy/self-hosted
Every component runs inside the perimeter and makes no outbound call. Only telemetry can ever export — to collectors you run inside, and only if you switch it on.
In an air-gapped DocsGPT deployment every component runs inside the customer's perimeter and makes no outbound call: the LLM on a local inference engine, local embeddings on FastEmbed with ONNX Runtime (sentence-transformers optional), a self-hosted vector store, local disk or a self-hosted S3-compatible store for files, PostgreSQL, Redis and an internal OIDC identity provider. Telemetry is the one component that can ever export, and only to collectors inside the perimeter, when it is switched on; it is off by default.
| Runs inside the perimeter as | Outbound traffic | |
|---|---|---|
| Language model | llama.cpp · Ollama · TGI · SGLang · vLLM · Aphrodite · FriendliAI · LMDeploy | None |
| Embeddings | FastEmbed on ONNX Runtime — sentence-transformers optional | None |
| Vector store | pgvector · Qdrant · Milvus · Elasticsearch · LanceDB · FAISS | None |
| File storage | Local disk by default; a self-hosted S3-compatible store (MinIO, Ceph) optional | None |
| User data | PostgreSQL | None |
| Queue and cache | Redis | None |
| Identity | Internal OIDC IdP (Authentik or Keycloak) | None |
| Telemetry | OpenTelemetry | Off by default; if enabled, exports only to internal collectors |
The free DocsGPT public API mode (a hosted endpoint) is not configured in this posture; inference is served only by the local engine above.
The model is selected by running your benchmark suite against the candidates on the hardware you have.
docsgpt-cli bench runs a suite of assertions and LLM-as-judge rubrics with latency and token limits, compares candidates A/B and emits JUnit output for CI. In a bank proof of concept Qwen 3.6 was chosen from five-plus open-source candidates on custom benchmarks; in production the bank's pipeline is sized to legacy NVIDIA T4 GPUs.
assertions · llm-as-judge rubrics · latency and token limits · a/b · junit output
Guardrails
PII, secrets, denylist and prompt-injection checks with flag, redact or block actions; every event lands in an audit panel.
pii · secrets · denylist · prompt-injection · flag/redact/block
Approval
Tool calls and responses can require a person to approve before they run or leave the system.
approve · reject · tool-call gate
Audit
Authentication events are recorded append-only; logs are exportable for compliance review.
auth-events · append-only · exportable
Access
Permissions are enforced when passages are retrieved, so an answer can only draw on sources the user is allowed to see, as deployed for the UK DWP.
source permissions · viewer / editor · retrieval-level
| Check | Intervention point | Action | |
|---|---|---|---|
| 09:14:02 | Personal information · email | final answer | redact |
| 09:12:47 | Prompt injection | retrieved sources | block |
| 09:11:30 | Banned terms | user input | flag |
| 09:08:15 | Link policy | final answer | block |
| 09:02:51 | Personal information · phone | user input | redact |
Every guardrail decision is logged and exportable.
Detail: Guardrails & Human-in-the-loop · Security.
Releases are versioned container images, and the backend image already contains the default embedding models, so a container downloads nothing on first use. To update, pull the new tag on a connected machine, docker save the images to one archive, carry it into the disconnected network and docker load it (or push it to your internal registry), then start the stack with the new DOCSGPT_IMAGE_TAG. For pip installs, pip download into a wheelhouse and docsgpt prefetch-models on a connected machine, then install offline with --no-index. Model weights come in the same way, following the inference engine's own documentation. After an update, docsgpt verify-offline confirms that the models load with networking disabled. The air-gapped deployment guide covers the settings that switch off every feature that would otherwise call out, and how to block egress in Docker and Kubernetes.
The supply-chain programme behind every release:
Threat model
The threat model is published in the repository and maintained with releases.
THREAT_MODEL.md
SBOM
An SBOM accompanies the project so components can be checked against internal policy.
sbom
Scanning
Static analysis runs on the codebase through CodeQL.
codeql
Disclosure
Vulnerabilities are reported privately and disclosed in coordination with fixes.
SECURITY.md · private reporting
24 h → 16 min
A large Central European commercial bank processes 10,000+ inbound documents a day; time-to-action fell from 24 hours to 16 minutes, with over 99.5 % classification accuracy, running fully air-gapped on the bank's existing NVIDIA T4 GPUs.
Source: EU bank, name under NDA
1–2 days → ~5 min
Transfer-document review that took 1–2 working days (P95) now completes in about 5 minutes, with 12 deterministic and agent checks and human approval for uncertain cases.
Source: Bank (POC), name under NDA
Government infrastructure, local inference
UK Department for Work and Pensions: an internal knowledge assistant on government infrastructure, with local inference.
Source: DWP
See also: Banking & Financial Services · Government & Public Sector.
A 30-minute demo with an engineer, or a free 30-minute on-premises review of your hardware and identity setup.