Air-gapped deployment means the AI assistant runs with zero external network access: the language model, embeddings, vector store and file storage all run inside your perimeter, and nothing is sent to any cloud service. DocsGPT supports this posture fully. A large Central European bank runs it this way on its existing NVIDIA T4 GPUs.
zero egress · local llm · local embeddings · local vector store · internal idp · telemetry off
Last updated:
Cloud
Managed
On-premises
Air-gapped
Cloud: Arc53 operates a multi-tenant service and the LLM runs at a cloud provider. Managed: Arc53 operates a dedicated instance in your chosen region; the LLM runs at a cloud provider, on a local engine on the instance, or with your own key (BYOM). On-premises: you operate DocsGPT inside your network; the LLM runs locally, or (hybrid) prompts cross the boundary to a cloud provider you choose. Air-gapped: zero external network; LLM, embeddings, vector store and storage all run inside your perimeter.
Zero external network: LLM, embeddings, vector store and object storage all run inside the customer's perimeter.
Air-gapped
Zero external network: LLM, embeddings, vector store and object storage all run inside the customer's perimeter. Nothing crosses the perimeter, in either direction.
local llm · local embeddings · local vector store · local storage · internal idp
Not air-gapped
DocsGPT runs inside your network but calls a cloud LLM provider you choose: prompts and retrieved passages leave to the provider. That is a hybrid on-premises deployment.
→ /deploy/on-premises
Not air-gapped
A self-hosted install configured with an OpenAI, Anthropic or other cloud key sends prompts to that provider. Local platform, cloud model — not air-gapped.
→ /deploy/self-hosted
Every component runs inside the perimeter and makes no outbound call. Only telemetry can ever export — to collectors you run inside, and only if you switch it on.
In an air-gapped DocsGPT deployment every component runs inside the customer's perimeter and makes no outbound call: the LLM on a local inference engine, local embeddings on FastEmbed with ONNX Runtime, a self-hosted vector store, local disk (or, on Kubernetes, an in-network S3-compatible store or a shared volume) for files, PostgreSQL, Redis and an internal OIDC identity provider. Telemetry is the one component that can ever export, and only to collectors inside the perimeter, when it is switched on; it is off by default.
| Runs inside the perimeter as | Outbound traffic | |
|---|---|---|
| Language model | llama.cpp · Ollama · TGI · SGLang · vLLM · Aphrodite · FriendliAI · LMDeploy | None |
| Embeddings | FastEmbed on ONNX Runtime, models downloaded ahead with docsgpt prefetch-models | None |
| Vector store | pgvector · Qdrant · Milvus · Elasticsearch · FAISS | None |
| File storage | Local disk on Docker; on Kubernetes an in-network S3-compatible store (MinIO, Ceph) or a shared volume | None |
| User data | PostgreSQL | None |
| Queue and cache | Redis | None |
| Identity | Internal OIDC IdP (Authentik or Keycloak) | None |
| Telemetry | OpenTelemetry | Off by default; if enabled, exports only to internal collectors |
The free DocsGPT public API mode (a hosted endpoint) is not configured in this posture; inference is served only by the local engine above.
The model is selected by running your benchmark suite against the candidates on the hardware you have.
docsgpt-cli bench runs a suite of assertions and LLM-as-judge rubrics with latency and token limits, compares candidates A/B and emits JUnit output for CI. In a bank proof of concept Qwen 3.6 was chosen from five-plus open-source candidates on custom benchmarks; in production the bank's pipeline is sized to legacy NVIDIA T4 GPUs.
assertions · llm-as-judge rubrics · latency and token limits · a/b · junit output
Guardrails
PII, secrets, banned-term and prompt-injection checks flag, redact or block under a floor no agent can weaken; every decision shows in Guardrail activity.
pii · secrets · denylist · prompt-injection · floor
Approval
Tool calls and responses can require a person to approve before they run or leave the system.
approve · reject · tool-call gate
Activity
Sign-ins, changes and guardrail decisions in one append-only feed, exported as CSV or NDJSON for review inside the perimeter.
activity · append-only · csv · ndjson
Access
Permissions are enforced when passages are retrieved, so an answer can only draw on sources the user is allowed to see, as deployed for the UK DWP.
source permissions · viewer / editor · retrieval-level
Detail: Guardrails & Human-in-the-loop · Security.
Five steps, and the same route for every update afterwards.
Bring the software in
Release images carry the default embedding models, so a container downloads nothing on first use: pull them on a connected machine, docker save them to one archive and docker load it inside, or push it to your internal registry. On Kubernetes, mirror the images the manifests list and point the kustomization at your registry. For pip, carry a wheelhouse and run docsgpt prefetch-models.
docker save · docker load · internal registry · prefetch-models
Point DocsGPT at your own LLM
Any local engine that serves an OpenAI-compatible API, such as vLLM, Ollama or llama.cpp; the free DocsGPT public API is never configured.
LLM_PROVIDER=openai · OPENAI_BASE_URL
Switch off what would call out
One set of settings turns off every feature that would reach the internet, and HF_HUB_OFFLINE=1 makes model loading read the local cache only.
HF_HUB_OFFLINE=1 · telemetry off
Block outbound traffic in the network
On Docker, start the stack with docker-compose.airgap.yaml on an internal network with no route out. On Kubernetes, a NetworkPolicy denies egress for the namespace except to its own pods and cluster DNS.
docker-compose.airgap.yaml · NetworkPolicy
Verify
docsgpt verify-offline confirms that tokenizers, embeddings and the defaults load with networking off.
docsgpt verify-offline
Updates take the same route: pull the new release on a connected machine, carry it in, start the stack on the new tag and run docsgpt verify-offline again. The air-gapped deployment guide lists every setting and the full Kubernetes image list. The supply-chain programme behind every release:
Threat model
The threat model is published in the repository next to the code.
THREAT_MODEL.md
SBOM
An SBOM accompanies the project so components can be checked against internal policy.
sbom
Scanning
Static analysis runs on the codebase through CodeQL.
codeql
Disclosure
Vulnerabilities are reported privately and disclosed in coordination with fixes.
SECURITY.md · private reporting
24 h → 16 min
A large Central European commercial bank processes 10,000+ inbound documents a day; time-to-action fell from 24 hours to 16 minutes, with over 99.5 % classification accuracy, running fully air-gapped on the bank's existing NVIDIA T4 GPUs.
Source: EU bank, name under NDA
1–2 days → ~5 min
Transfer-document review that took 1–2 working days (P95) now completes in about 5 minutes, with 12 deterministic and agent checks and human approval for uncertain cases.
Source: Bank (POC), name under NDA
Government infrastructure, local inference
UK Department for Work and Pensions: an internal knowledge assistant on government infrastructure, with local inference.
Source: DWP
See also: Banking & Financial Services · Government & Public Sector.
A 30-minute demo with an engineer, or a free 30-minute on-premises review of your hardware and identity setup.