Air-gapped LLM deployment: what it means and what to verify

An air-gapped LLM deployment is one where the model, the documents it reads, and the tools it uses all run on hardware that has no network path to the outside. Nothing leaves the perimeter because nothing can.

That is a stricter claim than "private" or "on-premises". A private cloud still has a network. An on-premises server that calls a hosted model for embeddings still sends text out. Air-gapped means the whole working loop, from question to answer, completes with the cable unplugged.

What has to run locally

For the system to be useful disconnected, every component in the loop has to be local:

• The inference engine and model weights. The model answers from weights stored on the machine. There is no fallback to a hosted endpoint.
• The document index. Documents, spreadsheets, and images are indexed locally, and relevant material is selected into the model's context without an external retrieval service.
• Tools and computation. When the model specifies an analysis, the host executes the calculation and renders the tables and charts on the same hardware.
• Background workers. Indexing, curation, and delegated analysis run as local workers so the foreground session stays responsive.

smolsi is built this way. The engine, document index, tool surface, and workers form one local system on hardware the customer controls, and the model, index, and tools can operate with the network disabled.

How an air-gapped agent workflow runs

An agent workflow does not need a hosted model service to be useful. Inside a private environment, the sequence is:

1. Bring local documents. The local index makes relevant material available to the task. Source files stay inside the deployment.
2. Delegate work. The local model directs the analysis and delegates to tools and background workers.
3. Compute on the host. The model specifies the calculation or workbook; the host performs the computation and renders the result.
4. Return results for review. The user inspects the analysis, checks the underlying material, and decides what happens next.

The model directs the work. The host executes it. Both stay on site.

What to verify before you trust the label

A short checklist for a security review:

• Disconnect and run. Ask the vendor to demonstrate the full workflow with networking disabled at the operating-system level, not just a firewall rule.
• Inventory the components. Name every process in the loop and where it runs. Any hosted dependency, including telemetry, licensing checks, or embeddings, breaks the air gap.
• Ask how the model gets in. Weights and updates have to arrive through a controlled transfer. Ask for release stamps and byte-level manifests so a production model directory can be verified after transfer.
• Ask about ingestion. Documents brought inside can carry prompt-injection payloads. Ask whether ingestion scans for them and whether the verdict is stored with the document.
• Ask for the evidence. Data residency, access control, audit logging, encryption, and network isolation are deployment controls. Ask for the supporting documentation under NDA and check its scope against your environment.

Where air-gapped deployments fit

Air-gapped operation matters where the data cannot leave: hospital systems and clinical research, banks and asset managers, law firms and in-house legal teams, defense primes and their suppliers, utilities, and government agencies.

smolsi deploys to a single analyst's laptop, a shared node for a team, or a private cluster for isolated environments. The laptop and shared-node configurations are available today; private clusters are in early access. For defense companies, smolsi 1 is a dedicated hardware device in development, with controlled facilities first.