Air-Gapped AI

Private AI

An air-gapped AI system is one with no network path out. Your prompts, your documents and the model's answers never leave the building, because there is no route by which they could. That is a statement about wiring, not about intentions, and it is the only version of the claim that survives contact with an auditor.

Most "air-gapped AI" on the market is a perimeter arrangement or a contractual one. Both can be perfectly reasonable. Neither is an air gap, and the difference matters precisely when it is tested.

• A private endpoint or dedicated tenancy. Traffic still leaves your network. It travels a narrower, better-guarded path to somebody else's computer, which is a real improvement and a different thing.
• A no-training commitment. This is a promise about what a vendor does with your data after receiving it. It concedes that they receive it.
• Zero-retention or short-retention processing. A statement about how long your data is kept, which again presumes it arrived.
• A VPC deployment of a hosted model. Often genuinely well isolated, and still dependent on a control plane you do not own and cannot inspect.

Unplug the uplink. If inference still works, the system is air-gapped. If it stops, it was never air-gapped — it was well-configured, which is a thing worth having and a thing worth naming correctly. The test takes a minute and no amount of documentation substitutes for it.

A policy can be revised. A contract can be breached, and the remedy is damages after the fact. A subpoena can compel a third party to produce what it holds, and you may not be told. Each of these is a live failure mode for data held somewhere else, and none of them is reachable when the data was never transmitted. An absent network path cannot change its terms of service.

This is also why the guarantee gets easier to evidence rather than harder. Demonstrating that a vendor honours a retention promise is an exercise in trust and paperwork. Demonstrating that a machine has no egress is an exercise in reading its routing table.

Stated plainly, because a page that claims no trade-off is selling something. You run open-weight models on your own hardware, so you do not get whichever frontier model shipped last week, and at the top of the capability range a hyperscaler's best will outperform what sits in your rack. You also own the operational surface: capacity planning, model updates and the hardware itself are now yours, where a hosted service would have absorbed them.

The work most organisations actually queue up for AI is not frontier work. Retrieval across your own corpus, extraction from documents, classification, summarisation, drafting against your own house style, answering questions about material only you hold — this is well inside the range of models that run locally, and it is the work where confidentiality is least negotiable. The capability gap is narrowest exactly where the privacy requirement is hardest.

It is also the work where a model with access to your material beats a stronger model without it. A frontier model that cannot be shown the document is not a better answer to the question; it is no answer.

• Regulated handling. Health, financial and personal data under regimes where transmission itself is the regulated act, not merely its misuse.
• Privileged material. Legal work, investigations and transactions where disclosure to a third party is a question about privilege, not about security.
• Work where the data is the product. Designs, formulations, models and research programmes whose value is entirely in not being elsewhere.
• Environments that are already disconnected. Sites that operate without reliable connectivity, where a hosted service is not a policy problem but simply unavailable.

Garnet builds bespoke private AI on hardware you own, sited where you are. The starting point is a conversation about what material you need it to read and what the room it lives in looks like — not a licence count.

Design my Garnet →How we handle your materialEngagements