Same Controls, Three Environments: Why Air-Gapped Should Never Mean Blind
There is a quiet assumption in most enterprise software today: the product lives in the vendor's cloud, your data goes there, and if that does not work for you, you are not the customer. For a large part of the world that runs critical infrastructure, that assumption is a deal-breaker. Defense networks, utilities, manufacturing plants, financial institutions with data-residency obligations and any organization that has been through a serious supply-chain incident all have environments that are, by policy, disconnected.
We built Hive Command AI so that "disconnected" never has to mean "blind."
One platform, three operating modes
Hive Command AI runs in three modes, and the controls are identical in all of them.
Connected SaaS is hosted from our own colocation facility in Atlanta, on hardware we own and operate. For organizations comfortable with a hosted platform, this is the fastest path to a 90-day pilot.
Customer-hosted runs on the customer's virtualization platform or Kubernetes cluster, inside the customer's network boundary, under the customer's identity and change control. Data never leaves.
Air-gapped runs with no external connectivity at all. Discovery is import-first: exports from IPAM, CMDB, cloud consoles and device configurations are brought in on the customer's terms, alongside IP scanning and passive observation inside the enclave. AI services run on a local inference tier. Nothing is shared with any external model provider, because there is no path for it to be.
The point of describing them together is that a customer does not choose between capability and sovereignty. The same golden records, the same evidence vault, the same governed AI workflow and the same audit packs exist in all three.
What "same controls" means in practice
Same controls is easy to say and hard to deliver, so it is worth being specific.
Credential handling is identical. The credential broker issues scoped read-only grants in every mode. Secrets never reach a prompt, a log or a report. Blocked scopes are blocked whether the model is a cloud provider or a local one.
Governed AI is identical. Intent classification, evidence assembly, redaction, human approval, brokered execution and audit record apply in all three modes. In the air-gapped case the provider catalog collapses to the local tier, but the workflow around it does not change. An analyst in an enclave gets the same assistance, with the same guardrails, as one in a connected SOC.
Evidence is identical. Every asset record carries source, hash, confidence and approver in every mode. Audit packs export in the same format. A regulator or an internal auditor sees the same structure whether the estate is hosted or sealed.
Documentation is a product
Disconnected customers have a particular relationship with documentation: it is often the only support channel that works. We treat documentation as a product for that reason. Topology exports to Visio, Draw.io and SVG. An OpenAPI contract for every interface. Workbooks and reports that can be read without the platform in front of you. If a team in a sealed environment needs to understand what the platform did and why, the answer should be in a file they already have.
Data sovereignty is a design input, not a compliance checkbox
Most products bolt sovereignty on after the fact, usually by adding a region selector to a cloud service. We started from the other end: assume the customer may never let the data leave, and design so that everything still works. It turns out that a platform built for the air-gapped case is also a better platform for the connected one, because every decision about what data goes where was made deliberately.
Security is the operating model, not an appendix. That is true in our Atlanta racks, in a customer's Kubernetes cluster, and in a room with no network cable at all.
Share this post: LinkedIn · X · Facebook · Email · Follow us on Instagram
