Air-Gapped Security Architecture

In the Air-Gapped edition, every component - UI, auth, control plane services, and data tier - runs in your cluster, installed by the one-line installer with a signed license file and images from your own registry mirror. There is no connection to xpander Cloud at all: no heartbeats, no metadata sync, no telemetry.

​

Architecture

How to read the diagram:

• Everything runs in your cluster - the web UI (Xpander Chat), local sign-in, the API, the Agent Controller, the execution tier (the agent-worker service), the AI Gateway, and the control plane services that Hybrid would host in xpander Cloud.
• Users reach xpander over whatever path your network provides: internal DNS, VPN, or a private load balancer. See Domains, Ingress & DNS.
• The data tier is in-cluster by default - PostgreSQL, Redis (queues, cache, and knowledge-base vectors), and MongoDB - or your own Postgres/Redis. See Data tier options.
• Model calls go to your LLM endpoint: in-network vLLM, Ollama, or NVIDIA NIM, or Amazon Bedrock over a PrivateLink VPC endpoint to AWS (not xpander), or a hosted provider if your policy allows it. See Local LLM inference.
• Skill calls target the systems you connect - private Salesforce, internal GitLab, self-managed Jira, databases. Egress is your policy.
• No xpander Cloud. There is no deployment-manager sync, no PrivateLink to xpander, no agent-catalog pull. Agent configuration is authored and stored in your cluster.

​

What leaves the environment

Nothing is sent to xpander Cloud. All xpander data stays local: Every connection that leaves the perimeter is optional and yours to allow, deny or point at an endpoint inside your network. With OpenCode and an open-weight model served in-network, nothing leaves. The hosts and ports behind each row are listed in What Talks to What.

​

Entitlement: signed license, verified in-cluster

There is no cloud entitlement check. The license is a signed file (Ed25519), validated three times: by the installer locally, by the chart’s preflight hook, and by the in-cluster deployment manager at boot. It refuses to start on a bad signature. Renewal is a Secret update plus helm upgrade. See The License.

​

Sign-in is local

Authentication runs in your cluster with no external dependency: bootstrap admin password, email OTP (works without SMTP; codes print via a chart script), or SSO with your own OIDC identity provider. See Signing In.

​

Operations stay yours

• Observability: metrics are scraped from xpander’s /metrics endpoints by your Prometheus; logs stream from kubectl logs into your aggregation stack (Loki, ELK, Splunk).
• Updates are explicit. Nothing auto-updates: you mirror the new release bundle into your registry, then run the upgrade. For security-critical patches, xpander publishes advisories with the patched chart version.
• Skills target your systems. Anything that would need a public service is simply not offered under the sealed posture.

​

Air-Gapped vs. Hybrid

Choose Air-Gapped when policy forbids outbound traffic, you operate in classified or no-egress networks, or data sovereignty rules out hosted LLM providers entirely. Tradeoff: operational weight - you run local model infrastructure and mirror releases yourself. Choose Hybrid when the goal is data residency and audit rather than zero egress: operationally lighter, the same data-plane isolation, and hosted LLMs reachable - including over PrivateLink. Decision check: can your workload tolerate calls to hosted LLM providers over a private network? If yes, Hybrid. If no, Air-Gapped.

---

​

Related