Air-Gapped Security Architecture

In the Air-Gapped edition, the full platform — UI, auth, control plane services, and data tier — runs in your cluster, installed by the one-line installer with a signed license file and images from your own registry mirror. There is no connection to xpander Cloud at all: no heartbeats, no metadata sync, no telemetry. Use it for classified, no-egress, or residency-constrained environments: defense, government, financial services with strict residency rules, healthcare under tight PHI controls, critical infrastructure.

​

Architecture

How to read the diagram:

• Everything runs in your cluster — the web UI and Workbench, local sign-in, the API, the Agent Controller, Workers, the AI Gateway, and the control plane services that Hybrid would host in xpander Cloud.
• Users reach the platform over whatever path your network provides: internal DNS, VPN, or a private load balancer. See Domains, Ingress & DNS.
• The data tier is in-cluster by default — PostgreSQL, Redis (queues, cache, and knowledge-base vectors), and MongoDB — or your own Postgres/Redis. See Data tier options.
• Model calls go to your LLM endpoint: in-network vLLM, Ollama, or NVIDIA NIM, or Amazon Bedrock over a PrivateLink VPC endpoint to AWS (not xpander), or a hosted provider if your policy allows it. See Local LLM inference.
• Tool and MCP calls target the systems you connect — private Salesforce, internal GitLab, self-managed Jira, databases. Egress is your policy.
• No xpander Cloud. There is no deployment-manager sync, no PrivateLink to xpander, no agent-catalog pull. Agent configuration is authored and stored in your cluster.

​

What leaves the environment

Nothing is sent to xpander Cloud. All platform data stays local: The only outbound traffic is what you choose to allow:

• Your LLM endpoint — in-network, or a hosted provider if your egress policy permits
• MCP and connector calls to systems you connect
• NTP for time sync, typically the only other outbound connection worth keeping open
• Install and upgrade time only: image mirroring from a connected machine, or the two-hop archive flow for sealed networks. See what talks to what.

​

Entitlement: signed license, verified in-cluster

There is no cloud entitlement check. The license is a signed file (Ed25519), validated three times: by the installer locally, by the chart’s preflight hook, and by the in-cluster deployment manager at boot — it refuses to start on a bad signature. Renewal is a Secret update plus helm upgrade. See The License.

​

Sign-in is local

Authentication runs in your cluster with no external dependency: bootstrap admin password, email OTP (works without SMTP; codes print via a chart script), or your own OIDC / OAuth / SAML provider. See Signing In.

​

Operations stay yours

• Observability: metrics are scraped from the platform’s /metrics endpoints by your Prometheus; logs stream from kubectl logs into your aggregation stack (Loki, ELK, Splunk).
• Updates are explicit. Nothing auto-updates: you mirror the new release bundle into your registry, then run the upgrade. For security-critical patches, xpander publishes advisories with the patched chart version.
• Connectors target your systems. Anything that would need a public service is simply not offered under the sealed posture.

​

Air-Gapped vs. Hybrid

Choose Air-Gapped when policy forbids outbound traffic, you operate in classified or no-egress networks, or data sovereignty rules out hosted LLM providers entirely. Tradeoff: operational weight — you run local model infrastructure and mirror releases yourself. Choose Hybrid when the goal is data residency and audit rather than zero egress: operationally lighter, the same data-plane isolation, and hosted LLMs reachable — including over PrivateLink. Decision check: can your workload tolerate calls to hosted LLM providers over a private network? If yes, Hybrid. If no, Air-Gapped.

---

​

Related