> ## Content Index
> Fetch the complete content index at: https://gridflex.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# Offline-first versus air-gapped: what each really means
- URL: https://gridflex.ai/articles/offline-first-vs-air-gapped/
- Published: 2026-11-08T06:56:49.000Z
- Updated: 2026-11-08T06:56:49.000Z
- Description: Self-hosted, segmented and air-gapped are often used as if they meant the same thing. They do not, and the differences shape what a monitoring system can do.
- Author: Angel Beristain
- Tags: Deployment

"It runs on our own servers" and "it is air-gapped" describe very different situations. For a monitoring system that must keep working when outside services are unavailable or untrusted, the difference matters.

## Self-hosted is not air-gapped

Self-hosted software runs on infrastructure the customer approves. It may still depend on outside services for identity, licensing, updates or model inference. Self-hosting describes where software runs, not what it depends on.

## Segmented

A segmented deployment runs on a separate network segment with controlled boundaries. Reporting, support and updates pass only through approved paths, such as a maintenance gateway or controlled media. Segmentation reduces exposure; it is not the same as being disconnected.

## Strictly disconnected

A strictly disconnected system has no external network connection. That rules out live remote reporting: a system cannot be fully disconnected and also send automated live reports over the internet. Updates arrive by controlled transfer and are verified at the destination.

Planned options Deployment choices and what each depends on

- Self-hosted software  
Runs on  
Customer-approved infrastructure  
External reporting  
Optional, customer-controlled  
Support and updates  
Under an agreed responsibility matrix
- Turnkey appliance  
Runs on  
Integrated local hardware, sensors and operator interface (under evaluation)  
External reporting  
Optional, customer-controlled  
Support and updates  
Scope defined with the customer
- Segmented edition  
Runs on  
A separate network segment with controlled boundaries  
External reporting  
Only through approved, controlled paths  
Support and updates  
Through an approved maintenance gateway or controlled media
- Disconnected edition  
Runs on  
Local infrastructure with no external network connection  
External reporting  
None live while strictly disconnected  
Support and updates  
Local, with controlled transfer verified at the destination
- Managed on-premises  
Runs on  
Customer site, with optional maintenance or analyst support  
External reporting  
Optional, customer-controlled  
Support and updates  
Explicitly authorized access with a defined scope

Self-hosted, segmented and air-gapped are different things. A strictly disconnected system cannot also send live reports.

## Local essentials

Whatever the deployment, GridFlex proposes to plan local identity, alarms, evidence storage and update verification so that essential monitoring does not depend on mandatory external inference, a vendor login or a live licence check. That is a design requirement to test with design partners, not a completed implementation.

## Questions to ask any vendor

- Which functions stop if the internet connection is lost?
- Where do identity, licensing and model inference run?
- How do updates arrive, and how is their origin verified?
- What reporting is possible in each mode, and who controls it?

See the proposed [deployment options](https://gridflex.ai/deployment/).