Can AI governance run fully offline or air-gapped?

Yes, provided the decision path contains no external AI service. Turrigan's detector floor is deterministic and offline, so it needs no cloud model to reach a verdict. That is the property that makes air-gapped deployment real rather than a diagram: a governance layer that calls out to a hosted model cannot run in an environment with no egress, no matter how it is packaged.

What are the deployment options?

Three. Managed cloud on an isolated tenant, with physical database isolation available per tenant. Bring your own datastore, where the decision log lives in a database you host and own and the connection secret is sealed at rest. Or fully air-gapped on-premises, with customer-managed keys, for government and regulated deployments.

Deployment

Self-hosted and air-gapped AI governance

Q: Who holds the encryption keys?

An enterprise tenant can hold its own key, in which case the provider cannot read that tenant's data. Revoking the key crypto-shreds the tenant. Stored content is encrypted at rest with per-record keys, and personal data is redacted before storage, so raw personal data never appears on any read surface.

Q: How does erasure work without breaking the audit chain?

Erasure destroys the per-record key rather than deleting the record, which is what crypto-shredding means. The content becomes unrecoverable while the hash chain stays intact and verifiable. That is what lets a deletion request be honoured without the audit log losing the property that makes it evidence.

Q: Can I take my data with me?

Yes. In the bring-your-own-database model the decision log is already in infrastructure you own, and a tenant export is available in all models. A governance vendor that holds your evidence hostage has made your compliance case depend on your commercial relationship with them, which is the opposite of what evidence is for.

AI governance can run fully offline, but only if there is no external AI service in the decision path. Turrigan's detector floor is deterministic and needs no cloud model to reach a verdict, which is what makes air-gapped deployment a real option rather than a diagram. It runs as managed cloud, against a database you own, or entirely on-premises with your own keys.

The question that decides everything

Ask any governance vendor one question: what does your product call out to in order to reach a verdict?

If the answer includes a hosted model, then self-hosting the vendor's software has not made the system sovereign. Every governed decision still leaves the building, carrying exactly the content you were trying to protect, which is often the most sensitive text in the organization. The deployment diagram can show a box inside your perimeter and the data path still crosses it.

This is why the deterministic core is a sovereignty feature and not just a performance one. No model call in the decision path means nothing to egress, which means the same governance runs in an environment with no internet connection at all. See inline AI governance for why determinism also matters for latency and evidence.

Three deployment models

Managed cloud: Fastest start. Your tenant, your keys, your encrypted data, our operations. Physical database isolation available per tenant.
Your database: The decision log lives in a datastore you host and own. The connection secret is sealed at rest. You can walk away with the data any day.
Air-gapped: Fully on-premises and offline, with customer-managed keys and crypto-shredding. For government and regulated deployments.

Keys, and who holds them

Stored content is encrypted at rest with per-record keys, and personal data is redacted before it is stored, so raw personal data never appears on any read surface. An enterprise tenant can hold its own master key, in which case the provider cannot read that tenant's data at all.

That last point is worth being precise about, because "your data is encrypted" is often said by vendors who also hold the key. If the provider holds the key, the provider can read the data. Customer-managed keys are the arrangement in which that is not true, and revoking the key crypto-shreds the tenant.

Erasure without destroying the evidence

A tamper-evident audit log and a deletion request look like a contradiction. If the log cannot be changed, how is anything erased, and if records can be removed, in what sense was the log tamper-evident?

Crypto-shredding resolves it. Erasure destroys the per-record key rather than the record, so the content becomes unrecoverable while the hash chain stays intact and verifiable. The deletion is real, and the property that makes the log evidence survives it.

Evidence you can verify yourself

Sovereignty that ends at the hosting boundary is incomplete. If you can hold the data but cannot check it independently, you are still trusting the vendor about the thing that matters most.

The decision log is hash-chained and signed into verifiable checkpoints, so any edit, deletion or reorder is detectable along with the exact position where the chain breaks. You can run that verification yourself, against your own database, without the vendor's cooperation and after the commercial relationship has ended.

Who this is for

Government and public sector, where data residency is a legal constraint rather than a preference.
Regulated industries, where the content being governed is exactly the content that cannot leave the perimeter.
Defence and classified environments, where there is no egress to have an opinion about.
Any organization whose AI handles material it would not paste into a third-party service, which on inspection is most of them.

The honest tradeoffs

Air-gapped deployment means you operate it. Updates, capacity and availability become yours, and the offline detector floor cannot consult an external reference source that is unreachable by definition. Managed cloud is faster to start and easier to run, and it puts the data in our operational perimeter even though the keys can still be yours.

These are real tradeoffs rather than a menu where one option is strictly better. The reason all three exist is that data residency is a constraint imposed on you, not a preference you get to hold.

Frequently asked questions

Can AI governance run fully offline?

Yes, provided the decision path contains no external AI service. Turrigan's floor is deterministic and offline, so it reaches verdicts with no cloud model involved.

Who holds the encryption keys?

An enterprise tenant can hold its own, in which case the provider cannot read that tenant's data. Revoking the key crypto-shreds the tenant.

How does erasure work without breaking the audit chain?

Crypto-shredding destroys the per-record key rather than the record. Content becomes unrecoverable and the chain stays verifiable.

Can I take my data with me?

Yes. In the bring-your-own-database model it is already in infrastructure you own, and a tenant export is available in every model.

Does self-hosting make my organization compliant?

No. Nothing does. Compliance depends on your own quality management system and risk process. What this gives you is the evidence and the enforced controls, held where your data is allowed to live. See EU AI Act compliance.

Discuss a sovereign deployment