Skip to main content

Platform

Deployment topologies

Five shapes we deploy into. The column clients under-weight is the last one, operational burden is what determines whether the system is still healthy in a year.

TopologyData residencyEgressIdentityUpdate pathLatencyOperational burden
On-premisesYour datacentreNone requiredYour AD / LDAPChange windowLowest, no network hopHighest. You own the hardware
Private cloud (VPC)Your tenancyControlled, auditableYour IdPStandard pipelineLowModerate
Sovereign cloudNamed jurisdictionRegion-boundYour IdPStandard pipelineLow to moderateModerate
Air-gapped enclaveIsolated enclaveNone, physicallyEnclave-localSigned media, change boardLowestHighest, supply line is a project
Edge / disconnectedAt the siteIntermittentCached credentialsSync on contactLowest locallyHigh, fleet management

Choosing between them

Four questions settle it in most engagements. They are asked in this order because each one removes options rather than adding them.

  1. 01Can the data leave your estate at all?

    No → On-premises or air-gapped.·Yes → Continue.

  2. 02Must it stay within a named jurisdiction?

    No → Private cloud (VPC).·Yes → Sovereign cloud.

  3. 03Can the model weights be transferred over a network?

    No → Air-gapped, with a signed-media supply line.·Yes → Continue.

  4. 04Does the workload run where connectivity is unreliable?

    No → Choose from the above.·Yes → Edge, with a sync strategy and cached identity.

The air-gapped supply line

The transfer is the easy part. The difficulty is proving, months later, exactly which artefact ran on which day, and building a path a security team will approve more than once.

Getting model weights into an air-gapped enclaveOutside the boundary, weights are downloaded, scanned, hashed and signed, then written to removable media along with a manifest. Media crosses a one-way transfer point under change control. Inside the enclave, the manifest signature and hashes are verified, the artefact is admitted to an internal registry, and only then is it deployed to the serving tier. Nothing returns across the boundary except an approval record generated inside.OUTSIDEFetch weightslicence checkScan + hashmalware, SBOMSign manifestdetached signatureremovable mediaAIR GAP, one-way, under change controlVerify signaturefail closedInternal registryadmitted artefacts onlyServing tiervLLM / NIMChange record + approvalgenerated inside, never leavesAudit log + telemetryretained locallyThe hard part is not the transfer. It is proving, months later, exactly which artefact ran on which day.
Figure. Weights enter under signed manifest and verification fails closed. Nothing returns across the boundary.

Start with the constraint.

Most of these projects are shaped by what you cannot do rather than what you want. Data that cannot leave the estate, a model you cannot host with a third party, a decision somebody has to justify to a regulator. Tell us yours and we will say honestly whether we can work inside it.

Talk to an engineer