AI without the internet: how does offline and air-gapped operation work?

What does offline mean, and what does air-gapped mean?

The terms are often used interchangeably, but they describe different levels:

Level	What it means
No outbound connection	The server sits in the internal network and does not open any connection to the internet on its own. It can reach other systems in the organisation.
Isolated network	The whole network has no gateway to the internet; data only enters through a controlled data lock.
Air gap in the strict sense	There is no network connection whatsoever to other networks. Data only moves on checked storage media.

Which level you need follows from your security concept, for example under the BSI’s IT-Grundschutz (the German Federal Office for Information Security’s baseline protection). For an AI platform the answer is the same: the platform and the model must both run in your own network.

What works without the internet, and what does not?

Works	Not available
Chat with the AI model	Web search
Apps, instructions, documents	External models, for example from large model providers
Permissions, groups, sign-in via your organisation’s directory service	Internet services, for example SMS delivery for the second factor
Connectors to systems in your own network	Connectors to systems on the internet
Logs	Automatic updates from the internet

Sign-in also stays in-house if the directory service (for example Active Directory) is on the same network.

How do updates and new models reach the network?

Via a defined route, often called a data lock. The manufacturer delivers software and models as a package; IT checks it, places it in an internal repository and installs it. Ask every provider:

• Is there a complete offline package, including the AI models?
• How large is it? AI models often take up many gigabytes.
• Can authenticity be verified, for example using checksums?
• Does the software open connections on its own, for example for telemetry or licence checks?
• How quickly do security updates arrive, and how are you informed?

What does IT need to prepare?

• Hardware on site with enough GPUs for the expected number of simultaneous questions.
• Network plan: Which internal systems may the AI reach, and which not? In critical infrastructure environments, control systems and plant control stay out.
• Update process with owners and deadlines, especially for security updates.
• Certificates and time: an internal certificate authority for HTTPS and a time source on the network, because sign-ins need valid timestamps.
• Backup of databases and documents according to your organisation’s concept.
• Remote maintenance: If the manufacturer is to help in case of a fault, you need regulated, time-limited access, or help by phone and on site only.

How does this work with basebox?

The server from basebox runs completely without the internet, with the AI model, documents, apps, permissions and logs; only web search is not available. Out of the box, basebox does not open any outbound connection: no telemetry, no licence check, no update polling. Only what you set up yourself goes outside, such as web search, an external model, connectors, an SMS service or your SIEM.

Software and models arrive as versioned container images or as an offline package via your internal repository, installed with a Helm chart. Until the images are signed (in preparation), image digests prove that they are unchanged. Nothing installs itself automatically on the server; without an operations contract your IT installs updates and reviews urgent security updates without delay. Remote maintenance is only available on your instruction: time-limited, approved by you, logged and revocable at any time.

basebox does not connect to control systems or plant control. basebox has no approval for VS-NfD. More for energy, water, transport and security authorities: AI without the internet for critical infrastructure.