Skip to main content
The one question your security team will ask is “where does our data go?” Shadow AI gives you three answers, and you keep the same dashboard in all of them. Clients point at whichever you choose with a single setting (base_url).
Cloud is the fastest way to start. Most security-conscious buyers run hybrid: scanning stays on their infrastructure, but they still get one clean cloud dashboard. Pick air-gapped only if you truly can’t allow outbound traffic.

​
Hybrid — scan on your servers, review in the cloud

Run the engine on your own infrastructure and let only the results flow to the cloud dashboard. On the engine, set:
Each scanned event is recorded locally first, then reliably forwarded to the cloud (ordered, retried automatically if the link drops — nothing is lost during an outage). Policies you author in the cloud are pulled down automatically. Each engine authenticates with its own token and can only write events for your organization.
Set FORWARD_MODE=metadata to keep per-request visibility and billing in the cloud dashboard while guaranteeing no prompt content ever leaves your network — only the verdict, threat type, and counts do.

​
Air-gapped — fully offline

Air-gapped is a shipped deployment mode, not a bespoke project. The engine runs with DEPLOYMENT_MODE=airgap (the third of the three engine modes: cloud, data_plane, airgap) entirely inside your network, with no outbound connection. What you run:
  • The engine, via our Helm chart — including a zero-egress NetworkPolicy overlay that blocks all outbound traffic at the network layer, so “no data leaves” is enforced by Kubernetes, not by trust.
  • An offline license — a signed, node-locked license file validated locally; no license server or phone-home required.
  • Local ML inference — detection models run inside your cluster.
  • SSO against your own IdP — the dashboard authenticates directly via OIDC against your identity provider.
Desktop agents point at your internal engine with one setting:
Agent updates are served from an artifact store inside your network (or pushed via your MDM) — devices never need to reach our update servers. Everything you need to review activity — verdicts, threat types, and masked metadata — lives in the local dashboard and its SQLite event log, so you never need to reach the cloud to operate.

Get the deployment package

Contact sales@promptguard.co for the Helm chart, license, and rollout guidance for your environment.
When you do need to move data between an isolated site and another environment, you do it deliberately. The local event log is the system of record: it can be queried directly, and the import endpoint that ingests signed event bundles verifies both signature and tenant before accepting anything.
Tooling that packages the local event log into tamper-proof signed bundles for transfer across an air gap is available on request and on the near-term roadmap. If you need it for an isolated deployment, contact support@promptguard.co — we don’t ship a generic export script today, so don’t script against one.
In air-gapped mode your dashboard is the local instance — not promptguard.co. Combining data across sites is done with signed bundles, not a live link, and a tampered bundle is rejected.

​
Which one is right for you

Cloud

Fastest to deploy, full real-time dashboard. Great for getting started.

Hybrid

Scanning on your infra, one cloud dashboard. The common choice for security-sensitive teams.

Air-gapped

No outbound at all — local dashboard, signed bundles. For regulated or isolated environments.