Regulated industry, sovereign cloud, or plain caution: Hedy runs fully air-gapped with local models. Same skills, same governance — zero external calls. Licences validate offline via Ed25519 signatures.
Hedy runs fully air-gapped: point it at a local model server (vLLM or Ollama) and no request ever leaves your network. Knowledge, memory, and audit logs live in your own Postgres. Licensing is offline via Ed25519 signatures, so there are no license callbacks, no sub-processors, and no phone-home. You get the same AI employee and the same governance (append-only audit, L0/L1/L2 approvals, deny-by-default writes, per-asker ACL retrieval) with zero egress.
Last updated: 20 July 2026
Point the gateway at vLLM or Ollama inside the boundary. Anthropic and OpenAI-compatible APIs work identically.
Knowledge base, embeddings, memory, audit and metering are all in your PostgreSQL. No external dependency at runtime.
Approval tiers, allowlists, conduct tests and the audit ledger work identically offline.
Bind-address configuration and the absence of external endpoints are auditable in the compose file itself.
Air-gap is a deployment mode, not a stripped-down tier. Hedy uses bring-your-own model keys, and "your key" can point at a local vLLM or Ollama endpoint inside your subnet. Every LLM call routes through the Hedy LLM proxy, which is the single metering and quota chokepoint. When the model is local, that proxy talks only to your inference server. There is no outbound call to any hosted model API, and no path where a prompt, a document, or a memory leaves the perimeter.
Your data stays where you can inspect it. Retrieved knowledge, the employee's long-term memory, usage counters, and the audit trail are all written to your Postgres. Nothing is stored in a vendor cloud because there is no vendor cloud in the loop and no sub-processors. This is the core difference from a cloud AI coworker that lives in Slack or Teams: those move your context to someone else's infrastructure to function. Hedy is one AI employee running on yours, doing a team's worth of output without exporting a byte.
Licensing works offline too. Entitlements are carried in an Ed25519-signed license file that Hedy verifies locally against a public key. No activation server, no periodic checkin, no kill-switch that depends on reaching the internet. You can deploy into a network with no route out at all and the product still boots, validates, and runs. A roughly 30-minute Docker Compose install gets you from nothing to a working air-gapped employee.
Governance is identical in air-gap mode, because governance is code and config, not a hosted service. Audit logs are append-only with no update or delete API. Write actions are deny-by-default and require whitelisting, gated by L0/L1/L2 approval tiers. Retrieval is scoped by the asker's ACL, so an answer never surfaces documents the person asking isn't cleared to see. The evidence gate still forces answers to quote their sources verbatim. Cutting the network cord removes egress risk without loosening a single control.