Air-Gapped vs On-Prem vs Sovereign Cloud

The SDC review board drew three circles on a whiteboard and labelled them air-gap, on-prem and sovereign cloud. Every vendor in the morning slot sat their product in all three circles at once. By lunch the board had a single confused estate and a draft that said hybrid sovereign. Nobody could say whether a prompt could reach the internet.

Those three phrases are operations postures, not marketing SKUs. Air-gap means there is no live path to an untrusted network. On-prem means the primary compute sits in a facility you can walk into, and may still have a tightly controlled path out. Sovereign cloud is a vendor phrase for a hosted platform that promises Indian geography, extra isolation, and sometimes extra legal wrapping. The promise is only as good as the admin plane and the collector.

This comparison is how we help a CIO pick a posture per data class without inventing a fourth circle called hybrid so the meeting can end.

The three postures, without poetry

If a vendor cannot say which row they are selling, they are selling the whiteboard.

Posture	Honest definition	Typical fit	Typical failure
Air-gapped	No live IP path to untrusted networks; updates by controlled media	Restricted operational data; some exam estates; defence-adjacent workshops	No media process, so people use phones; stale models
On-prem, fail closed	Your cage or colo; allow-listed or denied egress; you hold admin	Most civilian case-file agents	Silent fallback; updater bundles; identity in a foreign tenant
Hosted Indian / so-called sovereign cloud	Someone else’s platform in India with contractual isolation	Low-to-medium sensitivity if the admin plane and logs are instructed	Foreign parent, shared collector, marketplace components you did not list

Notice that sovereign cloud is the least precise row. Some offerings are well-run Indian private clouds with buyer-managed keys. Some are a public region with a new brochure. You cannot score the phrase. You can score keys, admin plane, subprocessors and the right to test egress.

Choose by data class and by operations skill

Two axes, not one. How bad is leakage of this class? How good is this team at running disconnected or fail-closed systems? A high-leakage class with a weak team needs either a hiring plan or a narrower workflow. It does not need a costume air-gap.

• Public content, no personal data: hosted Indian cloud is often enough if you still list subprocessors.
• Staff or citizen case files: on-prem fail-closed is the default we recommend starting from.
• Restricted operational or exam-critical content: air-gap or a dedicated disconnected VLAN with media control.
• Anything counsel tags as official secret or classified: stop and use the organisation’s own rules, not this table.

Hybrid is not a fourth posture

Committees love the word hybrid because it ends the argument. Hybrid, as used in vendor decks, usually means one cluster, one identity, one logging pipe, and a story that sensitive workloads will be careful. That is not a posture. That is a hope.

The only honest hybrid is two or three estates with irreconcilable network policies and no shared context window. The FAQ estate may call a weather feed. The scholarship estate may not. If an officer account can paste a scholarship row into the FAQ agent, you built a bridge and called it convenience.

Sovereign cloud can host the FAQ estate if the admin plane and logs survive the DPA reading. It should not host the estate you already decided was air-gapped because the salesperson offered a dedicated tenancy. Tenancy is not a missing cable. Walk the path.

Objections

Finance will not fund three estates. Then fund two, and do not run the third workflow. One leaky estate is not cheaper than two honest ones once you price the incident.

Sovereign cloud is government-approved, so we are done. Approval of a cloud empanelment, where it exists, is not a transfer decision for your prompts and not an air-gap.

Air-gap will make us unpatchable. Only if you refuse to build a media-controlled update path. That path is a later article in this series. If you will not build it, do not air-gap.

Cost and staffing by posture

Air-gap is the most expensive in people per workload. You need a promotion path, a deputy, media discipline, and a local observability estate. If you cannot name those people, do not pick the posture.

On-prem fail-closed is the middle. You need an egress owner, a soak capture habit, and someone who can revoke a tunnel. Many SDC teams can do this if they are not also asked to run three new chatbots this quarter.

Hosted Indian cloud is the cheapest in people and the most expensive in residual transfer risk. Price that risk on the sheet even if you cannot give it a rupee. A CISO who has lived through one collector incident will fill the number in for you.

Do not let finance average the three into a blended unit cost. They are different products. Averaging them is how the air-gap is understaffed and the hosted estate is over-trusted.

A 45-day posture decision

1. Days 1–10: list workflows and data classes. No architecture yet.
2. Days 11–20: score leakage harm and ops skill honestly.
3. Days 21–35: assign one posture per class. Write the shared-nothing rule for context windows.
4. Days 36–45: take the assignment to finance with the costing shape from the cost article. Cut workflows, not postures, if money is short.

What goes in the file

The class-to-posture table, the network diagrams that prove the estates do not share a hopeful gateway, and the sentence that sovereign cloud was scored as a hosted platform, not as a synonym for air-gap. If those pages exist, the whiteboard circles can be erased.

Add the people named against each posture: who promotes artefacts on the air-gap, who owns egress on the fail-closed estate, who reads the DPA for the hosted estate. A posture without a name will become hybrid again the first week someone is on leave.

Prcept AI is built for on-prem fail-closed and for air-gapped estates. If you need a public-cloud region, say so, and do not let us or anyone else relabel it.

How to prove this on a rack, not on a slide

“Air-Gapped vs On-Prem vs Sovereign Cloud” only matters if a CISO can fail it. A P1 CIO/CTO should be able to point at a cable, a registry, a licence file, a PDU reading or a SIEM index and say: this is the control. If the only evidence is a brochure that mentions “air-gapped vs on-premise AI”, you do not have the control.

Air-gap, on-prem and sovereign cloud are three operations postures. Pick them per data class. A single estate that claims all three is usually none. Air-gap and on-prem programmes die in the second month, when the first update, the first crash, or the first GPU lead-time slip arrives. Budget the boring path — media, offline licence, local registry, local traces — in the same note as the model name.

On-prem is not air-gapped. An India region is not either. Write the forbidden path (outbound HTTPS, licence phone-home, crash reporter, hidden model API) as a numbered list and test it with the internet off. Whatever still dies was a dependency you did not draw.

1. Draw the data path for one user-visible answer under “air-gapped vs on-premise AI”.
2. Disable outbound internet on staging and run the demo script.
3. List every remaining hop: update, licence, registry, NTP, DNS, SIEM.
4. Give each hop an owner inside the department, not only the SI.
5. Minute the restore or the media-transfer once before go-live.

Close this loop before the next CAB

Put “Air-Gapped vs On-Prem vs Sovereign Cloud” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “air-gapped vs on-premise AI” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next noting must contain

“Air-Gapped vs On-Prem vs Sovereign Cloud” belongs in a file, not only in a search result. A P1 CIO/CTO should be able to point at one artefact that proves “air-gapped vs on-premise AI”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

Air-gap, on-prem and sovereign cloud are three operations postures. Pick them per data class. A single estate that claims all three is usually none. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C2 Air-Gapped & On-Prem: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “air-gapped vs on-premise AI”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.