Vector Databases Behind the Air Gap

Vector-database comparisons on the public internet are latency charts and million-QPS claims. None of that is what breaks in an SDC cage. What breaks is a Helm chart that wants a public image, a licence daemon that wants a phone-home, a snapshot that cannot be restored without the vendor's SaaS, and an index that cannot filter by the officer's role.

This is a comparison for people who have to live with the choice after the demo. It will not name a winner. It will name the questions that make most winners fail. If a product cannot answer them in writing, it is a lab toy, however pretty the recall curve.

We will talk about engines as classes — embedded libraries, search engines with vectors, dedicated clustered stores, and hosted APIs — rather than as a product ranking that will be stale next quarter. Your BoQ should do the same.

Compare classes, not last quarter's logos

Pick the dullest class that can filter, snapshot and stay offline. Dull is an operational virtue.

Class	When it is honest	Air-gap failure mode
Embedded library in the app process	Small corpora, single team, simple ops	No isolation; backup is 'copy the disk'; scale cliff
Relational / search engine + vector plugin	You already operate that engine well	Plugin version pins; memory surprises; weak hybrid
Self-hosted dedicated vector cluster	Large corpora, many tenants, strict SLOs	Chart wants the internet; licence; snapshot story
Vendor appliance that wraps one of the above	You bought ops, not just software	Opaque upgrades; licence server; no export
Hosted vector API	Almost never, if you claimed an [air gap](/blog/air-gapped-vs-on-prem-vs-sovereign-cloud)	Every upsert is egress

The seven questions that matter more than recall@10

1. Can we run it from a private registry with pinned digests and no outbound check?
2. Is there a licence file or binary that expires or phones home?
3. Can a query declare ACL and tenant predicates that the engine enforces, not the app?
4. Can we snapshot consistently with the chunk store, and has someone besides the vendor restored it?
5. Can we delete by document id and principal id without rebuilding the world every time?
6. What is the memory and disk behaviour at our order of magnitude — ten thousand, a million, ten million chunks — on CPU if needed?
7. Can we export to an open format so a future SI is not trapped?

Ask them in the POC, not in the first outage. A vendor who says 'the app layer will handle ACLs' is asking you to never leak a log. A vendor who says 'just rebuild from S3' is assuming a connected object store. Rewrite that sentence as 'rebuild from the object store we actually have'.

Metadata is the product

The vectors are the easy part. The product is the payload: document id, version, ACL list, purpose, language, hash of source bytes. If the engine treats payload as an opaque blob it cannot filter on, you will pull too much and filter late. Late filters become traces. Traces become personal data in the SOC.

Hybrid or bust for government paper

Circular numbers, file numbers and section ids are keywords. Hindi explanations of those numbers are vectors. Engines that only do dense search will miss 'G.O. Ms. No.' Engines that only do keywords will miss the paraphrased question from a citizen. Hybrid retrieval, even if fused in your code, is the default for Indian administrative paper.

Operations behind the gap

Capacity plan like a database, not like a notebook. Indexes want RAM. Disk will grow when you re-embed. Re-embedding is a planned outage or a blue-green build, not a surprise the week you change embedding models. Write the re-embed runbook the day you choose the engine.

• Keep the chunk store as the source of truth. The vector index is derived. If they diverge, rebuild from chunks.
• Snapshot both together. An index restored against yesterday's chunks will cite ghosts.
• Watch recall and empty-retrieve rate, not only CPU. A silent index that returns nothing looks healthy on a dashboard.
• Separate tenants by collection or by strongly enforced predicates. A shared 'department' collection is how one cell reads another cell's note.
• Pin the embedding model id on every vector. Mixed embeddings in one collection are a quiet quality incident.

A comparison sheet you can score

Criterion	Fail	Condition	Pass
Offline install	Needs Docker Hub at runtime	Needs it once, then pins	Private registry only
Licence	Phone-home daemon	Annual file, vendor-held key	File you hold, no callback
ACL filters	App-only	Payload filter, unindexed	Indexed predicates
Delete by id	Full rebuild only	Rebuild of one shard	Point delete + compaction
Snapshot	Vendor cloud only	Disk copy, undocumented	Documented consistent snapshot
Export	None	Proprietary dump	Open or documented dump + rebuild
Hybrid	Dense only	You fuse in app	Native or first-class hybrid

Score in the room with the packet capture still open. A pass on recall and a fail on licence is a fail. Do not average a security fail with a benchmark win.

Objections you will hear — and what to do with them

We will decide after we see accuracy.

Accuracy on a connected demo tells you almost nothing about restore, ACL or licence. Run accuracy on the engine that already passed offline install. Otherwise you will fall in love with a hosted API and spend six months pretending you can replicate it.

Open source means no licence risk.

Open source means a licence you must read. It does not mean the operator chart is clean. It does not mean the 'enterprise image' you actually deploy is the same as GitHub. Compare the binary you will run.

We can always rebuild, so backup is optional.

Rebuild time is a number. Measure it on a realistic corpus. If it is twelve hours, backup is not optional for a morning counter. Derived data still needs a story for the morning.

A three-week bake-off that is not a beauty contest

1. Week 1: write the seven questions into the POC script. Disqualify hosted APIs if the RFP claimed an air gap.
2. Week 2: install two shortlisted classes from a private registry. Break the network. Insert, filter, delete, snapshot, restore.
3. Week 3: run the same gold set on both. Time a full re-embed. Read the licence file. Score the sheet. Pick the dull winner.

How this shows up in the file

Attach the scored sheet, the restore log, and the licence file's expiry. Write the class you chose and why the more famous class failed. A later SI should be able to replace the engine because you treated it as derived data. That sentence is the whole sovereignty of a vector store.

Tenancy and memory without benchmark theatre

Memory charts from a vendor laptop assume a dedicated machine and a single collection. Your SDC node may share RAM with ingest, a SIEM forwarder and a model server someone 'temporarily' scheduled on the same box. Ask for resident-set behaviour at your chunk count, on CPU if you do not have a spare GPU for the index, and with payload fields populated — empty payloads make pretty RAM numbers.

Tenancy is a safety control. Separate credentials per department. Separate collections. If the engine supports encryption per collection, ask whether the key lives in a licence daemon. Encryption that dies when the licence dies is not encryption you can explain to a CISO.

Re-embedding is a capacity event. When you change the embedding model, you need disk for a second index or a window to rebuild. Write that window before you standardise an engine that can only hold one generation of vectors.

This article is a field guide, not legal, procurement, electrical or engineering advice. Confirm numbers, duties and designs against the current Gazette, CERT-In directions, your SDC / NIC / campus standards, a site survey and your counsel before you file them.