Skip to content

Solutions / Security & compliance

Air-gapped and data-residency deployments

Run licensing and metering with no outbound network, in the exact region or environment you require.

The challenge

Some environments cannot reach the internet at all; others must keep every byte within a specific jurisdiction or accreditation boundary. A licensing service that phones home, or that runs in a region you cannot choose, simply cannot be deployed there.

You need licensing that is correct and complete offline — verification, metering and administration — and a deployment you fully control.

1 Pull on a connected host get the image
2 Transfer in docker save → media → load
3 Run in your region your DB, your backups
4 Operate offline verify + meter, no network

How Delta1 Labs helps

A layered approach

1

Verify offline

Licenses verify against embedded public keys with no network call — the instance even validates its own license offline. It works fully disconnected.

2

Meter offline

Signed credit blocks let disconnected machines consume against a budget and reconcile later — no connectivity at spend time.

3

Choose where it runs

Self-host on your own hardware or a sovereign cloud region; all state lives in your PostgreSQL, backed up by you.

Capabilities

What you get

No runtime phone-home
Nothing leaves the enclave during operation.
Offline license & credit verification
Embedded-key verification and signed blocks.
Sovereign / regional hosting
Run in the jurisdiction you require.
Docker, Kubernetes or Windows
Deploy the way your environment allows.
Transfer via saved images
Move the image in on media with docker save/load.
Your database, your backups
All state in your Postgres, under your control.

Built with

Outcomes

  • Deployable where there is no internet.
  • Data stays in your chosen jurisdiction.
  • Full licensing lifecycle works offline.
  • You own the data and the backups.

Frequently asked

Questions, answered

How does the software get into the air-gapped network?

Pull the image on a connected host, docker save it to a tarball, move it in on approved media, and docker load it inside the enclave.

What about the built-in scheduled jobs?

They run on in-process timers, or you can drive them from your own scheduler with a shared secret — no external service required.

Let's talk about your setup

Tell us what you're building — we'll help you protect, license and ship it, managed or self-hosted.