The one question that separates them
Both a cloud API and an air-gapped deployment can run a capable model. For a regulated buyer — pharma under GxP and 21 CFR Part 11, or a federal program with data-residency obligations — the deciding question is not "which is smarter." It is: which claims can I check for myself, and which do I have to take on trust?
A cloud LLM asks you to trust the vendor on four things: where your data goes, what the model actually is, whether the logs are complete and unaltered, and who else can reach the endpoint. An air-gapped LLM converts those trust questions into verifiable facts on hardware you control. That is the entire comparison, and everything below is a consequence of it.
Side by side
Verify it yourself
- No route to the internet and no external name to resolve — things go in, nothing comes out.
- Data residency holds by construction: regulated data physically cannot leave the perimeter.
- Weights proven byte-identical to the public artifact on your own hardware.
- Tamper-evident audit chain, signed with post-quantum cryptography (ML-DSA), held on your systems.
- Latent/dormant capacity enumerated, so the surface you accept is written down.
Trust the vendor
- The endpoint resolves external names and retains open network routes by design.
- Prompts and completions leave your perimeter; residency depends on vendor contracts and regions.
- The hosted model is opaque — you cannot hash what you cannot hold.
- Audit logs are vendor-held; you receive what the vendor chooses to expose.
- The accepted surface is described in documentation, not enumerated on your metal.
Egress and data residency
A cloud endpoint is, by definition, reachable. To serve your request it resolves external names and keeps network routes open, and your prompt — which for a pharma or federal buyer may be promotional copy, clinical language, or controlled information — travels to infrastructure you do not operate. Residency then rests on the vendor's region selection, subprocessor list, and contractual promises. Those can be perfectly good promises. They are still promises, enforced by policy and paper.
An air-gapped deployment enforces the same obligations physically. There is no route to the internet and no external name to resolve, so there is no path for prompts, completions, embeddings, or telemetry to leave. Residency is not a setting you configure and trust; it is a property of the network you can inspect. For regulated buyers this collapses a long list of downstream data-handling risks into a single verifiable fact.
Auditability: who holds the record
21 CFR Part 11 and GxP both turn on the same idea: if you cannot reconstruct who did what and when, and prove the record was not altered, the record does not count. With a cloud LLM, the authoritative record of what was sent and returned lives in the vendor's logging pipeline. You get exports and dashboards, but the completeness and integrity of that trail is the vendor's to attest, not yours to prove.
An air-gapped deployment anchors every inference call — input, response, and context — to an append-only audit chain on your own systems, signed with post-quantum cryptography (ML-DSA). The chain is tamper-evident: any change to a past record breaks the signatures that follow it. An auditor does not have to trust a logging pipeline; they check the signatures. "The AI helped with this review" stops being a soft assertion and becomes a court-durable record you control.
Provenance: can you prove what model is running?
With a hosted API, the model is a black box behind a version string. When the endpoint says v-whatever, you take it on faith that the weights, quantization, and any adapters behind that label are what you evaluated — and they can change under you without notice. You cannot hash what you cannot hold.
An air-gapped deployment runs open-weight models, so the weight files on your hardware can be hashed and compared to the hash of the public artifact from the model's original distribution. A match proves the running model is exactly the artifact you assessed — not a re-quantized, adapter-injected, or silently swapped copy. This is deliberately narrow: byte-identity proves the artifact is the one you evaluated. It does not prove the artifact is free of hidden behavior. Those are different questions, and we do not conflate them.
The tradeoffs, stated honestly
Air-gapped is not free. Cloud has real advantages, and a regulated buyer deserves the whole picture, not a sales pitch.
| Dimension | Air-gapped / on-prem | Cloud / API |
|---|---|---|
| Egress | No route out; no external name to resolve. Verifiable. | Endpoint resolves names and holds routes by design. |
| Data residency | By construction — data cannot leave the perimeter. | By contract and region selection; vendor-enforced. |
| Audit trail | Tamper-evident, ML-DSA-signed, held on your hardware. | Vendor-held logs; you get what is exposed. |
| Model provenance | Byte-identical check against the public artifact. | Opaque; version label you cannot verify. |
| Setup & hardware | You provision and run the hardware; heavier to stand up. | Nothing to run; provision in minutes. |
| Scaling & elasticity | Bounded by your own capacity. | Elastic; scale on demand. |
| Model updates | Deliberate, controlled, re-verified on change. | Vendor updates; may change under you. |
| Frontier capability | Best available open-weight models. | Access to the largest closed frontier models. |
If your workload has no regulated data and elasticity matters more than verifiability, cloud is often the right call. The case for air-gapped is specifically about what you must be able to prove.
The honest posture. Neither approach can honestly claim a "clean" model. We do not scan the model, and we do not claim it is clean, safe, or free of hidden behavior — no one can honestly promise that about a large open-weight model, and a closed cloud model gives you even less to inspect. The real difference is what you can verify yourself. Air-gapped makes four controls checkable on your own hardware — byte-identical weights, enumerated latent capacity, no egress, and a signed audit chain — so you rely on evidence you can examine, not on anyone's word.
Where this shows up: MLR promotional review
The first production use case is an AI assist for pharmaceutical MLR (Medical, Legal, Regulatory) promotional review. A live demo runs at mlr.hyfstele.com.
The doctrine is deliberately conservative: "It flags. You decide." The flow is Flag → Judge → Prove, and there is no LLM inside the flag decision plane. The model surfaces candidate issues for a human reviewer; the decision, and accountability for it, stays with the reviewer. Every step lands in the signed audit chain, so the review is reconstructable end to end — exactly the kind of record a cloud endpoint cannot hand you.
Frequently asked questions
What is the difference between an air-gapped LLM and a cloud LLM?
A cloud/API LLM runs on the vendor's infrastructure: your prompts leave your perimeter, the endpoint resolves external names and keeps network routes open, the model is opaque, and the audit logs are vendor-held. An air-gapped LLM runs open-weight models inside your own perimeter with no route to the internet and no external name to resolve. The practical difference for a regulated buyer is verifiability: with air-gapped you can prove egress, data residency, model provenance, and audit-trail integrity yourself, rather than trusting the vendor's attestations.
Is a cloud LLM ever acceptable for pharma or federal use?
It can be, when the workload contains no regulated data and elasticity or frontier capability matters more than what you must prove. Cloud is faster to stand up, scales on demand, and offers the largest closed models. The case for air-gapped is specific: it applies when data residency, tamper-evident audit trails, and model provenance are obligations you have to demonstrate to an auditor rather than assert. Judge it by what you must be able to verify, not by which model is smartest.
Does air-gapped mean the model is proven safe or backdoor-free?
No. We do not scan the model and we make no claim that it is clean, safe, or free of hidden behavior — that is not something anyone can honestly promise about a large open-weight model, and a closed cloud model gives you even less to inspect. Air-gapped's advantage is narrower and real: four controls become verifiable on your own hardware — byte-identical weights, enumerated latent capacity, no egress, and a signed audit chain. You rely on evidence you can check, not on anyone's word.
How does an air-gapped LLM handle data residency without an internet connection?
By construction. The deployment has no route to the internet and no external name to resolve, so regulated data has no path out of the perimeter — things go in, nothing comes out. Residency is enforced physically rather than by contract or region selection, and you can verify it by inspecting the interfaces and routing on your own hardware. A cloud endpoint, by contrast, must resolve names and keep routes open to serve requests, so residency there rests on vendor promises.
Can I verify which model is running in a cloud API the way I can on-prem?
Generally no. A hosted model sits behind a version label you cannot inspect; the weights, quantization, and any adapters can change without notice, and you cannot hash what you cannot hold. An air-gapped deployment runs open-weight models, so the weight files on your hardware can be hashed and compared to the public artifact's hash. A match proves the running model is exactly what you evaluated. It does not, on its own, prove the model is free of hidden behavior — that is a separate question we do not overclaim on.
Weigh it against your own requirements
Hyfstele is built by Hibiscus Consulting LLC (Raleigh/Cary, NC; SBIR-eligible small business). See the MLR promotional-review assist live, or talk through how an air-gapped deployment compares to your current cloud setup.
View the MLR demo Email blake@hibiscus.buzz