Defence & classified networks
Operators bound by classification rules that prohibit any outbound connectivity, monitored or not.
Platform/Air-Gapped Networks
Never touches the internet.
A fully offline Hive control plane for networks that can never see the public internet: defence, critical infrastructure, and isolated industrial sites still get every capability, delivered by hand.
Who it's for
Zero egress, zero compromise
Some networks aren't allowed a connection to the outside world, full stop. Hive's air-gapped variant runs the entire control plane and policy engine with no outbound path required: not a degraded mode, the same fleet management.
Critical infrastructure
Utilities, energy, and transport operators isolating operational technology networks from the public internet by design.
Isolated industrial networks
Manufacturing and industrial sites where the control network is physically segmented from anything internet-facing.
Architecture
The full console, fully offline
The same containerised control plane as on-premises, with every outbound dependency removed. No phone-home telemetry, no licence check-in, no update server it needs to reach.
- Complete fleet management with no internet egress, ever
- Local certificate authority for device identity, no external trust chain
- Local application repository: a private Google Play with none of the internet
- Signed, portable update bundles for manual transfer into the enclave
- Device enrollment performed entirely inside the enclave, no cloud handshake
How it moves
Software travels by hand, not wire
When there's no wire to send updates across, Hive makes the manual path a first-class one: signed, verifiable, and repeatable.
Signed update bundles
- Console, agent, and policy updates as one signed artifact
- Carried in on approved removable media, the classic sneakernet
- Signature verified locally before anything is applied
Local app repository
- Import APKs once, distribute silently to every device
- Version pinning and staged rollout, same as connected fleets
- No Managed Google Play dependency anywhere in the chain
Enrollment in the enclave
- QR or config-file enrollment against the local control plane
- Devices never dial out during provisioning
- Bulk enrollment for large batches staged before deployment
Isolation at scale
Disconnected, not diminished
- Outbound connections required
- 0Outbound connections required
- Console feature parity with cloud
- 100%Feature parity with cloud Hive
- Update bundle signature checks
- 100%Update bundles cryptographically signed
- Audit log retention control
- FullAudit log retention, defined by you
Audit & compliance
Isolated doesn't mean unaccountable
Every command, policy change, and remote session is still logged, immutable, and exportable. The audit trail simply never has to leave the enclave to prove its case.
- Immutable audit logs for every command and configuration change
- Locally exportable evidence packages for classified reviews
- Retention controls you define, with no vendor-side copy of the data
- Reviewed as part of Hive's trust centre documentation
- Available under a Custom agreement, with matching SLAs
Air-gapped deployment ships under a Custom agreement: see pricing.
Related
Keep exploring
On-Premises
The connected variant: full control-plane ownership without giving up outbound updates.
Explore →Security & Compliance
Per-device identity, signed commands, and immutable audit logs across every deployment mode.
Explore →Platform Overview
One control plane, four deployment modes, and Android support from GMS to bare AOSP.
Explore →