Deployment mode

Air-gapped, when the machine has no connection at all

An air-gapped deployment cuts the server off from every outside network. Recapro transcribes and summarises your meetings offline there, with embedded models. Here is what that mode really demands, what it costs you day to day, and the organisations it is justified for.

What it really costs Frequently asked questions

An air-gapped deployment, in one definition

An air-gapped deployment installs the software on a machine sitting in an isolated network, with no network path to the internet nor to any less strictly controlled trust zone. There is no inbound connection, no outbound connection and no supervision tunnel. The only way to move anything in or out is a protocol break, meaning a controlled transfer on physical media. For a meeting-notes tool that implies embedded AI, because offline transcription and summarisation have to be produced by local models on the server itself, no remote service being reachable.

What an air gap means, technically

Three notions are enough to frame the subject, and they are stricter than "the machine has no internet".

Protocol break

No packet travels between the isolated network and the outside. The exchanges you still need, installation, updates, exporting a set of minutes, go through physical media your teams control and log. It is a human procedure, not an automated flow.

Closed trust zone

The server, the hosts connecting to it and the switch linking them form a trust zone whose boundary is physical. An isolated host that accepts a cable to the office network breaks that isolation, even for a few minutes, even for an update.

Embedded AI

With no internet connection, no remote model is reachable. The local transcription and generation models ship with the machine and run on its own hardware. That is the condition for offline transcription to actually work.

What an air gap is not

Four setups are regularly presented as air gaps. None of them is one, and the distinction matters as soon as a security framework requires it.

A private cloud at a hosting provider. The machine is still reachable through the provider network and by its operations teams. The isolation is contractual and logical, not physical.
Access through a VPN only. A VPN is a network path to the outside. It is encrypted and authenticated, which is useful, but it exists, and the machine stays reachable.
A firewall blocking outbound traffic. A rule can be changed, forgotten or fail open. An air gap does not rely on any software configuration to hold.
An on-premise server with telemetry. A server installed at your site that still reports metrics or keeps a supervision tunnel open is on-premise, not air-gapped. That is precisely what separates the two modes.

What an air gap costs you

Isolating a machine removes some risks and creates others. A buyer who knows the subject expects these four points, and is right to expect them.

Updates arrive on physical media

No patch can be pushed remotely. Every application release, every model update and every system fix arrives on media that someone has to carry in, verify and apply on site.

What it asks of you A written import procedure, dedicated transfer media and a planned maintenance window. The delay between a fix being published and applied depends on your organisation, not on ours.

No telemetry, therefore no remote diagnosis

Nothing leaves the machine, including technical metrics and logs. Nobody outside can see that a disk is filling up, that a model fails to load or that a service is restarting in a loop.

What it asks of you Internal monitoring wired into your own tools, inside the isolated network, plus operational skills on site. When an incident happens, diagnosis starts with a log export you produce yourself.

No automatic off-site backup

A remote backup assumes a network path to the outside, which an air gap forbids by design. A fire, a theft or a hardware failure takes away the data left on the only machine.

What it asks of you A local backup policy on removable media, taken off site according to your rules, and a regular restore test. This is the point most often underestimated at decision time.

Support cannot connect

No remote assistance is possible. A ticket is not resolved by taking over the server, and what you can share with the vendor is limited to what your teams can extract and hand over.

What it asks of you An internal technical owner trained to operate the machine, and on-site interventions when they are needed. The standard on-premise mode, by contrast, keeps a supervision channel.

The takeaway: An air gap is not a comfort option to tick "just in case". It shifts operational load onto your teams in exchange for a strong guarantee, namely that no meeting content can leave because no path allows it. If your requirement holds without that guarantee, the standard on-premise mode is simpler to operate.

Who actually needs an air gap

These organisations do not choose isolation out of caution. They already apply it to other systems, and a meeting-notes tool has to comply.

01

Clinical research

Committees, protocol reviews and discussions involving patient data often take place on a technical network already separated from the office network. A tool requiring an outbound connection simply could not enter it.

02

Defence and sovereign industry

On classified sites the question is not whether the vendor is trustworthy. No outbound traffic is allowed, whoever the recipient is, and the tool has to do without it entirely.

03

Critical infrastructure operators

Information systems of vital importance are compartmentalised by regulatory obligation. A transcription service hosted elsewhere cannot capture the meetings that deal with those systems.

04

Sensitive industrial sites

On an automation or production network, isolation protects availability as much as confidentiality. Production committees and incident reviews are held there, and their minutes have to stay inside the zone.

05

Qualification environments

A qualification bench reproduces a sensitive environment and stays cut off from the rest of the information system. Validating the tool there before any rollout assumes it works with no outside network.

06

Hospital healthcare

Some hospital networks isolate the segments carrying health data. The Recapro architecture is HDS-ready; in Cloud the HDS certification remains held by your hosting provider, and in air gap no third-party host is involved at all.

If your need matches none of these situations, an air gap is probably an unnecessary constraint. A standard on-premise deployment already keeps meeting content on your own hardware while retaining remote supervision.

How Recapro runs air-gapped

The same product as the on-premise version, with every outbound connection removed and a lifecycle that runs on physical media.

Installation from physical media

Application images and models are delivered on media, not downloaded at first boot. The machine needs no outside network access to be operational, neither on first start nor afterwards.

Zero outbound traffic

No telemetry, no heartbeat, no supervision tunnel. What the standard on-premise mode sends outside is simply absent, and your meeting content had never left it in the first place.

Access from the isolated network

The mobile, desktop and web apps connect to the server from the isolated network, exactly as they would on a regular LAN. No port is published outside, since there is no reachable outside.

The embedded local models

Transcribing and summarising means reading the text in clear. Air-gapped, that reading happens on your server, by open-weights models shipped with it. No excerpt is sent to OpenAI, Anthropic, Google or Mistral, for the simple reason that none of them is reachable.

whisper.cpp (transcription) vLLM (generation) pyannote (speakers) Local database PowerSync sync engine Open-weights models

Three questions not to confuse

An air gap answers the network question. Two other pages answer the two other questions a buyer asks.

Recapro On-Premise Where the software runs. A dedicated server inside your walls, the full stack on the local network, and a standard mode that keeps remote supervision. Sovereign notetaker Which law your meetings are processed under. The four criteria of the category, from hosting to reversibility. Cloud vs On-Premise Where your data is stored depending on the deployment model, and what each option implies in practice. Security and transparency Our architecture, our subprocessors by name, and what we are or are not certified for.

Air-gapped deployment, your questions

01

What is an air-gapped deployment?

It is an installation on a machine placed in an isolated network, with no network path to the internet nor to any less protected zone. There is no inbound connection, no outbound connection and no supervision tunnel. The exchanges you still need go through a protocol break, meaning a controlled transfer on physical media.

02

Can a meeting be transcribed with no internet connection?

Yes, provided the models are embedded on the machine. Air-gapped, Recapro produces offline transcription and the summary with local models running on the server itself. A tool that calls a remote transcription API cannot work in this mode.

03

Is VPN-only access an air gap?

No. A VPN is a network path to the outside, encrypted and authenticated, but very much present. An air gap assumes the absence of a path, not its protection. A private cloud at a hosting provider and a firewall blocking outbound traffic are not air gaps either.

04

How do updates arrive with no network?

On physical media. Every application release, every model update and every system fix is delivered on media that your teams verify and apply on site, in a planned maintenance window. The delay between a fix being published and applied therefore depends on your internal procedure.

05

What happens to support during an incident?

No remote assistance is possible, since nobody can connect to the machine. Diagnosis starts with a log export your teams produce and hand over, and some interventions happen on site. This is the main trade-off of the mode.

06

Are backups possible on an air-gapped machine?

Locally yes, automatically off site no. A remote backup assumes a network path an air gap forbids. The backup policy therefore relies on removable media taken off site according to your rules, with regular restore tests.

07

How is licensing handled with no outbound connection?

With no traffic to the outside, no online verification is possible. Licensing terms are settled in the contract and at delivery, and renewals go through the same physical channel as updates.

08

What is the difference between on-premise and air-gapped?

An on-premise deployment installs the server inside your walls, but its standard mode keeps limited outbound traffic, namely machine telemetry, a heartbeat and a supervision tunnel, never meeting content. An air gap removes that traffic and the supervision that comes with it. In both modes, meeting content does not leave the machine.