Full coverage offline - your data never leaves.
For finance, government and critical infrastructure, data residency is not a feature on a checklist - it is the condition that decides whether a tool is allowed inside the building at all. The question these teams ask first is not "how good is the detection" but "where does my source code, my traffic, my finding data go." If the honest answer is "to a vendor cloud for analysis," the conversation is over before it starts. apPosture is built to give a different answer: nothing leaves your network, because nothing needs to.
Most security tools that call themselves self-hosted still keep one foot in the cloud. The scanner runs on your infrastructure, but the AI analysis goes to a hosted model, the vulnerability database is fetched live, the license is validated by a call home, and usage telemetry streams out by default. Each of those is a thread back through the perimeter, and in an air-gapped environment every one of them is a failure point. The design goal here was to cut all of them.
The parts of an AppSec platform that are tempting to host elsewhere are exactly the parts that touch your most sensitive data: the engine that reads source for SAST, the AI layer that reasons over findings, and the gate that decides whether a build ships. In apPosture all three run on customer infrastructure. The scanners (DAST, SAST, SCA, container, IaC, secrets) execute locally. The AI engine is a local LLM served on your own hardware, not an API key pointed at someone else's. The CI gate evaluates policy in your pipeline. There is no step in the pipeline that requires reaching the public internet.
The usual objection to going fully offline is that a security tool goes stale: new CVEs land daily, and a scanner that cannot fetch them is blind to last week's vulnerability. apPosture answers this with a curated CVE and threat-intelligence cache that ships and updates as a controlled artifact rather than a live feed. Detection content - vulnerability records, dependency advisories, the data the engine matches against - is packaged and brought across your own boundary on your own terms, the same way you already move signed software into a sensitive environment.
This matters beyond the air gap. A live feed is itself an attack surface and a dependency: if the upstream is down, poisoned, or rate-limiting you, your scan quality moves with it. A cache that you import deliberately is auditable - you know exactly which content version produced a given finding, which is the kind of provenance a regulator or an incident reviewer will eventually ask for.
The clearest way to see the difference is to lay out what a typical cloud-backed tool sends outward against what apPosture keeps in place:
| Component | Typical cloud tool | apPosture |
|---|---|---|
| Source / traffic analysis | uploaded to vendor backend | processed locally, never leaves |
| AI reasoning | hosted model API | local LLM on your hardware |
| CVE / advisory data | live fetch from the internet | curated cache, imported offline |
| License / entitlement | periodic call-home check | license file, no validation call |
| Usage telemetry | streamed out by default | none emitted |
There is no row where the offline answer is a degraded version of the online one. The engine, the AI analysis and the gate are the same code regardless of whether the host can see the internet - air-gapped operation is the default posture, not a stripped-down mode you fall back to.
"No telemetry" is easy to claim and hard to verify when a product is built to call home and then has the calls switched off by a flag. The more durable position is to not build the outbound paths in the first place. apPosture has no cloud dependency to disable: there is no analytics endpoint waiting for a configuration toggle, no model gateway that a misconfiguration could re-enable. A network team can confirm this the direct way - put the host behind an egress-deny policy and watch the platform keep working with nothing leaving.
An honest air-gapped product almost has to be licensed rather than metered. Metered consumption pricing - per scan, per finding, per token - requires the vendor to count what you do, and counting means reporting, and reporting means a connection out. You cannot sell a no-phone-home platform and bill by phone-home usage. apPosture is therefore a license, not metered consumption: you run it as much as you need on infrastructure you control, and the commercial model never becomes a reason for data to cross the boundary.
For a regulated buyer this closes the loop. The same property that satisfies the auditor - that nothing about your code, your findings, or your usage leaves the network - is the property that keeps the bill predictable and the deployment self-contained. Data residency stops being a compromise you negotiate against capability, because the full platform, AI included, already lives on your side of the wall.