Designed for the isolated and the classified.
Some environments allow no vendor backchannel of any kind — no telemetry, no licence check, no "phone home". Claridis is built to run fully air-gapped and offline, node-locked to its hardware, so the network intelligence you need lives entirely inside the enclave and stays there.
Nothing in, nothing out — except on your terms.
A classified network is defined by what it refuses to allow: no outbound connection, no unverified inbound code, no dependency on infrastructure outside the enclave. A tool that assumes internet access, streams telemetry, or checks a licence server cannot cross that line. Most software fails here not while running, but at the edges — activation, and updates.
How it stays sealed — indefinitely.
The two moments most products need a network are the two Claridis was engineered to do offline: licensing and updates. That is what lets the enclave stay closed for as long as you need.
Claridis is licensed offline and node-locked to its hardware — there is no licence server to reach and no activation to renew over a network.
Updates work the same way. Each one is a cryptographically signed package that an operator carries in, verifies against the signing key, and applies by hand on their own schedule — nothing pulls automatically and nothing calls out to check. The practical effect is the property a classified environment requires: an air-gapped Claridis can run, and stay current, for as long as you need without a single connection ever leaving the enclave. Sealed operation is not a mode you switch on — it is the only way the appliance is built to work.
Fewer moving parts, by design.
The same discipline that keeps the enclave sealed also shrinks what an adversary has to work with.
Source-compiled for the appliance
The software is compiled from source for the appliance and the filesystem is hardened for a closed deployment — reducing the moving parts and the attack surface a general-purpose install would carry.
The whole picture, inside the wire
Discovery, IPAM and topology build a current, accurate map on the appliance itself, so an isolated network is still a fully understood one — no reach-back required.
An assistant with no outside line
On the Local AI edition, Claridis's AI runs locally on the appliance. There is no call to an external model — the assistant stays inside the enclave with everything else.
Governed access, on the record
Role-based access and a full audit trail come with the appliance, so control inside a sealed network is still demonstrable — without opening it to anyone outside.
Run it inside the air‑gapped enclave.
Request an evaluation appliance and deploy Claridis in your own isolated environment — license it offline, apply a signed update by hand, and confirm nothing ever reaches out. For how the no-backchannel model maps to the ISM, PSPF and related controls, see Sovereignty & Trust; for the appliance itself — the whole picture inside the wire, with a local-only assistant on the Local AI edition — see Claridis (in Beta).