Air-gapped business software for government, defence and critical infrastructure in India

What air-gapped means

NIST defines an air gap as an interface between two systems that are not connected physically, where any logical connection is not automated, so data moves only manually under human control [1]. In practice that rules out SaaS, licence checks that phone home and cloud AI services.

What Indian guidance says

• Government cloud: MeitY told Parliament in 2022 that empanelled cloud providers give a legal undertaking that data shall reside in India [2]. By September 2026 MeitY had empanelled 30 providers and about 2,330 departments used the MeghRaj ecosystem [3].
• Classified data: MeitY's Cloud Selection Framework of 20 March 2026 does not permit Top Secret or Secret workloads on cloud platforms, with classification following MHA's National Information Security Policy and Guidelines. The framework is advisory [4].
• Standalone systems: in December 2022 the Ministry of Home Affairs asked officials to do classified work only on standalone computers not connected to the internet [5].
• Critical information infrastructure: NCIIPC guidelines (version 2.0, 2015) say complete isolation of the intranet from the public network should be maintained, with whitelisted connections and controlled removable media [6].
• Power sector: the CEA's 2021 cyber security guidelines call for hard isolation of OT systems from internet-facing IT [7].

Defence requirements are largely classified, and we found no public document that mandates a specific deployment model, so treat each programme's own security instructions as the rule. No single statute says all government data must stay in India; residency comes from MeitY empanelment terms and procurement guidelines [2][8].

What business software needs to run air-gapped

• Installation, updates and licensing that work with no internet connection.
• AI models that run inside the perimeter, not calls to a public model API.
• Identity, audit logs and monitoring that run locally.
• One platform for many functions, so each new tool does not need its own isolated deployment.

Where Own360 fits

Own360 deploys on-premise, in a private cloud or air-gapped, with 23 OwnApps on one control plane. OwnIQ, the sovereign AI gateway, can route to self-hosted models so inference stays inside your perimeter, and OwnCentral provides identity, role-based access for people and agents, an immutable audit log and observability, all on your infrastructure.

Questions buyers ask

What is an air-gapped system?

Two systems with no physical connection, where data moves between them only manually under human control, as NIST defines it [1].

Can Secret government data go on cloud in India?

Not under MeitY's March 2026 Cloud Selection Framework, which does not permit Top Secret or Secret workloads on cloud platforms; the framework is advisory [4].

Must all Indian government data stay in India?

No single statute says so; residency comes from MeitY's cloud empanelment undertakings and procurement guidelines, which require data to reside in India [2][8].

Read next

• OwnIQ, the sovereign AI gateway
• The DPDP Act and data localisation
• Security at Own360