Jira air-gapped alternative: how to keep your project data offline after 2029

Table of contents

Can Jira run in an air-gapped environment?
On-premises, private cloud and air-gapped are not the same thing
Every Jira route to an air gap, compared
What a Jira air-gapped alternative has to prove
How Easy8 runs behind an air gap
Installation and deployment
Licensing that never phones home
Identity and access you own
AI that stays inside the perimeter
Integrations and automation behind the gap
Certified, and committed for the long term
Proof from production: EKS InTec
A common pattern: Jira outside, Easy8 inside the air gap
From Jira Data Center to air-gapped Easy8

TL;DR

Jira can run behind an air gap today only as Data Center, which Atlassian stops selling to existing customers on 30 March 2028 and switches to read-only on 28 March 2029. Jira Cloud cannot run offline, and Atlassian's announced air-gapped deployment targets US classified workloads with no date. Easy8 runs fully air-gapped now, with offline licensing and updates, local identity, AI that stays inside the perimeter, and a migration path for your Jira data.

Can Jira run in an air-gapped environment?

Yes, but only in one form, and only for a while longer.

Jira Data Center installs on your own servers, against your own database and Active Directory, so it works behind an air gap. It is also the product Atlassian is retiring:

Jira Cloud is a hosted service. It needs a connection to Atlassian, so by definition it cannot run on an isolated network.

Atlassian's announced air-gapped deployment (23 September 2026) targets US classified workloads at impact level 6 (IL6) and above. It is still in technical design with US government partners and has no date, pricing or product list. We looked at the details in Atlassian's air-gapped deployment: Just not for Europe, and not before 2029.

So for a European bank, energy company, research institute or defence supplier, there is no Atlassian product that will run air-gapped after March 2029. 

The real planning deadline is earlier: from 30 March 2028 you cannot grow your Data Center licence beyond the size it has that day.

On-premises, private cloud and air-gapped are not the same thing

People often use the three terms as synonyms. They describe very different levels of isolation.

• On-premises: the software runs on infrastructure you control. It may still call the vendor for licence checks, updates, avatars or telemetry.
• Private or isolated cloud: a single-tenant instance hosted for you, usually by the vendor. Your data sits apart from other customers, but the platform is still operated by someone else and reached over a network. Atlassian's Isolated Cloud, for example, targets organisations with 15,000+ seats, as we cover in our analysis of Atlassian's plans.
• Air-gapped: the system has no physical or logical connection to the internet or to any network the organisation does not fully control. Nothing goes out, and everything that comes in (installers, updates, licences) passes through your own approved transfer process.

That last point is where most "on-premises" tools fail. Self-hosting is the easy part. 

The hard part is everything inside the product that still expects to reach the internet: 

• licence activation that phones home
• installers that fetch dependencies
• update commands pointed at a public repository
• sign-in through a hosted identity provider
•  AI features that send prompts to an external model

We list these blockers in detail in our comparison of air-gapped project management tools.

Every Jira route to an air gap, compared

Two more questions decide whether a Jira setup can move behind an air gap at all, and neither has a public answer from Atlassian yet: whether Rovo, its AI layer, will work without an internet connection, and whether Marketplace apps will run there. Most Jira installations depend on apps, so the second question alone can decide a migration.

What a Jira air-gapped alternative has to prove

When regulated organisations brief us, the request usually looks like this one, which we received from an international organisation this year:

A secure, on-premises Jira alternative compatible with high-security and air-gapped environments, with documentation on security compliance, deployment flexibility, scalability and pricing for around 1,000 users.

Behind those four words sit concrete checks. Use them as your evaluation list:

1. Deployment model: no mandatory internet calls at install or at runtime, and a documented offline install.
2. Licensing and updates: offline licence activation and a defined process for patches and upgrades through removable media or an internal repository.
3. Identity and access: sign-in against your own directory (LDAP, Active Directory) or your own SAML identity provider, plus two-factor authentication you control.
4. Compliance and audit: role-based permissions, audit trails, and evidence that maps to ISO 27001, NIS2, DORA or your national rules.
5. Feature fit: the work Jira does today (agile boards, workflows, service desk) plus whatever you currently bolt on through apps.
6. AI behind the gap: if AI touches project data, it has to run inside the same perimeter.
7. Integrations and automation: workflows and connectors that run on your own servers, not through a hosted integration service.
8. Contractual data protection: a written commitment on where your data is stored and that no vendor cloud or AI service can access or reuse it.
9. Scalability and cost: a licence model that fits several hundred to several thousand users, and a rollout you can phase.
10. Vendor commitment: a written commitment that the self-hosted product will still exist when your next audit comes round.

How Easy8 runs behind an air gap

Every tool you bring inside the perimeter is one more thing to install, patch and secure offline. Easy8 replaces several of them with one system: project and portfolio management, agile and waterfall delivery, resources, budgets, time tracking, help desk and knowledge base. 

It is a European Private WorkOps Platform built on open-source Redmine.

Installation and deployment

• Fully isolated deployment: Easy8 runs inside your network with no connection to the internet or to us.
• Three install routes: a Docker container (our recommended option), a pre-configured virtual machine for VMware or VirtualBox, or a custom installation for specific infrastructure requirements.
• Air-gapped installation and offline updates: we deliver both as part of our deployment service, together with security hardening and regular maintenance. Our team prepares the packages; your team moves them across the gap through your own approved process.
• Not every team needs a full air gap: the same platform runs as a Private Cloud or in the EU Sovereign Cloud, operated by EU-based entities, with data processed and stored only in the EU region you select.

Licensing that never phones home

• A perpetual server licence includes the installable package with its source code, so the platform keeps running on your terms.
• If you prefer operating cost to capital cost, a service subscription is available for on-premises deployments too.

Identity and access you own

• LDAP against one or more directories, including Active Directory and OpenLDAP.
• SAML 2.0 and OAuth 2.0 single sign-on, pointed at your internal identity provider. On a connected network, Microsoft Entra ID works too.
• Two-factor authentication that admins can require for everyone, only for administrators, or for selected groups, plus brute-force protection and session expiry settings.
• Role-based permissions down to project, tracker and field level.

AI that stays inside the perimeter

You can deploy Easy AI on-premises, so prompts and project data never leave your infrastructure. In an air-gapped network, this is the difference between having AI and having none: a hosted model is simply unreachable.

Integrations and automation behind the gap

Easy8 connects to other systems through its REST API and through n8n, a workflow automation tool that you can host on your own servers. Your workflows then run next to Easy8 inside your perimeter, so integration data does not pass through a cloud service you do not control.

Certified, and committed for the long term

• Easy8 holds ISO 27001 (information security), ISO 27017 (cloud security), ISO 9001 (quality) and ISO 42001 (AI management system) certifications. They cover how we build, release and support the product; your own instance stays inside your ISMS and your audit scope.
• Our founder and CEO, Filip Morávek, has made a public commitment that Easy8 will support and maintain on-premises solutions indefinitely. For a buyer comparing roadmaps, that sentence matters as much as any feature.

Proof from production: EKS InTec

EKS InTec GmbH, an engineering partner in automotive and industrial automation from Weingarten, Germany, works with customer data and engineering IP that must never leave its network. The company runs Easy8 air-gapped inside its own infrastructure, with no connection to the public internet and full control over access rights, logging and retention. 

Project planning, resources, time tracking, quality checklists and the help desk all run in that one isolated installation.

A common pattern: Jira outside, Easy8 inside the air gap

Not every organisation can (or wants to) replace Jira everywhere at once. A pattern we see more often in briefs from international and public organisations looks like this:

• Two networks, same architecture. One Easy8 instance on the internet-connected network, one on the air-gapped network, built the same way so admins maintain one setup twice rather than two different systems.
• Service desk and projects together. For example, around 1,000 users doing project and task work, of whom roughly 300 act as help desk agents.
• Jira can stay where your policy allows it. Some teams keep Jira on the connected side for as long as it suits them and run Easy8 for work that must stay behind the gap. How and whether data moves between the two networks is a decision for your security team, and we scope it with you as part of the project.
• One user, one licence. The same people can work on both instances without paying twice, as long as the agreement says so.

This way, the air-gapped side does not depend on Atlassian's timeline at all, and the connected side can move at its own pace.

From Jira Data Center to air-gapped Easy8

The calendar is the real constraint. Counting back from 30 March 2028, a regulated organisation has roughly 16 months to choose, test, approve and migrate, and procurement alone often takes a large part of that.

A realistic sequence:

1. Map what Jira does for you today: projects, workflows, service desk, and every Marketplace app you rely on.
2. Agree the deployment model with your security team: on-premises, air-gapped, or both networks.
3. Run a migration pilot on a copy of your own Jira data. We migrate with our native migrator or the n8n-based migration tool, and existing data can also come in as SQL and file dumps or XML/CSV imports.
4. Install inside the gap using the Docker image or virtual machine, with offline licence and update packages prepared by our team.
5. Roll out in phases, department by department, while Jira Data Center is still supported.

If your work has to stay behind an air gap, you need a platform whose offline future does not depend on someone else's roadmap. 

Book a free Jira data migration pilot and test Easy8 on your own data, in your own environment, or start with our on-premises and air-gapped deployment options.