On-premises deployment: air gap, self-hosted or managed server?
On-premises is no longer a binary choice. Between air gap, self-hosted and managed server, there are shades that affect data sovereignty, AI use and daily operations. Here's how to pick the right one.
TL;DR
On-premises comes in 3 main shades: air gap, self-hosted and managed server. Based on Easy8's 20 years of deployment experience, air gap gives maximum control but blocks integrations. Self-hosted balances control with flexibility. Managed server keeps your data on your infrastructure while someone else runs it.
Why on-premises matters now
Regulations like the 2018 US CLOUD Act, NIS2, DORA and the Cyber Resilience Act have changed the conversation. It's not just about where your data physically sits, but which jurisdiction applies to your vendor. In a 2025 French Senate hearing, Microsoft confirmed under oath that if US authorities requested customer data, they would have to comply, even for data stored in Europe. France and others are now actively replacing US providers with European alternatives, like Easy8.
If you want data to physically and legally belong to you, on-premises is the only real answer. The good news: you have options.
Three shades of on-premises
Every on-premises deployment covers 4 layers: the delivery artifact (e.g. a Docker container), the runtime stack (web server, database, background workers), outbound dependencies (email, SSO, AI, integrations) and operations (backups, upgrades, maintenance).
The 3 deployment modes:
- Air gap: no internet connection at all. Maximum control, built for the most critical and most heavily guarded environments. Updates arrive through a controlled transfer zone.
- Self-hosted: runs on your infrastructure with controlled outbound connections for mail, SSO, AI or integrations. The setup most of our webinar attendees run today.
- Managed server: your data stays on your infrastructure, but a trusted vendor handles operations and upgrades.
In all three, your data physically stays with you. The difference is how much you lock down and how much you operate yourself.
1) Air gap deployment: when it fits
Air gap works when you are forbidden from any outbound connection and have the team to manage weekly security rebuilds. Keep in mind:
- Every integration partner must also be air-gapped, which rules out most automation across systems.
- Security patches still need regular installation, so you need a flexible update process through a controlled transfer zone. Air gap is not a way to skip updates: internal users can still exploit vulnerabilities.
- Watch for vendors claiming "air gapped cloud" — make sure their definition matches yours.
2) Self-hosted deployment: when it's chosen
If your regulations allow some outbound connections, self-hosted is usually the more comfortable choice. You decide which components stay inside and which you outsource, for example email delivery, an identity provider for SSO, integrations or an AI provider. Sensitive parts can still live in an isolated subnetwork.
3) Managed server: when it's suitable
Managed server suits organisations that want the same physical ownership of data but don't want their IT team to run the database, backups and upgrades. The data stays on your infrastructure, while a trusted vendor takes care of operations.
How to choose: 3 questions
- Can the instance open any outbound connection at all? If not, the answer is air gap.
- Do you want to operate the system yourself — database, backups, upgrades? If yes, go self-hosted. If not, consider a managed server.
- Are integrations the reason you're buying the software? Then air gap is not an option.
How AI and integrations can work on-premises
Self-hosted LLMs are now viable. Easy8 tests show you need at least 96 GB of VRAM for interactive chat use by several people at once, and 48 GB is enough for background tasks. With more users, plan for more. The indexing, vector database and data handling can live inside your runtime stack, while the LLM itself can run locally or connect to a sovereign European provider.
Most Easy8 clients currently use a sovereign European cloud LLM, while some run the model fully on-premises. If you go air-gapped, the LLM will be one of the most expensive parts of your stack.
For integrations, separate inbound from outbound connections. Even a standard self-hosted setup can be hardened to behave almost like air gap by restricting outbound traffic to only what you need.
Your deployment choice is not a one-time decision. As regulations evolve, reassess your classification at least once a year — you may need to internalise more components over time. Before you decide, check with your vendor whether switching between modes later is feasible, as licensing and the runtime stack can differ.
Recording: Watch the full webinar
Want the full technical breakdown? Watch the full recording and book a consultation with an Easy8 expert.
Moving off Jira Data Center before its 2028 end of life? Join our next webinar on 19 November, where we share how clients have already migrated from Jira Server and Data Center while staying on-premises.
Frequently asked questions
Does on-premises hosting guarantee data sovereignty under regulations like NIS2 and DORA?
On-premises keeps your data physically and legally under your control, which is the foundation of data sovereignty. It does not by itself make you compliant with NIS2 or DORA: you still need to assess your obligations regularly and secure and operate the system accordingly.
Which on-premises deployment is right for my organisation?
It depends on your regulatory requirements, your integrations and your internal capacity. Choose air gap if you are barred from any outbound connection, self-hosted if you want to run the system yourself with integrations, and managed server if you want to offload day-to-day operations.
What are the different shades of on-premises and how do they differ?
There are three main shades of on-premises: air gap, self-hosted and managed server. In all of them your data physically stays on your own infrastructure. They differ in how locked down the environment is and who handles day-to-day operations.
Related articles
Good AI vs bad AI: How to adopt without losing your edge
Two companies. Same budget. Same goal: adopt AI. One year later, they end up in completely different places. Here is what separates AI that sharpens your business from AI that quietly drains it.
Building a context layer for AI
Half of the organisations we surveyed have no single source of truth for their work. Our first webinar of the autumn series looked at what that costs, and at how a context layer lets AI reach the systems where your work already lives without handing over control.
WorkOps for IT operations: Automate L1 and L2 support with AI and MCP
Most IT ops teams sit on huge automation potential and barely use it. In our latest WorkOps webinar, our experts show how AI agents, n8n and MCP can resolve L1 tickets without a human and guide L2 technicians through real fixes.
