Air-Gapped AI for Defence, Government and Regulated Teams: A Setup Checklist (2026)
Under CMMC, any AI that processes controlled unclassified information is in scope. A five-phase checklist for running AI coding and chat on isolated or restricted networks: what to download, how to verify and transfer it, how to prove nothing leaves, and the exact network allowlist for Quietly—including its one honest limitation.
Awareness · 11 min
Air-Gapped AI for Defence, Government and Regulated Teams
Under CMMC, any AI that processes controlled unclassified information is in scope. A five-phase checklist for running AI coding and chat on isolated or restricted networks: what to download, how to verify and transfer it, how to prove nothing leaves, and the exact network allowlist for Quietly—including its one honest limitation.
Definition
An air-gapped AI setup runs the language model, its engine and every file it needs on machines with no route to the internet. Everything is downloaded and checked on a connected system first, moved across through an approved process, and then used fully offline.
Teams handling export-controlled data, controlled unclassified information (CUI) or classified work can’t send source code to a cloud assistant. In the US, CMMC’s first phase took effect on November 10, 2025, and any AI system that processes, stores or transmits CUI sits inside the same security boundary as everything else that touches it.
Cloud AI tools don’t fit inside that boundary. Local ones can—if you set them up carefully.
This checklist works in five phases. It’s written for Quietly, but most steps apply to any local AI tool. At the end we cover the one thing Quietly needs from the network, so you can plan for it rather than discover it later.
The five phases at a glance
From connected download to verified offline use.
| Phase | Where | Goal |
|---|---|---|
| 1. Provision | Connected staging machine | Download the app, engine and models |
| 2. Verify | Connected staging machine | Check every file’s hash against its publisher |
| 3. Transfer | Your approved media process | Move the files across the gap |
| 4. Isolate | Target machine | Install, import and lock down the network |
| 5. Prove | Target machine | Show that nothing leaves—and record it |
Phase 1 — Provision: what to download
Files to collect on the connected staging machine.
| Item | Where from | Notes |
|---|---|---|
| Quietly installer | quietlycode.org/download | .exe, .dmg, AppImage, .deb or .rpm for the target OS |
| llama.cpp server build | Official llama.cpp GitHub releases | Match the target OS, CPU and GPU (CUDA, Vulkan, Metal or CPU) |
| Model files (.gguf) | The original publisher on Hugging Face | Pick sizes that fit the target’s RAM and VRAM; bring two (a small fast one and a stronger one) |
| The sha256 of each file | The release page or Hugging Face file page | Copy them now—you’ll need them on both sides |
tip
Stick to llama.cpp on isolated machines
Quietly’s other engines (AirLLM, image generation and training) install Python and packages from GitHub, PyPI and PyTorch’s servers during setup. That’s awkward to reproduce offline. llama.cpp with GGUF models is a single binary plus model files—much easier to move, review and approve.
Phase 2 — Verify every file
Compute hashes and compare them with the published values
# Linux
sha256sum Quietly-*.AppImage llama-*.zip *.gguf
# macOS
shasum -a 256 Quietly-*.dmg llama-*.zip *.gguf
# Windows (PowerShell)
Get-FileHash .\* -Algorithm SHA256Write the hashes into your transfer record. Re-check them on the target machine after transfer. A matching hash proves the file wasn’t corrupted or swapped on the way; it doesn’t prove the source was trustworthy—so download from original publishers only.
Phases 3 and 4 — Transfer, install and lock down
- Move the files with your approved media process and scanning procedure.
- Install Quietly on the target machine.
- On Quietly’s first-run setup screen, choose “I already have it” (labelled “Browse for llama-server” when Air-Gap Mode is on) and point it at the transferred llama.cpp build.
- In Settings → Models, use Import Model to add the .gguf files.
- Turn on Air-Gap Mode in Settings → Privacy. Quietly then refuses every request that isn’t to the machine itself, refuses the agent’s terminal and web tools, and cancels any download.
- Open each project in Restricted Mode first, so project-controlled tools (git hooks, linters, language servers, MCP servers) stay off until you’ve reviewed them.
note
Why the engine never listens on the network
Quietly starts every engine bound to 127.0.0.1, so other machines on the network can’t reach it—even on a shared isolated network.
Phase 5 — Prove that nothing leaves
Security reviewers rarely accept “the vendor says so”. Give them evidence from three independent layers:
Evidence a reviewer can check.
| Layer | How to check | What “good” looks like |
|---|---|---|
| App | Settings → Privacy → Security Feed | Blocked requests listed; no successful outbound calls |
| Operating system | List open connections while using chat and the agent (command below) | Only 127.0.0.1 / ::1 connections |
| Network | Your firewall or network monitoring logs for the machine | No outbound traffic from the device |
Show the app’s network connections (Linux; use Resource Monitor on Windows or lsof on macOS)
sudo ss -tunp | grep -Ei 'quietly|llama'The one network call Quietly needs: plan for it
Quietly’s licence works offline for 30 days at a time. After that, the app needs a single HTTPS check to www.quietlycode.org before it unlocks again; your key and data are kept. Air-Gap Mode postpones the check but doesn’t extend the 30 days.
Fitting the licence check into different environments.
| Environment | Works with Quietly? | How |
|---|---|---|
| Restricted network with a controlled proxy | Yes | Allow www.quietlycode.org only; block everything else |
| Isolated machine with scheduled connection windows | Yes | Connect briefly at least every 30 days, with Air-Gap Mode off for that moment |
| Permanently disconnected (never any connection) | Not today | Contact us before buying so we can discuss your setup |
Full allowlist, if you control egress during provisioning.
| Host | Used for | When |
|---|---|---|
| www.quietlycode.org | Licence activation and check | At least every 30 days |
| github.com, api.github.com, objects.githubusercontent.com | Engine downloads, app updates, portable Python | Provisioning only |
| huggingface.co, cdn-lfs.huggingface.co | Model downloads | Provisioning only |
| pypi.org, files.pythonhosted.org, download.pytorch.org | Python engines (AirLLM, image, training) | Provisioning only, if used |
Mapping it to your compliance story
- CMMC: an AI tool that touches CUI is in scope. Running the model on an in-boundary workstation keeps it under the same access control, encryption and logging as your other systems.
- ITAR and export control: cloud AI can mean technical data leaves your control and crosses borders. Local inference keeps it on the machine.
- Software bill of materials: list Quietly, the llama.cpp build and each model file with its hash.
- Data storage: chats are files under the user profile, and project indexes live in each project’s .quietly folder. Neither is encrypted by Quietly—rely on full-disk encryption.
warning
This is a technical checklist, not an accreditation
Your authorising official, facility security officer or compliance lead decides what’s approved. Use this list to prepare the evidence they’ll ask for.
Where Quietly fits
FAQ
Can you run an AI coding assistant in an air-gapped environment?
Yes. Download the app, a llama.cpp build and GGUF model files on a connected machine, verify their hashes, transfer them through your approved process, and run them fully offline. The model and engine need no internet once installed.
Does CMMC cover AI tools?
Yes. If an AI system processes, stores or transmits controlled unclassified information, it’s in scope and must sit within the same security boundary as other systems that handle CUI.
Does Quietly need the internet?
Only for setup downloads and a licence check at least once every 30 days to www.quietlycode.org. Chat, coding and the agent run fully offline. Permanently disconnected environments should contact us before buying.
How do I prove an offline AI tool isn’t sending data?
Check three layers: the app’s own log (Quietly’s Security Feed), the operating system’s list of open connections, and your network firewall or monitoring logs. All three should show no outbound traffic.
Which models are best for air-gapped use?
GGUF models from original publishers, run with llama.cpp. They’re single files that are easy to hash, review and transfer. Bring a small fast model and a stronger one sized for your hardware.
Sources
- CMMC 2.0: the model, the rules, and the timeline — SaltyCloud
- AI, CMMC and ITAR: what compliant AI looks like for defense manufacturers — Proto
- CMMC: what every DoD contractor needs to know — US Department of Defense
Related guides
Awareness
Local AI for Lawyers: Using AI Without Breaking Client Confidentiality (2026)
In February 2026 a federal judge ruled that a defendant’s chats with a consumer AI weren’t privileged—partly because the provider’s policy let it keep and disclose them. What ABA Opinion 512 asks of lawyers, where a prompt actually travels, and how to use AI on client matters without the data ever leaving your machine.
Awareness
Local AI for Therapists: Writing Session Notes Without Sending Them to the Cloud
AI note tools save clinicians hours, but most send session content to a vendor’s servers. What HIPAA and the APA’s 2025 guidance expect, why psychotherapy notes get extra protection, and a step-by-step way to draft progress notes with a model that never leaves your computer.
Awareness
AI for Journalists: How to Use It Without Exposing Your Sources
Your shield law protects you—not the copy of your notes sitting on an AI company’s servers. Why “we don’t train on your data” isn’t source protection, what the 2025–26 ChatGPT log orders showed, a threat-model table for reporters, and an offline workflow for transcripts, documents and travel.