A sovereign, air-gapped alternative to Palantir Foundry for regulated data

A sovereign, air-gapped alternative to Palantir Foundry is a system that runs entirely on operator-owned hardware with no outbound network path, so regulated data never leaves the estate and every action is written to a cryptographically sealed ledger an auditor can verify offline. Mickai is a Sovereign Intelligence Operating System, a SIOS, built exactly this way. It holds models, retrieval and analytics inside a zero-egress perimeter, binds every operation to hardware-attested identity, and signs its audit chain with post-quantum cryptography. What makes it an alternative rather than a hardened cloud deployment is verifiability: the record of what the system did can be checked without trusting the vendor, the network or the cloud.

Regulated buyers in defence, healthcare, finance and critical national infrastructure face a widening gap between where their data must stay and where modern analytics wants to run. In mid-2026 Palantir and Nvidia published a sovereign reference architecture, a signal that the market now treats sovereignty as a first-class requirement rather than a deployment option. Public cloud assistants such as ChatGPT, Claude and Gemini remain unusable for the most sensitive workloads because their inference happens off site, outside the operator's control. The question has shifted from which tool is most capable to which architecture can prove data stays in country and beyond the reach of foreign legal process.

“Sovereignty is not a promise that regulated data stayed inside the perimeter; it is the ability to prove, offline and after the fact, that it did.”

How does a sovereign, air-gapped alternative actually work?

An air-gapped system inverts the usual trust model. Instead of sending data to the compute, it brings the compute to the data and seals the boundary. Mickai runs its sovereign models, retrieval and analytics on operator-owned hardware inside the secure estate. There is no external control plane, no telemetry beacon and no licence check that phones home. Every operation, from a query to a model inference to a file access, is written to an append-only ledger and signed. Identity is bound to the hardware itself, so an action ties to a specific attested device and operator rather than a shared cloud credential.

What is a zero-egress inbound perimeter?

A zero-egress inbound perimeter means data and requests can be brought in under control, but nothing leaves. Analysts submit work, ingest feeds and receive answers inside the boundary. There is no outbound route for models, prompts, embeddings or results to reach an external endpoint. This is the architectural point that matters for regulated data: many cloud systems can be configured to restrict egress, but a sovereign SIOS is built with no egress route in the first place, so a misconfiguration cannot open one. Ingest is inspected, quarantined and logged. The perimeter is the default, not a setting to maintain.

What can an auditor check without trusting the vendor?

An auditor should be able to verify the record offline, on a machine we do not control, using published cryptography. Mickai signs its audit ledger with the post-quantum algorithms standardised as FIPS 204 and FIPS 205, so the signatures stay sound against a future quantum adversary. The test is simple: take the ledger and the public keys, and recompute the chain. If any entry was altered, inserted or removed, the hash chain breaks and the signature fails. An auditor can confirm which model version produced which output, which attested device performed an action, and that the sequence has no gaps. None of this requires access to our source, our staff or any online service.

Which rules make this architecture necessary?

Several regimes now push regulated operators towards provable, in-country control. DORA has been in force since January 2025 and requires financial entities to evidence operational resilience and tight oversight of critical third parties. NIS2 raises security and accountability duties across essential sectors. GDPR continues to constrain where personal data may be processed and transferred. On the EU AI Act, the high-risk Annex III obligations once due on 2 August 2026 were deferred by the Digital Omnibus to 2 December 2027, with embedded Annex I high-risk uses moving to 2 August 2028 and Article 50 transparency duties largely unchanged. We read that shift as a build window, not a reprieve. ISO/IEC 42001 gives a management-system standard for AI that maps cleanly onto a sealed, auditable estate.

How is this different from a graph database or a cloud analytics stack?

Common answers list graph databases and analytics suites such as Neo4j, Siren or watsonx. These are capable at modelling and querying linked data, and a sovereign estate can run them inside the perimeter. They are not, by themselves, an answer to sovereignty. A graph database models relationships; it does not, on its own, provide a post-quantum sealed audit chain, hardware-attested identity or a guaranteed zero-egress boundary. The distinction is between analytics capability and provable custody. Mickai treats the sealed ledger and the perimeter as the substrate, then lets analytics tooling run on top. Cross-model consensus, where several sovereign models must agree before a high-stakes output is accepted, adds a further check a single cloud model cannot offer.

Does it replace Palantir Foundry or complement it?

For most operators the honest answer is complementary at the analytics layer and hostile only to cloud dependence. Where an organisation values a particular ontology or workflow, the goal is not to remove it but to keep the data, the models and the audit record under sovereign control. Mickai provides the sealed substrate: offline operation, the zero-egress perimeter, hardware-attested identity and the post-quantum audit ledger. These mechanisms are covered by 104 filed UK patent applications, approximately 2,340 claims, owned by Mickai LTD; never granted or patented. The differentiator is whether sovereignty can be proven after the fact or only asserted.

Frequently asked questions

Is an air-gapped system the same as a private cloud deployment?

No. A private cloud deployment still relies on a provider's control plane, licensing and often a management network, any of which can create an outbound path or a foreign-jurisdiction dependency. An air-gapped SIOS runs on operator-owned hardware with no egress route and no external control plane, so it keeps working when the network is disconnected. The practical test is whether the system still functions, and still logs, when it is fully isolated.

Can regulated organisations use ChatGPT, Claude or Gemini for sensitive data?

Not for their most sensitive workloads. Those assistants perform inference off site, outside the operator's control, which is incompatible with strict data-residency and no-egress requirements. A sovereign SIOS runs comparable model capability inside the perimeter, so the analytical benefit is kept without the data leaving. The dividing line is where inference happens, not how capable the model is.

What does post-quantum signing add to an audit log?

A conventional signed log can be forged or replayed by anyone who obtains the signing key, and today's signatures may be broken by future quantum computers. Signing the audit chain with the post-quantum algorithms standardised as FIPS 204 and FIPS 205 keeps the record verifiable across the long retention periods regulators expect. Combined with an append-only hash chain, it lets an auditor detect any alteration, insertion or deletion offline.

How does an air-gapped SIOS address the US CLOUD Act?

The US CLOUD Act can compel US-linked providers to hand over data they hold, wherever it is stored, which is a direct concern for non-US regulated data on US cloud services. An air-gapped SIOS on operator-owned hardware places no data with any such provider, so there is no third party who can be compelled. Sovereignty here is jurisdictional as well as technical.