Skip to content
Sentinel AI Sentinel AI
Mesh demo Qila demo

Sentinel Qila

SENTINEL QILA

Prove it never left.

The air-gapped defence build — fully isolated, no outbound traffic allowed, sovereign-only, one flat offline licence.

Talk to usSee Sovereignty

THE PROBLEM

In defence and national security, a promise that data stayed in-country is not enough — you have to be able to prove it never left. An accreditor does not accept “we didn’t route it offshore”; they need to see that offshore was never possible. And a promise can fail quietly: one setting left wrong, one fallback path still enabled, a single request to an outside provider — any of these breaks the guarantee, and you cannot take it back.

Sentinel Qila (also Sentinel Sovereign) removes the risk instead of managing it. It is the air-gapped defence build of Sentinel Mesh — the same engine you run everywhere else, delivered sovereign-only for classified and national-security work — and it ships with no outbound path at all. There is nothing to misconfigure, because there is nowhere for a request to go.

THE BUILD

No outbound traffic allowed

Qila answers one question — prove it never left — and the answer holds up to an audit: it runs fully isolated inside your perimeter, with no outbound traffic allowed. Nothing leaves.

  • Nothing leaves your perimeter. The enclave has no path to the outside world. No request can reach an outside provider, because there is nowhere for one to go — and that absence is what you show an accreditor.
  • No setting could ever change that. Isolation is built into the deployment, not switched on. There is no toggle an operator could get wrong — the outside path simply isn’t there. Every request stays in-country by construction.
Commercial deployment versus the Qila defence deployment Two deployments side by side. The commercial deployment — which runs both the Commercial SaaS and the self-hosted Mesh on-premise — can reach outside providers when an operator turns that on; the path exists and stays shut only because a setting keeps it shut, so the guarantee is a promise. The Qila defence deployment is sealed inside your perimeter: there is no outbound path at all, so nothing can leave and no setting could open a way out — the guarantee is something you can prove. COMMERCIAL DEPLOYMENT Commercial SaaS · Mesh on-premise Mesh pipeline auth · guardrails · metering In-country route the default Outside providers a setting keeps this shut QILA DEFENCE DEPLOYMENT Air-gapped · nothing leaves Mesh pipeline auth · guardrails · audit In-country route the only route there is Outside providers NO WAY OUT — NONE TO BUILD YOU PROMISE a setting kept the outside path shut. YOU PROVE there was no outside path to shut.
No outbound traffic allowed. The commercial build can reach outside providers if an operator turns that on — the guarantee lives in a setting. The defence build ships fully isolated: there is no outside path to turn on, so nothing can leave, and you can prove it.

What you get

Sovereign-only, by construction

all inference runs on in-country hardware that no one abroad can restrict. No outside providers, ever, and no way to add one.

Self-contained air-gapped install

delivered as a complete offline bundle that installs and runs on a network-isolated site with no internet reach.

Internal CA

TLS and identity terminate on an in-enclave certificate authority; nothing outside is ever contacted.

Accreditation-grade audit

Sentinel Watch gives you the full evidence trail, the proof an accreditor asks for. Classified traffic is not usage-metered — counting it would itself be a leak — so you see your own usage and audit trail without a meter on the traffic.

One flat offline licence

a per-install licence verified on-site, with no phone-home. The licence covers your entitlement, and your usage and Watch stay fully visible.

The commercial Sentinel Mesh keeps outside routing off by default. The self-hosted Mesh on-premise build leaves that choice to the operator. Qila goes further: it has no outside path at all. Sovereignty here isn’t a policy or a default you set — it’s built into the deployment, which is the difference between a promise and proof. See Sovereignty.

Nothing leaves.

The difference between a promise and proof.

Talk to usSee Sovereignty