For Regulated & Sovereign Environments
Government, defence, critical infrastructure, and regulated finance ask the same four questions of every vendor. Alvor answers them with architecture: single-tenant by design, deployed in your region, on your servers, or fully air-gapped, with the AI on a model you host.
Vendor screening
4 of 4Where does our data live?
Your region, or your servers
Who else is on the instance?
No one. Single-tenant, own database
Where do AI prompts go?
A model inside your boundary
Can it run disconnected?
Fully air-gapped, yes
The Obligations
Choose the region your dedicated instance runs in, or take the platform onto your own infrastructure entirely. When the obligation says the data cannot leave, it does not leave.
On-premise & air-gapped deploymentAlvor is single-tenant by design: every customer runs their own instance with its own database. There is no shared data plane to explain to a regulator, because there is no shared data plane.
For EnterpriseThe AI Assistant is bring-your-own-model, so AI data flows are governed by your provider agreement, or eliminated as a question entirely by pointing it at a model you host. Every write is approval-gated and audit-logged.
Self-hosted AI modelsBusiness impact analyses, continuity plans, and exercises live in the Business Continuity module, next to the assets and risks they cover, so resilience evidence is a record you maintain, not a binder you rebuild.
Business ContinuityStructured vendor assessments, a hardened external portal, and reassessment schedules give outsourcing registers and vendor-concentration reviews a system of record instead of a spreadsheet.
Third-Party Risk ManagementEvery action is timestamped and attributed, sign-offs are named, and roles keep the person who builds the posture separate from the person who approves it. What the assessor asks for is already a report.
Platform overviewDeployment
A single-tenant instance in the region you choose.
The same containerised platform on your own servers.
Fully disconnected, with the AI on a model inside the boundary.
The Contexts
CPS 234 information-security obligations and CPS 230 operational-resilience expectations, carried by the same record: controls, continuity, and third parties in one place.
APRA CPS 234 & CPS 230 advisorySOCI-style obligations meet a platform that can live inside the protected environment it governs, and keep working when the internet does not.
SOCI readiness advisorySovereignty requirements, approved-infrastructure mandates, and procurement screens answered with a deployment decision instead of an exception request.
Talk to the advisory practiceClassified and clearance-bound environments where shared infrastructure is ruled out by policy. Air-gapped deployment exists for exactly this room.
How air-gapped deployment worksGet started
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.