The Air-Gap Rule
Some networks have no internet. Not by policy — by design.
A SCIF (Sensitive Compartmented Information Facility) is a Faraday-caged room. No wireless signal goes in or out. ITAR (International Traffic in Arms Regulations) bans sending covered technical content to unapproved parties. Cloud providers are not ITAR-cleared. For these groups, "cloud SaaS" is not a risk to manage.
For these sites, cloud tools do not work. Full stop.
A tool that needs a live network link cannot run here. A tool that calls a license server is blocked. A tool that sends files to a cloud API for detection cannot function inside a SCIF. These are not edge cases. They are daily constraints for defense teams.
The ITAR Case
A data scientist at a defense firm has personnel records under ITAR. She must remove names and IDs before sharing the files. Her network is air-gapped.
There is no cloud fix. The only path is a tool that runs on the local device, stores its models locally, and produces clean output with no external calls at all — not even to a vendor's own servers.
anonym.plus, our sister product built for exactly this case, does this: a one-time license, detection models bundled on the device, no network call at any point. anonym.legal's own Desktop App does not fit a true air gap — it keeps files local, but PII detection still calls anonym.legal's servers, so it needs a live connection this SCIF does not have.
Why Reversibility Matters
Classified work often needs reversible pseudonymization. Teams swap real names for codes. They keep the records useful. They protect real identities.
GDPR Article 4(5) defines pseudonymization as a formal privacy measure. It lowers risk. Pseudonymized records carry fewer legal duties — if the lookup token is stored apart from the dataset.
IAPP research (2024) found that only 23% of tools support true reversibility. Most do one-way masking or full replacement. Once a record is overwritten, it is gone.
Some government teams split their work by compartment. One team gets the pseudonymized files. They do the analysis. A second team holds the lookup token. They re-identify records only when the law requires it. This split design is the only safe approach for multi-team classified workflows.
The zero-knowledge model goes one step more. The lookup token is created on the client device. It is never sent out. If the vendor is subpoenaed, they cannot hand over the token. They never had it. This satisfies chain-of-custody rules in many classified environments.
EDPB Token Separation
EDPB Guidelines 05/2022 say the pseudonymization token must be held apart. It must not sit with the same party that holds the pseudonymized records. Or it must be locked behind controls that stop that party from reading both records and token at once.
Three things together meet this rule:
- Token created on the client device — never sent out
- All processing done locally — nothing leaves the air-gapped site
- Output and token exported separately — two separate files, two separate paths
This design meets the EDPB rule and the air-gap constraint at the same time — with anonym.plus as the tool that actually satisfies "all processing done locally" inside a true air gap.
For the full picture, our security overview shows how local processing cuts the third-party chain. Our compliance guide covers GDPR transfer rules. See our FAQ for setup help.
For sites with a controlled but not fully air-gapped connection — where a single trusted vendor link is acceptable — anonym.legal's Desktop App installs and runs locally too, but PII detection itself runs on anonym.legal's servers: the app ships no detection models and needs an internet connection. It supports Windows, macOS, and Linux. Its allowlist pins that connection to anonym.legal alone; no data goes anywhere else.
Updated for 2026
When This Approach Has Limits
Local, air-gapped processing satisfies the ITAR, FedRAMP, and EDPB constraints that rule out the cloud. But the air gap addresses where data is processed, not how well, and three limits apply.
Air-gapping controls custody, not detection accuracy. Keeping all processing on the local device removes the transfer and third-party-chain risk that disqualifies cloud SaaS in a SCIF. It does nothing for the residual false-negative rate of the detection engine itself. A missed identifier in a classified or export-controlled document is a serious failure regardless of how well the perimeter is sealed, so human review of output remains essential — arguably more so in high-stakes environments.
Bundled models go stale without a network. The advantage of needing no live connection at all — anonym.plus's case, not the Desktop App's — is also a constraint: detection models, recognizers, and identifier formats only improve when you deliberately update them, and in a true air gap that means a manual, controlled process. A deployment left unpatched for years runs against an aging model. Plan for periodic, offline model refreshes rather than treating install-once as maintain-never.
Reversible pseudonymization keeps the data in scope, and moves the secret. Article 4(5) reversible tokenization means the output is still personal data while the mapping exists, and in an air-gapped setting the key store becomes the asset that must be protected and access-controlled inside the same perimeter. Offline processing does not change the legal status of pseudonymized data or remove the key-custody burden — it relocates the crown jewel to the local environment.
Sources
- EDPB Guidelines 05/2022: Pseudonymization and token separation — VERIFIED-EXTERNAL
- IAPP 2024: Anonymization tool reversibility survey — FLAGGED
- LocalAI Master: Air-gapped AI for sensitive environments — VERIFIED-EXTERNAL