Three shapes
Your cloud
A VPC you own. The usual choice, and the one with the fewest trade-offs.
Your data centre
On-premise, including inside an OT boundary.
Airgapped
No egress at all. The deployment refuses to start if a setting selects a
service outside your network.
What airgapping costs, stated rather than hidden
A disconnected deployment gives up one evidence property: external anchoring. Sealing, sequencing and inclusion proofs all still work, so tampering remains detectable. What you lose is the independent attestation that a record existed by a certain time, because that requires publishing a root somewhere you do not control. The deployment tells you this at start-up rather than letting you discover it in an audit. A platform that quietly degrades a guarantee is worse than one that cannot offer it.No outbound surprises
The platform calls no LLM anywhere. Not for summaries, not for classification. A test fails the build if a model provider appears in the dependency graph, and a second test fails the build if any module opens a network connection without appearing in the egress inventory. That inventory is enumerable and probed rather than described, which is the difference between a claim and a control.This section is about a deployment. rotascale.com itself runs Google
Analytics and says so. The two are separate,
and conflating them would be the kind of thing this platform exists to catch.