# What deployment models are available for data sovereignty?

**Short answer:** Two. A fully air-gapped on-premises model where nothing leaves your network, and a hosted or hybrid cloud-assisted model with JWE-encrypted TLS communications to regionally staged servers. Both provide the same sub-200-millisecond local prevention.

## Comparison

| | Sovereign On-Premises (Air-Gapped) | Hosted / Hybrid Cloud-Assisted |
|---|---|---|
| **Data transit boundary** | 100% contained within customer physically secured server racks | JWE-encrypted TLS communications to regional application servers |
| **Cross-border flow** | Zero external network flow; zero outbound telemetry | Geographically localized staging to match regional boundaries |
| **Regulatory alignment** | Supports strict national data residency and sovereignty requirements | Designed to align with global privacy directives (GDPR, PDPL, and others) |

## Choosing between them

The air-gapped model suits government, defense, critical infrastructure, and any organization under strict national residency mandates or operating disconnected environments.

The hybrid model suits organizations that want centralized management and cross-fleet reporting while still keeping data within a regional boundary.

**Prevention is identical in both.** The local Detect–Decide–Respond loop runs in the kernel on the endpoint regardless of deployment model — the difference is only where management and reporting infrastructure lives.