Secure your air-gapped networks. Nothing ever leaves the site.
Trout Access Gate is an on-premise appliance that secures air-gapped and classified networks. It runs fully on site, with no cloud and no call-home.
Last updated:
Trusted by leading companies
Most security tools need the internet.
Most Zero Trust solutions assume persistent internet connectivity. Their control planes run in the cloud. Their policy engines pull configuration from SaaS portals. Their agents require update infrastructure that phones home on a schedule. In air-gapped environments, classified networks, and isolated OT segments, none of this works.
The result: organizations either deploy no Zero Trust at all, or they punch holes in the air gap to accommodate the security tool, defeating the purpose of the isolation.
Everything runs on site.
Every part of Access Gate runs inside your network. Nothing leaves it.
Managed from the appliance.
No cloud, no SaaS. You write and enforce policy on the appliance itself.
Addressing stays on site.
Access Gate uses an IP range inside your perimeter. DNS and routing stay local.
Updates without the internet.
Signed updates arrive by USB or internal share. The appliance checks them locally.
Logs stay on site.
Audit logs stay on the appliance. Export them to your own SIEM by syslog or file.
Two ways to deploy offline.
An appliance in a classified facility.
Rack it, connect it to a switch, power it on. Setup runs from a local web console. There is no activation server and no online license check. It works from first boot.
Access Gate Essential at a remote post.
The smaller appliance for labs, remote posts and small enclaves. Setup is the same and stays local. You manage it from the main site over the air-gapped LAN.
Audit-ready, without the cloud.
CMMC
A CUI enclave with a full audit trail. No CUI leaves the site. Evidence for your C3PAO comes from local logs and policy exports. Controls for OT machines are documented and enforced without the cloud.
NERC CIP
Machine inventory and access control for substations with no internet path. Every electronic access to BES Cyber Systems is tied to a person. Audit logs stay on site as evidence.
Common questions about air-gapped deployment.
External dependencies required to operate Access Gate in an air-gapped environment.
No. Activation is local. Operation is local. Updates are delivered offline. There is no license server, no cloud control plane, no telemetry.
Updates are packaged as signed images that can be transferred via USB drive, internal file share, or any air-gap-compatible media. The appliance verifies the signature locally before applying.
Yes. The management UI runs on the appliance itself. It is accessible only from the local network. There is no external portal, no cloud dashboard, no remote management path unless you create one.
Access Gate is deployed in restricted environments, including facilities that handle classified information. All data, policies and logs stay on site. The software is fully inspectable. With no cloud dependency, the security tool itself has no path to send data out.
An air-gapped network is isolated from the internet and other untrusted networks, common in defense, utilities, and classified environments. Air-gapping reduces exposure but does not remove internal risk from insiders, removable media, or vendor laptops. Access Gate runs fully on-premise with no cloud control plane, adding Zero Trust access, segmentation, and audit inside the air gap, so isolation and identity work together.
Deploy Access Gate without the internet.
See Access Gate running fully offline. No cloud, no SaaS, no connection needed.
Capability statement
Full technical specifications, deployment options, and compliance coverage for Access Gate.
Talk to an engineer
Discuss your air-gapped deployment requirements with someone who has done it before.