Three facts for the review
By Omer Khan, Zimmer AI (Fihi Labs UG) · Published May 3, 2026 · Updated September 1, 2026
Physical separation: NIST defines an air gap as an interface with no physical connection and no automated logical connection. Transfer is manual and under human control.
The whole dependency chain: The model, inference runtime, retrieval index, identity path, licence check and audit record must all work without a public-network dependency.
A process, not a switch: Every model, application update and security patch needs an approved intake, verification, transfer and rollback procedure owned by the customer.
The NIST air-gap definition is the useful review standard because it distinguishes disconnection from strict firewall policy. A server with outbound access through a proxy may be tightly controlled, but it is not physically air-gapped. Zimmer AI uses open-weight models on hardware the customer owns: Zimmer Desktop is the personal workspace for one Mac or Windows PC, while Zimmer Server is the multi-user appliance for a private network on company-owned Apple-silicon hardware.
Private-network mode: Zimmer Server opens no inbound port, needs no public IP and joins an end-to-end encrypted WireGuard-class mesh through an outbound connection.
Air-gapped mode: A physically disconnected environment cannot use that remote mesh path to reach employees outside the isolated network.
Choose by threat model: Remote access and physical isolation solve different problems. A reviewer should record which property the deployment actually requires.
Zimmer AI deployment options differ mainly in connectivity, licensing and who can reach the system. None of these labels is a compliance certificate; the customer remains responsible for system hardening, physical controls, operating procedures and legal review.
| Question | Desktop | Server private network | Air-gapped Enterprise |
|---|---|---|---|
| Who is it for? | One person on one Mac or Windows PC. | A team sharing one governed private network. | A team inside a physically isolated environment. |
| Does inference need internet? | No, once a model is downloaded. | No; inference and retrieval run on the server. | No; local inference is the operating requirement. |
| How is licensing checked? | Personal use is free forever. | A heartbeat runs roughly every seven days with a 14-day grace period. | A signed offline licence is verified locally with zero licensing calls. |
| Can remote staff connect? | Not a multi-user server. | Yes, through the encrypted mesh with zero inbound ports. | Only through access permitted inside the isolated environment. |
| Where do updates come from? | The connected user downloads them normally. | The connected administrator manages updates normally. | The customer must define a controlled transfer process; Zimmer does not claim automatic offline updates. |
Signed licence file: Zimmer Enterprise supports an offline signed licence file that the server verifies locally.
No heartbeat: Offline mode makes zero outbound licensing calls. Team and pilot heartbeat behavior is a separate connected deployment mode.
No data hostage: Connected licensing has a 14-day grace period and then degrades to read-only instead of locking customers out of their data.
No silent refresh: An isolated server cannot browse a model hub, pull an application update or fetch a security patch from the internet.
Customer-owned intake: The reviewer should define approved media, malware scanning, hashes or signatures, change approval and a tested rollback path.
State the product boundary: Zimmer verifies the offline licence locally. It does not currently claim a complete signed offline software-and-model update-bundle workflow.
Download the approved model or update on a connected staging system.
Record provenance, version, hash or signature, scan result and approver.
Move the exact artefact through the organisation’s approved manual boundary.
Keep the prior version and prove rollback before production use.
Inference and retrieval: Open-weight model inference, document indexing and document Q&A run on the customer-owned server rather than a hosted model API.
Local evidence: Clickable citations open the exact PDF page or Word or Markdown section used for an answer. Missing source material is reported instead of invented.
Backup and restore: A backup includes configuration, users, devices, permissions, document index, sync tokens and licence, with an integrity manifest checked before restore.
Hard filter in search: A user's groups constrain vector retrieval before any passage is placed in the model context.
Immediate changes: Collection grants and revocations take effect on the next question without a restart.
Reviewable events: Permission changes and denied retrieval attempts are written to the access log.
Single-use payload: An administrator issues an enrolment payload valid for 60 minutes; the employee pastes it once.
Device-held key: The device creates a keypair, seals the private key in the Mac Keychain and signs later requests.
Next-request revocation: Revoking a lost or retired device denies its next request. Browser users receive a one-time sign-in code.
A security review should end with artefacts, not assurances. Ask for a data-flow diagram, the list of required network destinations by deployment mode, the exact licensing payload, retrieval-denial logs, device-revocation evidence, backup integrity results, model provenance, and the organisation’s update-transfer procedure.
Capture zero-inbound-port behavior separately from any claim of physical disconnection.
Compare the public six-field heartbeat disclosure with a packet capture, or verify zero calls in offline mode.
Ask an unauthorized account for restricted content, then inspect both the answer and the denied-retrieval log.
Restore a representative backup and verify the integrity manifest before expanding the pilot.
Use the licensing payload disclosure as one test artefact, review the Zimmer Server operating model, and confirm the free three-seat pilot before committing to a larger deployment.
No certification shortcut: Zimmer AI does not claim HIPAA, ISO 27001 or SOC 2 certification. Local deployment does not make a customer compliant by itself.
No invisible update promise: A physical air gap trades automatic patches and model downloads for a human-controlled intake process. The organisation must own that process.
No universal hardware story: Zimmer Server currently requires Apple-silicon Mac hardware. Linux GPU nodes and native Windows server hosting are roadmap items, not shipped capabilities.
No frontier-model parity: A hosted frontier model can outperform a model that fits on local hardware. Air-gapped deployment prioritises boundary control and continuity over peak capability.
A true air-gapped AI deployment has no physical network connection and no automated logical connection to a less trusted network. Models, documents, application updates and security patches enter only through a manual, human-controlled process. Local inference alone is not enough if licensing, embeddings, identity or telemetry still requires an external service.
No. Zero inbound ports means the Zimmer Server exposes no listening service, public IP or port-forwarding rule while using an outbound encrypted mesh for remote access. That materially reduces exposure, but the system remains network-connected. A physical air gap removes that connection and therefore changes how users, models and updates reach the server.
Zimmer Enterprise can verify a signed offline licence file locally and make zero outbound licensing calls. The ordinary Team and three-seat pilot path instead checks entitlement roughly every seven days, caches a signed token with a 14-day grace period, and falls back to read-only rather than withholding customer data after the grace period.
Test the actual boundary: capture network traffic, revoke a device and retry, ask an unauthorized user for restricted documents, inspect denied-retrieval logs, open citations to their source pages, and restore a representative backup. For a physical air gap, also document model and patch provenance, transfer approval, integrity verification and rollback.
Start the free three-seat Zimmer Server pilot from the pricing page and run the evidence checks above on one real document collection. Zimmer Server hosting currently requires an Apple-silicon Mac; a Mac Studio is recommended and a Mac mini is supported for small teams.
Start the free three-seat pilotEnterprise-shaped deployment? The secondary option is a technical review call.
Book a technical review