Anonymizing Footage in Air-Gapped Environments: On-Premise Deployment Without Telemetry

TL;DR: In an isolated environment, the question is not whether anonymization software runs locally but whether it runs silently: no phone home, no telemetry, no detection logs. Gallio PRO processes entirely on your own hardware and stores no detection logs and no personal data. This guide is for security architects, evidence unit leads and IT teams in policing, defence, energy and critical infrastructure.

What "air-gapped" means once procurement gets involved

Teams use the phrase loosely. Security architects do not. In a formal review, an air-gapped deployment means at least four things at once, and a product can satisfy three of them and still be rejected.

1. No outbound connections. Not for licensing, not for update checks, not for crash reporting, not for usage analytics.
2. Installable from offline media. No package manager pulling dependencies, no container registry, no installer that fetches components on first run.
3. Inference happens locally. The detection model runs on the machine in front of you, not behind an API.
4. Auditable local footprint. Someone can list every file the software writes and account for each one.

Most anonymization tools fail on the first or the third. A service that uploads footage for processing is disqualified before the conversation starts. The wider trade off is set out in our comparison of on-premise versus cloud anonymization.

Why isolated environments need anonymization at all

A common objection inside secure facilities is that isolation already protects the footage, so redaction is redundant. It is not, because footage rarely stays inside. It leaves as evidence disclosure, as a freedom of information response, as a court exhibit, as an incident briefing shared with a contractor, or as training material.

The moment it crosses the boundary, the obligations attach:

• Directive (EU) 2016/680, the Law Enforcement Directive, governs processing by competent authorities for criminal law purposes and requires appropriate security measures, with Member State implementations setting the detail.
• GDPR Article 5(1)(f) requires integrity and confidentiality, and Article 32(1) requires technical measures appropriate to the risk, which for identifiable footage leaving a facility means redaction rather than access control alone.
• Directive (EU) 2022/2555, known as NIS2, pushes essential and important entities in energy, transport, water and other sectors toward documented risk management measures and supply chain security, which is exactly the lens a security team applies to any new tool on an isolated network.
• GDPR Article 5(1)(e) requires storage limitation, which applies to the unredacted original as much as to the export.

Our guide on managing original data after anonymization covers the retention half of that obligation.

The five questions a security architect will ask

Put these to any vendor, in writing, before a pilot. The answers belong in the file, not in a sales call.

Question	Why it decides the review
Does the software make any outbound connection, including for licence validation?	A single phone home breaks the air gap and the deployment model.
What is the offline activation procedure?	Determines whether the licence can be installed and renewed without network access.
What files does the software write, and do any contain personal data?	Logs containing detections would create a new, unmanaged copy of personal data.
Where does the detection model execute?	Local inference is the difference between on-premise and a hosted service with a local front end.
How are updates delivered to an isolated node?	An unpatchable node is a finding in its own right.

What Gallio PRO provides for this scenario

Processing is fully local. Footage is read, detected and exported on your own machine or server, and it does not leave your infrastructure at any point. The software stores no detection logs and no personal data, which removes the most common objection in a secure environment: that the tool itself becomes a second, uncontrolled record of who appeared on camera.

Deployment options fit isolated architectures. There are desktop applications for Windows 10 and later, macOS 10.14 and later, and Linux with glibc 2.35 or newer, an MSI installer for managed estates, a Docker container for a shared internal processing node, and a Linux command line interface plus floating licensing on the Enterprise plan. A REST API is available where redaction has to be driven by an internal system rather than by an operator.

Two scope points belong in the design document rather than in a surprise later. Automatic detection covers faces and license plates only, so name badges, monitor screens, documents, tattoos and logos are redacted in the built in manual editor. And Gallio PRO processes recorded files, not live streams, so an isolated control room feed is not the use case. Law enforcement specific considerations are covered in how AI based anonymization helps law enforcement comply with data privacy regulations.

How to deploy anonymization on an isolated network, in six steps

1. Document the data flow before the tool. Map how footage enters the isolated zone, where it is processed, where the export goes and how the original is destroyed. If that diagram does not exist, no software choice will fix it.
2. Validate silence on a monitored test node. Install on a machine with full egress logging, process a sample, and confirm there are no outbound connections. Keep the capture as evidence for the security file.
3. Obtain offline installation media and the activation procedure in writing. Include renewal, because a licence that lapses in eighteen months with no way to reactivate is a planned outage.
4. Enumerate the local footprint. List what the software writes to disk, confirm nothing contains personal data, and place those paths under the same retention rules as the footage.
5. Define transfer hygiene in both directions. Removable media handling, checksums, scanning and chain of custody apply to the export leaving the zone as much as to the footage entering it.
6. Test on your own footage with the free Gallio PRO demo, then run a recall check. The demo is unlimited and watermarked at up to 720p, which is enough to measure missed detections before the environment is committed.

Three mistakes that undo the isolation

The temporary bridge. Someone connects the processing node to a general network for one afternoon to install a driver or pull an update. The exception becomes the configuration, and nobody documents it.

The convenience export. Redacted output is emailed from a workstation that also holds the unredacted source, and eventually the wrong file is attached. Keep the source and the export in separate, clearly labelled locations, and destroy the source on schedule.

The unmaintained node. An isolated machine that never receives updates is not secure, it is merely unreachable. Define how patches and software updates reach it, through controlled media, before it goes into service.

Where this leaves the decision

For organisations that cannot send footage anywhere, the shortlist is short by definition: software that runs locally, keeps no record of what it detected, installs without a network and can be audited on the machine. Gallio PRO is built for that pattern and is used by organisations including police services and large transport operators. You can scope a deployment from Gallio PRO video anonymization.

FAQ

Can video anonymization software run without an internet connection?

Yes. Gallio PRO processes entirely on local hardware, so footage never leaves your infrastructure. Confirm the offline licence activation procedure with the vendor in writing before deployment.

Does anonymization software keep a log of the faces it detects?

Gallio PRO stores no detection logs and no personal data. This matters in secure environments because a detection log would create a second copy of personal data outside your retention controls.

Is on-premise the same as air-gapped?

No. On-premise means the software runs on your hardware. Air-gapped additionally requires no outbound connections, offline installation, local model inference and an auditable local footprint.

Can Gallio PRO be deployed as a container on an internal server?

Yes. A Docker container, a Linux command line interface and floating licensing are available on the Enterprise plan, alongside desktop applications and an MSI installer for managed estates.

Does an isolated network remove the need to redact footage?

No. Obligations attach when footage leaves the facility as evidence, a disclosure response, a court exhibit or a briefing, and that is when redaction has to already have happened.