Air-gapped is not a mode.
It's the baseline.
NeuroPing was built for NERC-CIP-audited environments where "does it need internet?" ends conversations. It doesn't. There is no cloud backend and no SaaS component — the app is fully functional on a box with no route to the outside world, reading your estate and nothing else.
NeuroPing evidence stored locally What never happens
No configuration changes
The app authenticates with read-scoped API access and contains no code path that writes to a firewall. Monitoring cannot become mutation.
No agents on the firewalls
Nothing is installed on your firewalls or process equipment. NeuroPing reads the API and logs your firewalls already produce.
No telemetry, no phoning home
No usage analytics, no crash uploads, no update pings. What happens on the box stays on the box — verifiable at your own perimeter.
No cloud dependency
There is no SaaS half of this product. Every feature — monitoring, discovery, compliance scanning, evidence packs — runs entirely on-prem.
Offline, signed,
and it never bricks.
Licenses are cryptographically signed files verified locally — no activation server, no license phone-home. Pilots start with a 30-day trial. If a license lapses, the app degrades to read-only viewing of already-collected data. It never locks you out of your own evidence.
The assistant obeys
your boundary.
The AI assistant answers from locally collected evidence. Where it reasons is your deployment decision, made explicit in settings — and "off" is a first-class choice.
The questions your security
review will ask anyway
What exactly can the firewall API account do?
Whatever you scope it to — we recommend a read-only admin role. NeuroPing issues read operations (config, operational state, counters, logs) and contains no code path that writes configuration or commits. If the account can't write, the tool can't either, and it never asks to.
Does it really work with zero internet access?
Yes. Install, licensing, monitoring, discovery, compliance scanning, reports, and evidence packs all run without any outbound connectivity. The AI assistant runs in local mode against models inside your perimeter, or you disable it and lose nothing else.
What leaves the box in "cloud — redacted" AI mode?
Only the sanitized question: IPs, hostnames, and identifiers are stripped before any prompt leaves the machine, over TLS, using your API keys. If that's still too much, local mode and disabled mode exist precisely for you.
What happens when the license expires?
The app degrades to read-only viewing of already-collected data. It never bricks, never deletes evidence, and never needs to phone anywhere to be re-licensed — a new signed license file restores full function.
How do updates work on an air-gapped network?
The same way the installer arrived: a file you carry across your own transfer process. The app checks nothing automatically and notifies only from information it already has. No auto-update, no background downloads.
Where are firewall credentials stored?
In the operating system keyring (Windows Credential Manager), or injected as service secrets for daemon deployments. Never in config files, never in logs, redacted from every export.
Which firewalls does it work with?
NeuroPing reads from firewall APIs and logs rather than any single vendor's tooling, so the estate view, tunnel health, HA readiness, and OT discovery are vendor-neutral by design. Centrally-managed fleets are supported, including multi-site scoping — group by site, region, or customer for MSPs. Bring your estate to a pilot and we'll confirm coverage for your exact platforms and versions.
Can we review the architecture with our compliance team?
Please do. Pilot participants get the full architecture walkthrough, the audit-event schema, and straight answers about what's built versus what's roadmap. Start with the one-pager below.
A note on honesty: NeuroPing is pre-release software in a design-partner pilot program. We don't print compliance badges we haven't earned or uptime numbers we can't prove. What we do offer: the architecture above, and direct answers from the people who built it.