🔒
Air-gapped transcription:
SPIX AI on Physically Isolated Machines
Ultimate cybersecurity tolerates no software firewalls. Discover how SPIX deploys its neural networks for speech recognition and transcription on workstations without any network cards, ensuring the absolute security of your classified information.
What is an air-gapped environment?
An air-gapped environment (literally, “separated by an air gap”) refers to a radical IT security measure that involves physically isolating a computer or local network from any other network, particularly the Internet.
Unlike a computer protected by antivirus software, a firewall, or a VPN, an air-gapped machine has no physical or wireless connection to the outside world. The Wi-Fi card is removed or disabled at the BIOS level, the Ethernet port is disabled, and Bluetooth is not present. The only way to import or export data from this machine is physically (usually via an encrypted USB drive, governed by strict protocols known as “Sneakernet”).
Why Is a Firewall No Longer Enough?
Faced with state-sponsored advanced persistent threats (APTs) or malware capable of exploiting zero-day vulnerabilities to exfiltrate data, any device connected to the Internet presents an exploitable attack surface. Physical isolation (air gap) is the only mathematically guaranteed defense against the network-based exfiltration of classified data.
SPIX AI Box:
A technical architecture for offline workstations
Running state-of-the-art artificial intelligence (transcription, structuring, diarization) on an isolated machine requires specialized software engineering, designed from the very first line of code to operate without any external dependencies.
1. Installation via an encrypted container
The software is deployed via a standalone package. We provide an archive containing the binary executable, the complete runtime environment, and compressed neural network models (model weights in quantized format). This package is transferred to the air-gapped workstation via a secure removable storage device. No download is required.
The “Box” concept allows the entire processing chain to be configured in-house on a PC that will never again connect to the network after delivery.
2. Activation via Hardware ID (Without API)
Traditional software verifies its license by contacting a cloud server. SPIX AI uses the unique hardware fingerprint (Hardware-ID) of the installation machine. A digitally signed license file (.lic) unlocks the software on the offline machine.
Machine maintenance and updates are governed by the company’s IT department’s policies.
3. Local Tensor Processing (GPU)
Once the audio is fed into the system, transcription begins. The entire acoustic model for speech transcription is loaded into the graphics card’s video memory (VRAM). The motherboard performs inference (voice decoding) at very high speed. The diarization model runs simultaneously (or asynchronously) on the central processing unit (CPU) to identify speakers. The data flow is closed-loop.
This closed-loop processing also addresses a request from employees who do not want their voices to be potentially used or identified outside of their work context.
Post-Treatment Safety: The “Zero Trace” Protocol
The security of an information system doesn’t end with network segmentation. What happens if the physical hard drive of an air-gapped machine is stolen or seized?
During AI-powered transcription, the system segments the audio, generates spectrograms, and creates text matrices and error logs. By default, these temporary files remain buried in Windows’ hidden folders (AppData/Temp).
Data cleanup by SPIX AI
Native Encryption: If this option is enabled, the output text document can be instantly encrypted with a strong password even before it is saved to the hard drive or exported to a USB drive, which is itself encrypted.An air-gapped environment refers to a radical IT security measure that involves physically isolating a computer or local network from any other network, particularly the Internet.
Automatic cleanup: As soon as the final document (DOCX, PDF, and/or JSON) is successfully exported, SPIX AI triggers an algorithmic cleanup routine.
Memory Overwrite: Temporary audio files (segmented WAV files) and voice embeddings are destroyed. The allocated storage space is overwritten to prevent recovery by forensic software (digital investigation).
Unlike a computer protected by antivirus software, a firewall, or a VPN, an air-gapped machine has no physical or wireless connection to the outside world. The Wi-Fi card is removed or disabled at the BIOS level, the Ethernet port is disabled, and Bluetooth is not present. The only way to import or export data from this machine is physically (usually via an encrypted USB drive, governed by strict protocols known as “Sneakernet”).
Use Cases: Sectors Requiring Total Isolation
Find out why government agencies and strategic industries deploy our SPIX AI Box voice transcription and structuring solutions in air-gapped mode.
🪖
Defense Industry, Armed Forces
Transcripts of incident debriefings in overseas theaters of operations (OPEX) or staff meetings are classified as defense secrets. The use of cloud-based tools (even those hosted on domestic servers) is often prohibited for these classifications. The transcription AI embedded in isolated tactical units (SPIX AI Box) enables real-time processing of information without emitting any radio waves or exposing the device to a network.
⚖️
Critical Industries, Unions, and Works Councils
In critical industries such as pharmaceuticals, defense, the environment, or aerospace, meetings or on-site assessments involve multiple stakeholders: employees, decision-makers, unions, or the Social and Economic Committee (CSE). The requirements of sensitive operational procedures mandate that the transcription of these exchanges be performed in clean rooms (without internet access). SPIX AI automatically schedules and transcribes these interactions while ensuring the absolute integrity of the data chain and confidentiality.
☢️
Energy and Nuclear Industry
Critical Infrastructure Operators (CIOs) in the energy, aerospace, and defense sectors are subject to strict rules defined by Information Systems Security Policies (ISSPs). Transcripts of technical meetings concerning patents, power plant architectures, or chemical formulas may not leave the physical premises of the laboratory. Deploying AI on a fully isolated internal server protects national intellectual property.
SPIX AI Box:
Compliance and Lifecycle Management
Running state-of-the-art artificial intelligence (transcription, structuring, diarization) on an isolated machine requires specialized software engineering, designed from the very first line of code to operate without any external dependencies.
Compliance with ANSSI Guidelines
Although SPIX AI is commercial software, its siloed architecture has been designed to integrate seamlessly into environments subject to the recommendations of the French National Cybersecurity Agency (ANSSI) and standards regarding network isolation.
The absence of hidden telemetry and the 100% on-premises operation greatly facilitate the software’s approval by your own IT department during internal security audits.
Secure update protocol.
How to update a machine that does not have internet access?
1. Download via SAS workstation:
The update patch is retrieved from our secure portal on a connected machine (SAS workstation).
2. Hash verification (SHA-256):
The integrity of the packet is cryptographically validated to ensure it has not been altered (Supply Chain Attack).
3. Sneakernet Transfer:
The executable is injected via encrypted USB key onto the Air-Gapped transcription workstation to manually update the AI models.
Compliance and Lifecycle Management
Can Bluetooth be used for voice dictation on an air-gapped device?
In a strict security environment (Classified Information), the use of wireless protocols such as Bluetooth is prohibited due to the risk of interception (sniffing) and inherent protocol vulnerabilities. We recommend physically disabling Bluetooth and using only wired microphones (USB or jack) or encrypted voice recorders and recorders to transfer audio files.
How can you ensure that the software does not contain any malicious code?
SPIX AI is software designed in France. Unlike “black box” cloud solutions, our on-premises architecture can undergo dynamic and static testing (penetration tests) by your information security team prior to deployment. Furthermore, since the target machine is physically disconnected from the network, the silent exfiltration of data to a command-and-control (C&C) server is physically impossible.
What hardware configuration is required for the isolated workstation?
The offline machine must have all the computing power required for AI built right in. It requires a stable power supply, a robust processor, 32 GB of RAM, and, most importantly, a dedicated graphics card (GPU) with at least 12 GB of VRAM (ideally an NVIDIA RTX 4070 or higher) to process high-speed offline transcription.
Can the software transcribe encrypted audio files?
The software does not process encrypted containers directly. In a highly secure workflow, the audio file must be decrypted locally on the air-gapped machine using your utility (e.g., VeraCrypt), and then the unencrypted file (.wav, .mp3) is submitted to SPIX AI. Once the transcription is complete, the unencrypted audio and the transcription are re-encrypted, and the “Zero Trace” protocol deletes any remaining traces.
With the SPIX AI Box,
provide your field operators with
the same LLM capabilities
as your office staff.
This is the revolution SPIX Industry is bringing: democratizing the use of advanced AI capabilities, saving experts time in the field, and enhancing the traceability of industrial operations—all without compromising data privacy or the quality of results.