Observability for networks
that can't reach the internet.
Defense, critical infrastructure, government, factory floors, regulated finance: some networks are disconnected on purpose. Ultraviolet runs entirely inside them — not a reduced version, the whole product.
The problem
Almost every modern observability product assumes a connection. SaaS tools need your telemetry in their cloud. "Bring your own cloud" options keep the data in your account but still depend on a control plane the vendor runs. Either way, a disconnected network is left with older tools, or with assembling and maintaining an open-source stack of several systems itself.
Ultraviolet is built offline-first. The core has no dependency on the internet: it installs, runs, licenses and investigates incidents with no outbound connection at all. Air-gapped is a supported way to run it, not a degraded fallback.
What works with no connection
Install and upgrade
Mirror the signed images and Helm chart to your own registry, verify them, and install. Upgrades are the same: mirror the new release, verify, upgrade.
Every feature
Services, traces, logs, metrics, infrastructure, profiling, alerts, SLOs, dashboards, synthetic checks and cost views all run inside the network. Nothing is a cloud add-on.
Licensing
Your license is a signed file you install and refresh yourself. The core never phones home, and it never stops collecting data over a license.
AI investigation
Point it at a model you host, such as one served with vLLM or Ollama — or use none: investigations gather the evidence and write their findings without a model.
Remote and disconnected sites
Each site connects outbound to the core and buffers to disk while the link is down, then sends what it held when it returns.
Proving what you run
Every image and chart is signed, with an SBOM and build provenance attached — all verifiable offline with one public key.
How an air-gapped install goes
- Bring the release across. Pull the signed images and Helm chart for the version you want, and move them into your registry.
- Verify it. Check every image and the chart against our public key with cosign — offline — and review the attached SBOMs.
- Install. Point the chart at your registry and install the core; add the collector to the nodes you want to see.
- License. Install the signed license file. Renew it the same way when the time comes.
Services, requests and connections appear as soon as the collectors start — there's no code to change in the applications you monitor. The installation guide has the commands.
Questions teams ask
- Does anything ever leave the network?
- Not in air-gapped mode. Connected mode — optional, for automatic license renewal — sends license usage metadata only (license, customer, node counts), never telemetry. Air-gapped installs leave it off.
- What happens if our license expires while we are disconnected?
- Nothing stops collecting. As a license nears expiry it enters a grace period with a banner, well before anything stops; even with no license, data keeps coming in and only the UI is locked until a new license file is installed. Node counts are metered and shown, never enforced.
- How do we verify the software before it goes in?
- With cosign and our public key, entirely offline: signatures are key-based and stored next to the artifact in your registry, so there is no transparency log or certificate authority to reach. The same key verifies each image's SBOM and build provenance.
- Is there a single offline bundle?
- Not yet — today you mirror the images and the chart from our registry into yours, with any registry-mirroring tool. A single signed bundle for transfer is planned.
- What do we need to run it?
- A Kubernetes cluster for the core, sized by your traffic — the sizing guide in the docs has measured figures — and the per-node collector on the nodes you monitor.
Licensing for disconnected sites
Air-gapped licenses are arranged directly with us, with support suited to sites we can't reach. Talk to us about yours — or explore the live demo first to see the whole product on a real cluster.
Run it in your own cluster this week.
A 30-minute call, then an evaluation core on your infrastructure. You will see your own services, traces and logs — from your own traffic — before you decide anything.
- No data leaves your environment, including during the trial
- Helm install, works fully air-gapped
- You talk to the engineers who built it