Runs where your data lives — air-gapped if you need it.
Some environments must be isolated: dedicated infrastructure, no third-country access, sometimes no network at all. Blueprint is a thin, open-source runtime with no phone-home — deploy it inside those enclaves and own it end to end.
The honest version: self-host and air-gap are deployment properties that enable such mandates — no regulation says “you must self-host,” and Blueprint isn’t FedRAMP/DoD-authorized (a library can’t be).
No law says “self-host.” Plenty of environments require isolation.
Self-host is the enabler — a runtime that makes zero external calls can live where hosted tools simply can’t.
- NIST SP 800-53 SC-7 (boundary protection) and AC-4 (information-flow enforcement) define the isolation controls used to build isolated and classified enclaves.
- DoD Cloud Computing SRG impact levels require increasingly dedicated infrastructure — IL5 dedicated, IL6 classified (SIPRNet).
- Data-sovereignty and national-security regimes can require the data — and the systems processing it — to stay in-country on dedicated infrastructure.
- A self-hosted open-source runtime has no vendor dependency to operate, and can run fully offline.
Why a hosted or gated tool can’t come inside.
A hosted or phone-home UI can’t enter an air-gapped or classified network at all — the outbound dependency is a non-starter.
“Self-host” that’s a heavy platform to babysit just moves the burden; regulated teams need control without a second ops job.
Closed-source or gated on-prem means you can’t fully inspect or own what runs in your most sensitive environment.
A runtime with nothing to phone home, point by point.
What a security architect sees: no calls leaving the enclave.
Even the change above swaps a remote asset for a local one — nothing the runtime needs is off-network.
{ "type": "screen", "id": "ops-dashboard", "nodes": [ { "type": "chart", "src": "https://cdn…" } { "type": "chart", "src": "local" } ] }
External calls at runtime
Deployment
- Air-gap supported
- Vendor dependency none
- Source open (AGPL)
The honest part
Self-host and air-gap are deployment properties that enable mandates like data sovereignty and isolated or classified networks — they aren’t themselves a regulation, and no standard says “you must self-host.” Blueprint is not FedRAMP- or DoD-authorized; a UI library can’t hold such an authorization. It can be deployed into environments that carry those requirements — the authorization applies to the overall system and its operator.
The questions your security team will ask.
Is Blueprint FedRAMP / DoD authorized?
No — a library isn’t authorized on its own; those authorizations apply to a whole system and its operator. Blueprint can be deployed inside such an accredited environment because it makes no external calls.
Can it run fully offline / air-gapped?
Yes. The runtime has no phone-home — it runs with no network access at all, inside your own enclave.
Is “self-host” itself a compliance requirement?
No. It’s a deployment property that enables requirements like data sovereignty and network isolation (NIST 800-53 SC-7/AC-4, DoD IL5/IL6). We frame it as an enabler, not a mandate.
How heavy is the runtime to operate?
It’s a thin library, not a platform — no ops treadmill to run it in your own environment.
Verify it yourself.
The isolation and impact-level references this page relies on.
- IsolationNIST SP 800-53 Rev 5 — SC-7 boundary protection and AC-4 information-flow enforcement (the controls behind isolated/air-gapped enclaves).
- SC-7 textNIST 800-53 — SC-7, Boundary Protection — managed interfaces and physically/logically separate subnetworks.
- DoD impact levelsDoD Cloud Computing SRG (DISA) — IL5 dedicated infrastructure; IL6 classified (up to SECRET) on isolated networks.