People analytics that never leaves your perimeter: what air-gap actually means
Author
Gabriel Croitoru
Date Published
"Your data stays with you" is a sentence every vendor can write. The difference is whether it is an architecture or a promise. For the most sensitive dataset in the company — who works here, what they earn, who is about to leave — the distinction matters more than any feature list.
What air-gap means in practice
- No mandatory outbound connections — no CDN fonts, no telemetry, no "phone home" licensing checks. The platform runs in a room without internet.
- Single exposed port — the rest of the components never appear on the network; connectors reach out to your sources, nothing reaches in.
- Read-only connectors — the platform reads from HRIS, payroll and files; it never writes back into operational systems.
- Verifiable residency — you can inspect the container set, the egress rules and the audit log yourself; residency is demonstrated, not asserted.
Why it matters for people data specifically
HR data concentrates every regulated attribute: identity, salary, health-adjacent absence signals, performance. A breach or an opaque subprocessor chain is not an IT incident — it is a works-council and DPA problem. Air-gap removes the entire class of "where did the data go" questions before legal asks them.
What it does not mean
Air-gap is not "no cloud features forever" — updates ship as versioned, auditable bundles you apply deliberately. It is also not a substitute for governance inside the perimeter: role scopes, suppression of small cohorts and pseudonymized identifiers still decide who sees what once the data is inside.
Workforce Observatory was designed this way from the first commit — the same build runs on an evaluation VM or in an offline room. See the security model or install it on your own infrastructure for a pilot.
A four-level people analytics maturity model (L1–L4) — how to score yourself honestly, and why buying above your level is the most expensive mistake.
HRIS says 1,240, payroll says 1,248 — why HR numbers diverge and how a canonical data model, identity resolution and metric lineage create one source of truth.
A people analytics readiness assessment should cover expectations, source inventory, maturity, mapping complexity and current capability — and produce a report that stands alone.
A sustainable people analytics roadmap defines the target state first, then prices two tracks — with a governed platform and without — so every phase defends itself.
The honest boundary list of a people analytics platform: no HRIS replacement, no arbitrary code, no invented numbers, no compliance-as-checkbox — and why it matters.
Automating the executive board pack: governed metrics computed once, assembled on a cadence, exportable to PDF/PPTX — with the analyst focused on the narrative.