ERA Sovereign HybridData at home — support like the cloud

A modern operating model without losing sovereignty: the platform, data lake, AI, and investigation materials remain in your perimeter, while protection updates, licenses, and support telemetry are delivered from the ERA cloud over an outbound channel. The answer to "we need on-prem, but without the cloud we fall behind in operations."

How it works

Hybrid mode is enabled deliberately and configured by policy. Fully isolated mode (air-gap) remains available with no outbound connections whatsoever.

What stays in the perimeter, what goes outbound

Always in your perimeter	Outbound (only per your policy)
Raw events and telemetry	Licenses and subscription renewal
Data lake (ClickHouse / MinIO)	Rule, CVE, AI pack updates
AI inference (LLM in perimeter)	Certificate revocation list (CRL)
Cases, investigations, personal data	Support telemetry (by tier)
Never leave the perimeter	De-identified indicators — only if you allow

Solution components

Component	Location	Purpose
ERA Cloud Portal	ERA cloud	Licenses and contracts, subscription renewal, revocation list, health status ingestion
ERA Update Service	ERA cloud	Delivery of signed content: rules, CVE, connectors, AI packs (also works via offline package)
ERA Hybrid Relay	Your perimeter	Single outbound channel with logging and allowlist
ERA Managed View	ERA cloud	Your integrator / MSSP dashboard: health, licenses, versions — without access to your data

Two deployment profiles

Criteria	ERA Sovereign (air-gap)	ERA Sovereign Hybrid
Data / data lake / AI / cases	In perimeter	In perimeter
Protection updates	Offline package	Automatic from ERA cloud
Outbound connectivity	None	Outbound only, per policy
Best for	Public sector, critical infrastructure, strict air-gap	Banking, large enterprise: sovereignty + convenient operations

For security and procurement