Cloud, self-hosted, or air-gapped — you choose the boundary.
Extant 2000 runs three ways. Commercial programs use our SOC 2 cloud. Defense primes host it themselves. Classified programs deploy inside an IL4 / IL5 / IL6 enclave with zero outbound connectivity. Same product, same features, different deployment envelope.
Side-by-side comparison
| Capability | SaaS | Self-hosted | Air-gap |
|---|---|---|---|
| Deployment time | 10 min | 1-2 days | 1-2 weeks (DAA package + cert) |
| Infrastructure owner | Extant | You | You |
| Data sovereignty | AWS us-east-1 | Your choice | Your choice (inside enclave) |
| Software updates | Continuous | Quarterly signed bundles | Manual via courier / OTP package |
| SSO & IdP | Google / Microsoft / SAML | Any SAML / OIDC / CAC | Any (incl. CAC / PIV) |
| Outbound network required | Yes | Yes (for updates) | None |
| CUI / CMMC Level 2 | Pending SOC 2 | Supported | Supported |
| Classified (Secret, TS/SCI) | — | — | Supported |
| FedRAMP | Moderate (Q4 2026 target) | Inherit customer's ATO | Inherit customer's ATO |
| Price floor | $29/seat/mo | $499/seat/mo | Custom site license |
| Typical customer | NewSpace startups · university programs | Aerospace primes · subs | Defense programs · classified labs |
Frequently asked questions
Can we pilot SaaS and then migrate to self-hosted?
Yes. The data model and APIs are identical. We provide a tenant-export tool that produces a signed archive (ReqIF / CSV / SysML XMI + document blobs + schema migrations). Import into your self-hosted instance with one command.
What does "no outbound connectivity" mean in practice?
Air-gap Extant has no license server, no telemetry endpoint, no analytics SDK, no CDN fallback, no feature-flag service, no software-update daemon. All assets ship inside the Docker images. Startup requires zero network calls beyond your enclave DNS. You can verify this with egress monitoring.
How do air-gap customers receive updates?
Two options. (1) We publish a quarterly signed release bundle to a customer-designated secure file drop (typically SIPR DVIDS or an OPTIC-enabled AWS GovCloud bucket). You validate the signature with our public key and load it through your approved transfer process. (2) Physical media: signed USB or DVD shipped via US courier with SF-312-cleared personnel.
Which STIG baseline do you ship?
Ubuntu 22.04 STIG (V2R1+) and RHEL 9 STIG (V1R6+) base images. We deliver the SCAP XML benchmark output pre-run against our images so your ISSO can review before deployment. We do not certify your ATO — we provide the inherited controls and POA&M template; the AO of your system still issues the ATO.
Do you support cross-domain solutions?
Not natively. If your program requires CDS (e.g., ingest at Unclass, operate at Secret), we can partner with approved CDS vendors (Forcepoint, Owl) to provide the guard. The Extant install on each side is standard; the CDS handles the one-way transfer.
Does the Aerospace pack work in an air-gap install?
Yes, including all 100+ calculators, orbit propagator, cislunar design studio, and AI trajectory optimizer. The one caveat: AI features that rely on external LLMs (AI Advisor, AI Requirements Generator) require either a local LLM gateway (we support Ollama and vLLM) or disabling those features. All deterministic calculators and the SysML modeler work fully offline.
What about Defense / MedDevice / Energy packs in air-gap mode?
Defense pack is available in beta today for self-hosted and air-gap deployments. MedDevice and Energy packs are design-partner access only — see the roadmap. Self-hosted customers always get every pack their license covers, regardless of cloud availability.
Not sure which deployment fits?
Talk to us for 30 minutes. We'll walk through your classification, your IL level, your IdP, and your CDS requirements — and tell you honestly whether Extant is a fit this quarter or next.
Schedule a briefing →