Banks, insurers, defence suppliers and public bodies often run their most sensitive analytics on networks with no route to the internet at all. Most modern BI tools assume the opposite — a vendor cloud for licensing, updates, sharing and now AI. This guide sets out what air-gapped business intelligence actually requires, where the big platforms make it hard, and how ATX AnalyticsTable is built for it. A note on fairness: ATX Institute makes ATX AnalyticsTable. Prices and features of other vendors change over time, so always check the current details on each vendor's official website.
An air-gapped environment has no network path to the public internet. Software is brought in through a controlled transfer, runs entirely inside the network, and never calls home. For a BI tool that rules out anything that needs an online activation, a cloud tenant, a hosted sharing service or a public AI endpoint to work.
On-premise and air-gapped are not the same thing. Plenty of on-premise software still phones home for licence checks, telemetry or updates, and simply stops working — or quietly loses features — when it cannot.
Power BI and Tableau are both capable tools, and both offer a self-managed server: Power BI Report Server and Tableau Server. Their newest capabilities, however, tend to arrive in the vendor's cloud service first, and AI features are built around the vendor's hosted models. A bank that cannot use the cloud ends up on the edition that moves slowest.
If you are comparing them in detail, our Power BI and Tableau comparisons set out the differences feature by feature, including where those platforms remain the better choice.
Before a BI tool goes into a network with no internet route, it should pass these tests:
ATX AnalyticsTable installs on Windows or a Linux server, with silent installers, a Docker image and a Helm chart. A licence is a signed file verified against a public key compiled into the build, so an air-gapped installation validates its own licence with no network at all.
Group Policy and Intune templates — or a policy file on Linux — turn off AI, e-mail, cloud storage, Git integration, the update check or individual connector types. Releases are signed and ship with SBOMs and provenance. The audit trail is hash-chained and append-only, and can be forwarded to a SIEM over syslog with TLS.
Ask Greg, the AI analyst, and the AI_PROMPT formula use whichever model endpoint the administrator configures, including a self-hosted one. Managed endpoints ship with the installer and cannot be repointed from inside the app, and an egress policy decides how much of the data each model may ever see.
Dynamic data masking usually means hiding values at query time depending on who is looking. ATX AnalyticsTable takes a stricter route: masking runs as a pipeline step on every refresh, so the dashboards, PDF reports and scheduled e-mails built on that table only ever contain masked values — there is no unmasked copy for a viewer to be shown by mistake.
Four methods are available: redact, partial, hash and synthetic. Hash masking is keyed per project, so the same customer becomes the same token in every table and joins still work. Masking reduces GDPR risk; on its own it does not make data anonymous.
BI software that runs on a network with no route to the internet: licensing, data sources, reporting and any AI all work inside that network, and the software never needs to call its vendor.
Yes, if the tool can call a model you host. In ATX AnalyticsTable the administrator configures the model endpoint and an egress policy; Ask Greg and the AI_PROMPT formula then use that endpoint, with data masked before it is sent.
For SQL-based reporting, data pipelines, dashboards and scheduled PDF reports that must stay inside the bank's network, yes. For large-scale self-service visual exploration Tableau and Power BI remain strong, and many teams run both.
This site needs JavaScript for the full experience. Every page above is reachable without it.