On-prem and air-gapped

kymeer installs inside your own environment, on RKE2 Kubernetes with Cilium or on a single node. Its licence is verified offline, so it can run on a network with no internet path.

Which platforms can I install on?

• Kubernetes: RKE2 with Cilium networking.
• Single node: for pilots and lab-scale installs.

What hardware does a pilot need?

A pilot needs at least 4 CPU cores, 8 GB RAM and 40 GB of SSD disk. Production sizing depends on your daily ingest volume in GB/day; plan it with your partner.

How does licensing work?

Licences are Ed25519-signed. The product carries only kymeer's public key, so it checks a licence offline, with no network call. A licence states:

• the edition
• the daily ingest allowance, in GB/day
• an optional storage cap and retention period
• the number of seats
• the validity window: a start date and, for a subscription, an end date
• feature flags

A new licence can be applied without a redeploy.

What happens when I reach a licence limit?

• Daily ingest above the allowance: ingest continues for a burst of up to 10% over, with an operator alert. Beyond that, the platform refuses new data and agents and collectors keep it in their on-disk spool and retry. Nothing is dropped silently.
• Storage cap reached: new writes stop until retention frees space or the licence is expanded.
• Licence expired: existing data stays searchable; ingestion resumes when you apply a renewed licence.

Can AI run inside my network?

Yes. Point kymeer at a local OpenAI-compatible model server such as Ollama, vLLM or llama.cpp. kymeer sends requests only to the address you configure, and calls to a loopback or private address are recorded as zero-egress. You can also leave outbound AI traffic closed, which is the default. See AI analyst.

How do I verify a release package?

Every release comes with a manifest signed with Ed25519 that lists the SHA-256 checksum of each archive. The install scripts check the signature and then the checksum before writing anything to disk. For an air-gapped install, copy the manifest, its signature and the archive across, verify the signature, then compare the checksum:

sha256sum <archive>.tar.gz

The result must match the value in the signed manifest. Do not install an archive whose checksum does not match.