A port authority must keep election-night draft communications air-gapped from the public internet. Which hosting approach best supports that isolation requirement?

For election-night drafts that must remain air-gapped, run the generative model on isolated local infrastructure with no public internet path, so prompts and outputs cannot leave the secure enclave. The sensitivity of election materials makes hosting architecture essential: local inference without outbound connectivity preserves confidentiality that internet services cannot guarantee. Routing drafts through a multi-tenant public SaaS chatbot breaks air-gap assumptions and exposes content to a third party with independent retention and access controls. Mirroring drafts to a public paste site for “backup” creates copies outside election custody and is an explicit confidentiality failure. Using an unauthenticated internet demo endpoint for speed bypasses controls for convenience and is incompatible with air-gapped operations. Exam caveat: an air gap is a hosting and network-architecture requirement, not a prompt-engineering trick or a checkbox on a SaaS order form. Practical check: verify there are no default outbound routes from the inference host, load offline model weights ahead of election night, control removable media, log privileged access, rehearse procedures with the isolated stack, and obtain election-security stakeholder sign-off before approving generative assistance for live use.