Security & Deployment

The entire stack runs
where your data lives

Everything ships as Docker containers on your infrastructure or private cloud — the application, the databases, and the AI model itself. No prompts, no readings, nothing leaves the network.

Architecture

Inside the box. Literally.

One server, one Docker Compose file, the whole platform.

Your network / OT environment air-gap ready
Your server — from 32 GB RAM, GPU optional (auto-detected)
Nerqon Appdashboards · API
Local LLM14B params · offline
Vector Searchlocal semantic index
Databasestime-series · config
MinIO Storagereports · exports
Connectors25+ sources
Alert Enginescheduled rules
Forecast EngineProphet · XGBoost
Reads from your databases, meters, PLCs and historians — inside your network
No cloud APIs, no external AI calls, no telemetry, no data egress
Security Controls

Enterprise controls, without the cloud

Security your IT/OT team can verify — because it all runs where they can see it.

AES-256 Credential Encryption

Stored connection credentials are encrypted with AES-256 (Fernet). Secrets live on your server, protected at rest.

JWT Auth & Role-Based Access

Token-based authentication with role-based permissions — operators, analysts and admins each see exactly what they should.

LDAP / Active Directory

Your users log in with the directory you already run. No separate identity silo to manage.

Audit Logs

Who connected what, who asked what, who exported what — a trail your compliance team can actually query.

Row-Level Security

Fine-grained, row-level permissions in the database — multi-site teams see their site, not everyone else’s.

Read-Only SQL Guard

The AI chatbot can query your data but can never modify it — a hard guard enforces read-only SQL, always.

Deployment

One command.
Fifteen minutes.

Nerqon deploys with a single Docker Compose command — from bare server to running product in under 15 minutes, on hardware you probably already have.

  • Modest requirements: runs from a single 32 GB server. GPU optional — auto-detected for faster AI answers when present.
  • On-premise or private cloud: your data center, your VPC — wherever your policies allow.
  • Fully air-gapped operation: no internet required at runtime — updates arrive as versioned bundles you apply on your schedule.
  • No per-token AI fees: the local model answers unlimited questions for the price of your own electricity.
terminal — your-server
admin@plant-srv01:~$ docker compose up -d
[+] Running 8/8
 ✓ nerqon-app Started
 ✓ nerqon-llm Started # local AI, no cloud
 ✓ nerqon-vector Started
 ✓ nerqon-db Started
 ✓ nerqon-minio Started
 ✓ nerqon-alerts Started
 ✓ nerqon-forecast Started
 ✓ nerqon-proxy Started
admin@plant-srv01:~$

What “private AI” means here

The model lives on your server

A 14-billion-parameter language model plus local vector search run as containers next to your data. Prompts and answers never cross your firewall.

No API keys to leak

There is no OpenAI key, no cloud AI account, no third-party processor for your energy data — nothing to rotate, audit or worry about.

No per-token fees

Ask a thousand questions a day. The marginal cost of an answer is your own hardware — not a metered API bill.

Answers you can audit

Every AI answer shows the exact SQL it ran. Grounded in your database — not the internet — and enforced read-only.

Bring your IT/OT team to the demo

They’ll ask the hard questions about deployment, auth and data flow. We like those questions.