An air-gapped voice agent runs with no automated connection to outside networks. Everything except the phone call can stay inside your network: run Dograh and open-weight models on your own servers, switch off telemetry, the quick tunnel and Dograh's model service, and end the carrier trunk at your own PBX. The call itself still reaches a carrier.
Key Takeaways
- A public phone call always crosses your boundary through a carrier.
- A default install calls out until you switch off each connection.
- Air-gapped agents run local speech, language and voice models only.
This post is part of our guide to open-source voice AI agents, where an air gap is the last step after your own keys and local models. Below, we list every outside connection a default install makes, with its switch, using Dograh, the open-source AI voice agent platform we build.
What air-gapped means for a voice agent
NIST defines an air gap as an interface where two systems are not connected physically and any logical connection is not automated, so data crosses only by hand. By that definition, a voice agent that answers the public phone network is never fully air-gapped. The call is an automated connection to a carrier.
What you can do is keep everything else inside. Dograh is the orchestration layer that runs the call flow, tools and telephony, and the speech and language models are a separate layer you choose. In an air-gapped setup, both layers run on your servers, and the carrier hand-off happens at your own phone system.
One hosted part breaks the promise. Some guides call a voice agent on-premise because its language model runs locally, while speech recognition and the voice still come from cloud services. In that setup, the caller's audio still leaves your network on every call.
What a default install reaches outside
A fresh Docker install makes several outside connections until you switch them off. Each one has a switch or a replacement.
The start script pulls images from the internet on every start. On a connected machine, pull the images and export them with docker image save. Carry the file across, load it with docker load, and start with --pull never.
The start script always adds --profile tunnel, which opens a public trycloudflare.com address to the API, so start the stack with docker compose up -d instead, without the tunnel profile. Telemetry is on by default in the Docker setup. To switch it off, run ENABLE_TELEMETRY=false ./start_docker.sh and delete POSTHOG_API_KEY from docker-compose.yaml, since the start script ignores a telemetry setting in .env. PostHog receives no audio or transcripts, but on a closed network it should receive nothing.
At first sign-in, Dograh connects your organization to its own model service on the internet. The same service writes agents from a plain description, lists Dograh's voices and transcribes uploaded recordings. Inside an air gap, build agents in the editor or through the API, type clip transcripts by hand, and never pick Dograh's models.
A few smaller requests remain. The web app asks GitHub for the project's details, and fails quietly offline. Tracing with Langfuse runs only if you set its keys, so leave it off or host Langfuse inside. Every tool, webhook and pre-call data fetch calls the address you give it, so point them at internal systems only.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Local models for speech, language and voice
Inside an air gap, every model runs on your own hardware. In Dograh, add the provider called Local Models (Speaches), as the model configuration guide shows. Speaches serves faster-whisper for speech-to-text and Kokoro for the voice. The language model connects to any OpenAI-compatible server, such as Ollama or vLLM.
Watch the addresses. Inside Docker, localhost means the Dograh container itself, so enter the model server's address on your network instead. For the whole setup in one place, see self-hosted voice AI with open-weight models.
Every speech-to-speech provider Dograh supports is a hosted service, so an air-gapped agent uses the cascade of separate speech, language and voice models. Test Chatterbox if you want another voice, and Parakeet, Canary-Qwen or Voxtral are options to try for speech recognition. Our guide to local and self-hosted voice AI models covers which models fit which hardware. Our post on how to choose an LLM for voice agents covers the language model.
A knowledge base needs one change. Chunked search needs an embeddings service, and every embeddings provider Dograh supports is hosted. Inside an air gap, use Full Document mode.
Phone calls: the carrier stays at your edge
A call from the public phone network has to come through a carrier, and you choose where it lands. With Asterisk ARI, Dograh connects to your own Asterisk PBX. That needs Asterisk 22 or later, or Asterisk 20 LTS with the chan_websocket and res_websocket_client modules. The carrier trunk ends at your PBX or session border controller, and Dograh never talks to the carrier directly.
The hosted options sit outside the gap. Dograh Managed SIP is a SIP domain Dograh runs, and Twilio, Telnyx, Plivo and the other carriers Dograh supports are hosted services.
Some calls need no carrier at all. Browser test calls and website widget calls inside your network go straight from the browser to Dograh. For those, on a closed network, run your own TURN server.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Records and checks inside the gap
Call records stay where Dograh runs, in your Postgres database and MinIO storage. To stop saving call audio, set ENABLE_CALL_RECORDING_UPLOAD=false. The switch is server-wide, and transcripts are still saved. Dograh has no retention setting or automatic deletion, so your team sets and runs its own deletion schedule.
Then prove it. Block all outbound traffic at the firewall except your carrier trunk, and make a browser call and a phone call. Anything that breaks shows a connection you missed. Our data residency checklist lists the questions an auditor will ask about each one.
If you have not installed Dograh yet, start with the online install in our Docker tutorial on a connected machine, then move it across the gap.
Glossary
- Air gap
- A boundary where two systems have no physical connection and any logical connection is not automated, so data crosses only by hand. NIST uses this definition.
- Egress
- Any traffic that leaves your network for an outside address. In a voice agent, it includes model calls, telemetry, tunnels and the carrier leg of each phone call.
- Asterisk ARI
- The Asterisk REST Interface, which lets an outside application control calls on an Asterisk PBX. Dograh uses it to run calls on a PBX you operate.
- Cascade
- A voice agent setup built from separate speech-to-text, language and text-to-speech models, run in turn on each reply. It is the setup that can run fully on local models.
