--- title: "Solution: Public sector and healthcare (by industry)" canonical_url: "https://tokenobserve.com/solutions/public-sector-and-healthcare" published: 2026-09-02 last_updated: 2026-10-21 --- # Solution: Public sector and healthcare (by industry) It runs air-gapped, the source is readable, and the supplier receives nothing. ## The argument For a public body or health organisation assessing optional customer hosting, Token Observe offers three structural features. In that mode it uses your provider keys without a supplier-operated runtime component, so runtime citizen and patient data is not sent to Token Observe: a prebuilt image has no runtime dependency on a supplier service or a content delivery network, the console bundles its own assets, and air-gapped or on-premise is a documented deployment mode rather than an accommodation. It is source-available, so your assurance team may read, compile and modify the code and commission its own penetration test on your own deployment. And its evidence is designed to outlive the contract: the licence provides that records may be retained, exported and used indefinitely after termination. ## Facts - Deployment modes: Single node, hybrid VPC, air-gapped on-premise, container platform, Kubernetes - Air-gapped operation: A prebuilt image needs no supplier service or CDN; the console bundles its assets - Patient identifier detection: NHS numbers validated mod-11, scoring 0.9 to 0.98 - Source access: Source-available: read, compile, modify, commission your own test ## The limit What is missing for a critical service: No high availability, replica or clustering, no point-in-time recovery, no availability commitment, and no independent certification ## What this reader is under pressure about - Data has to stay where you said it would stay: Residency commitments are made to citizens and patients, not to a procurement panel. Egress is allowlisted rather than merely configurable, and a per-agent policy can require a serving region, enforced on the fallback chain as well as the primary route. - Safety requires a stop that somebody owns: A kill switch scoped to one agent, a team or everything, requiring an attributable actor and a reason, evaluated first so it beats every other gate. It is the stop capability the regulation asks a deployer to have. - Staff are already using tools nobody procured: The shadow-AI radar reconciles five evidence sources from the security stack you already run rather than by inspecting the network. Findings tell you those agents exist; chasing them down inside your organisation is your work. ## What this reader asks, and the answer Q: Can it run with no internet connection at all? A: Yes, with two details to settle before you disconnect. A prebuilt image has no runtime dependency on a supplier service or a CDN and the console bundles its assets, so the running system reaches nothing you did not configure. Building from source still needs the pinned base image and the npm dependencies, so mirror those registries or import a verified release image first. The price catalogue ships with the product, so an offline install meters from the first request. Q: We cannot procure uncertified software for a critical service. A: Evaluate the fit with procurement before connecting data. The default cloud pilot is free for 30 days and holds workspace evidence and encrypted credentials on Token Observe infrastructure. A separately scoped customer-hosted evaluation can keep runtime data on your infrastructure. Neither mode has a certification, independent penetration test or availability SLA; keep production-critical workloads outside the pilot. Discuss any required certification milestone and support scope in a written agreement. Q: What happens to our evidence if the supplier disappears or we stop paying? A: That is what the terms are drafted to give you, and you have the source. The licence provides that records may be retained, exported and used indefinitely after termination, on the reasoning that losing the evidence would defeat the purpose of buying it, and it covers reading, compiling and modifying the source internally, with your modifications owned by you. Publication of what a test finds is narrower: benchmark results need no pre-approval provided the version and configuration are named, and security findings follow coordinated disclosure first. ### Running it where the network does not reach. Air-gapped or on-premise is one of five documented deployment modes, and nothing about the artifact changes between them except where it runs and which egress it is permitted. So the image your team reviews in a connected environment is the image that runs in the isolated one, and the verification is short enough to do during the review: search the source for every outbound call site, then run it with egress allowed only to your own endpoints. Two facts belong in the runbook: the process speaks plain HTTP and manages no certificates, and the metrics endpoint is unauthenticated while exposing agent identifiers and month-to-date spend. - Egress is allowlisted, not merely configurable: Two lists constrain which hosts a provider row may name and which environment variables it may reference, and neither may be empty. - Anchors can be written to a file: The anchor sink can be a local file, which makes no network call at all, so an isolated deployment can still hold off-box evidence, provided the copy lands where the database administrator cannot rewrite it. - Identity stays yours: Sign-in is authorisation code with PKCE against your own issuer; no offline scope is requested and no refresh token is held, so nothing persisted could be replayed against your directory. ### The radar reconciles evidence you already hold. It does not inspect your network. Five evidence sources: vendor bill reconciliation, network egress analysis, service-account key audit, developer tool telemetry, and the gateway's own caller and price consistency checks, including an hourly roll-up of credentials presented at the door and rejected, so an unrecognised credential in circulation becomes a finding rather than a log line nobody searches for. The integration direction is the security argument. Token Observe holds no standing broad credential into your stack: your gateway, proxy or SIEM pushes evidence to it, which is both the shorter review and the smaller blast radius. Two scheduled pull connectors are the named exception (GitHub Copilot and Cisco Umbrella), each on a read-scoped credential you supply, both off until you set it. ## The capabilities that matter most to this reader, in order - https://tokenobserve.com/platform/agent-registry - https://tokenobserve.com/platform/policy-engine - https://tokenobserve.com/platform/flight-recorder - https://tokenobserve.com/platform/audit-chain - https://tokenobserve.com/platform/shadow-ai-radar ## Questions and answers Q: Does patient or citizen data ever leave our network? A: Only to endpoints somebody in your organisation configured, and only after policy evaluation and redaction: your model providers, tool servers, webhook receivers, identity provider and anchor sink, plus a public price catalogue an administrator triggers by hand, and the two vendor pull connectors if you enable them. There is no default egress, and the supplier receives nothing. Q: How does this help with an AI system inventory? A: The registry is the inventory, and it is the same record the gateway enforces against on every request rather than a report generated from it, which is the only structural reason it cannot drift from reality. Four fields are required to create an agent: name, owner email, team and declared purpose. Risk tier, budgets and data policy sit alongside them, and metadata is where an impact-assessment reference lives. Q: Who signs off the residual risks in a public body? A: Whoever your governance requires, and the product tells you which risks need signing rather than leaving you to find them. The threat model names, per risk, the role that must record a dated acceptance: the CISO for six, the Data Protection Officer for regex-based detection, the Head of Product for unverified provider flags, the engineering lead for single-writer storage. Nine risks, four roles, none accepted until a named person dates it.