Government — isolated networks

A citizen feedback platform on an isolated network

Q: How do updates reach an isolated network?

As release packages, through the transfer procedure the entity already uses for other software: verified, then applied by the entity's IT team on its change schedule. The exact procedure is agreed on the technical call.

Q: Can kiosks and tablets work without internet?

Yes. They connect to the platform over the internal network; the device app also stores answers locally if the connection drops and syncs when it returns. See offline survey app.

Q: What happens if the vendor needs to help?

Support is given through the entity's own procedure: a supervised session inside the network, or diagnostics exported by the entity. The vendor has no standing access.

Q: Is the feature set reduced on an isolated network?

No. Surveys on every internal channel, dashboards, cases with SLA and escalation, reports and the API are the same. Only features that require external services are disabled or re-routed.

Q: How is this different from an open-source self-hosted survey tool?

A self-hosted survey tool collects answers. A feedback platform also runs kiosks and tablets, opens cases from low ratings with owners and deadlines, reports by centre and service, and keeps an audit trail; and it comes with a vendor responsible for releases and support under the entity's procedure.

A ministry whose network is isolated from the internet can still run a full feedback programme: Qmeter is installed inside that network, reached through the entity's own gateways, and updated from release packages applied by its IT team. Nothing calls out.

For entities whose policy excludes external SaaS and internet-connected services for citizen-facing systems.

On-premise deployment details

30 minutes with your IT and security leads. We bring the requirements and the release process in writing; a named person replies within one business day.

A security officer and an IT engineer talking at the doorway of a restricted-access server room

Why it matters

What an isolated network changes for a feedback programme

Three things that work differently when nothing can reach the internet: kiosks, tablets, web widgets and internal messaging reach the platform through the entity's own gateways, every action is written to an audit log held inside the network, and the vendor has no access unless the entity grants it for a defined task.

No external services at all

No cloud dashboard, no vendor-hosted survey links, no external SMS or e-mail provider. Every channel the programme uses must exist inside the network or pass through a gateway the entity controls.

Updates are a process, not a download

New versions arrive as signed release packages on media or through a controlled transfer point, are verified by the entity and applied on its change schedule. The platform must support this without a live connection.

Evidence stays inside

Audit logs, case histories and exports are held and read inside the network. An oversight body is given access there, not through a vendor portal.

How it runs

From installation to the daily report, without an internet connection

Each step produces a document the entity's IT and security teams can review.

Installation inside the perimeter

Application servers, database and the survey channel endpoints are installed on the entity's infrastructure from a release package. Sizing and requirements are provided in writing first.

Channels that never leave the network

Kiosks and tablets on the internal Wi-Fi or wired network; web widgets on the intranet and internal portals; SMS and e-mail through the entity's own gateways where they exist; manual entry for feedback received on paper or by phone.

Updates, backups and audit on the entity's schedule

Release packages applied by the entity's team; backups and monitoring on its tooling; every login, assignment, reveal of personal data and export written to the audit log inside the network.

Inside the network

How the pieces connect when nothing calls out

Code-drawn diagrams; the detailed architecture is provided in writing on the technical call.

Platform, channels and integrations behind the firewall

The platform sits on internal servers. Kiosks, tablets and intranet widgets talk to it over the internal network; the entity's own SMS and e-mail gateways carry invitations and replies; the API connects cases to the internal case system or CRM. No component needs an outbound connection.

Kiosks and tablets on the internal network
Intranet and internal portal widgets
Entity-owned SMS and e-mail gateways
API and webhooks to internal systems only

Diagram of Qmeter integrating with internal systems inside the customer's network

Updates, access and the audit trail

Releases are delivered as packages, verified and applied by the entity's team through its own change process. Vendor access, when needed, is granted by the entity for a defined task and logged. Role-based access, PII masking with audited reveal and retention rules are configured by the entity's administrators.

Release packages on the entity's change schedule
Vendor access only with approval, logged
Role-based access and masked personal data
Audit log held inside the network

Diagram of the Qmeter on-premise release and update process

What the entity provides

The four things we need from your side

Agreed on the technical call and written into the deployment plan.

Infrastructure and operations

Servers or a private cloud inside the perimeter, and an IT operations team that applies releases, runs backups and monitors the platform on its own tooling.

Internal channels

Network access for kiosks and tablets, an intranet or portal for widgets, and, where the programme needs them, internal SMS and e-mail gateways.

A transfer point for releases

A controlled way to bring verified release packages into the network: removable media or a transfer station, under the entity's own procedure.

Security review and sign-off

The entity's security team reviews the architecture, access model and controls before go-live. We provide the documents; the review and the decision are the entity's own.

Isolated-network deployment compared with internet-connected options

A plain comparison of three ways to run a feedback programme.

	Cloud or UAE-hosted instance	Isolated network (on-premise)
Where the data lives	On infrastructure operated for the entity, inside the chosen country	On the entity's own servers, inside its perimeter
Updates	Applied by Qmeter on a published schedule	Release packages applied by the entity's team on its change schedule
Channels	Kiosks, QR, SMS, e-mail, web, apps through Qmeter's gateways	Kiosks, tablets, intranet widgets, entity-owned SMS and e-mail gateways
Vendor access	Role-based, logged	None unless granted for a defined task, logged
Time to start	Days	Follows the entity's procurement, security review and infrastructure schedule

The feature set is the same in both models; what differs is who operates the platform and where it runs.

Where the requirements come from

UAE Information Assurance Regulation (u.ae)classification and controls for UAE government and critical entities
Qmeter on-premise deploymentmodels, architecture, controls, integration and release process

FAQ

Isolated-network deployment, answered

Short, factual answers. For your entity's case, book a technical call.

Does any part of the platform need an internet connection?›

No. Application, database, kiosks, tablets, intranet widgets, internal SMS and e-mail and the API all run inside the entity's network. Features that depend on external services, such as public SMS providers or AI translation through external models, are switched off or routed through the entity's own gateways.

How do updates reach an isolated network?›

Can kiosks and tablets work without internet?›

What happens if the vendor needs to help?›

Is the feature set reduced on an isolated network?›

How is this different from an open-source self-hosted survey tool?›

Keep exploring

Get started

Tell us how your network is isolated; we show how the platform runs in it

A 30-minute technical call with your IT and security leads. You receive the requirements, the release process and the architecture in writing. A named person replies within one business day.