Skip to content
Labs
Sign inRequest a demo

QUME · Deployment

Cloud, on-premises or air-gapped endpoint management, from the same build

The difference between a cloud tenant and an air-gapped installation is a values file, not a different codebase. Kubernetes, Docker Compose and native binaries are all first-class targets.

Book an architecture briefingQUME overview
An air-gapped installation: a signed bundle goes in, and nothing goes outA boundary encloses the installation and its own internal post-quantum certificate authority. A signed offline bundle enters through a fail-closed updater on the left. Three outbound arrows leave the boundary on the right and each one is crossed out: there is no egress at any point.signed bundleofflineno egress at any pointservicesPQC CAinternalfail-closed updaterblocked
  1. The same images run in the cloud, on premises and air-gapped; the difference between them is configuration, not a separate product.
  2. An internal post-quantum certificate authority issues every certificate inside the boundary, so nothing needs to reach a public one.
  3. Updates arrive as a signed offline bundle, and the updater fails closed when it cannot verify one.

Capabilities

What QUME does for deployment

  • Cloud

    Multi-tenant and cell-based. Organisations shard across cells, and each cell is a full cluster with its own database, bus and gateways.

  • On premises

    The same images and the same Helm chart for one organisation, on Kubernetes, Docker Compose or native binaries.

  • Air-gapped

    No egress at any point: an internal post-quantum CA, a signed offline bundle and a fail-closed updater.

In the console

And in day-to-day use

  • Scale is cell-based

    One cluster is designed for 50,000 devices. Beyond it, each cell is a whole cluster and organisations shard across cells behind a thin directory, so growth adds cells rather than rewriting anything.

  • Stateless services

    Every record carries an organisation and a cell, identifiers are ULIDs and there are no cross-device transactions, so nothing assumes one cluster is the world.

Getting started

From an empty install to a managed device

  1. Create the organisation

    Run qume-onboard tenant create on the host, then grant the first administrator.

  2. Connect your identity provider

    OIDC or SAML, with a claim mapped to a QUME role.

  3. Enrol the first device

    A single-use token, the agent, and attestation on first check-in.

Questions

What buyers ask

Is the air-gapped edition a separate product?

No. It runs the same images as the cloud and on-premises editions; only the configuration differs.

Explore QUME

Other capabilities

← Operations

See deployment in QUME

On your own devices, with your team.

Book an architecture briefingHow licensing works