Patch Windows and Linux Without Your Servers Ever Touching the Internet.
JetPatch governs Windows and Linux patching from one console — across the full connectivity spectrum, from restricted egress to fully air-gapped. No outbound connection from a server or endpoint, ever.
One Architecture. Dial It as Tight as You Need.
Restricted egress, partial isolation, and full air-gap aren't three different products — they're the same JetPatch architecture, with the outbound connection controlled as tightly as your policy requires.
Restricted Egress
Outbound traffic is limited to specific, whitelisted destinations. Only the JetPatch Manager is permitted to reach vendor update sources — on a schedule you control — while every server and endpoint remains fully internal.
Partially Isolated
Specific network segments have no outbound path at all. The Manager operates from a segment that does, syncing verified content into the isolated segments over internal-only connections — no exceptions carved into the isolated zone itself.
Fully Air-Gapped
No segment has any outbound connectivity. The Manager's connection to vendor sources runs on a scheduled, audited window, and every server and endpoint downstream stays completely sealed from the outside world.
Wherever your policy sits on this spectrum, the architecture underneath it doesn't change.
One Console. Two Connectivity Models. Zero Endpoint Exposure.
Windows and Linux need different mechanisms to stay isolated. JetPatch already knows both, so you don't have to design either from scratch.
One controlled doorway to Microsoft.
- Only the JetPatch Manager ever reaches Microsoft — servers and endpoints never do.
- Content is digital-fingerprint verified before it reaches the local update store.
- No WSUS infrastructure required for the isolated flow.
One repository, every distribution.
- The Unified Linux Repository syncs from vendor sources on a schedule you control.
- Every distribution runs in its own container on a single Docker host — no separate mirror server per OS.
- Removes the burden of standing up and maintaining Satellite, reposync, or SMT infrastructure yourself.
Fewer Servers. Less Scripting. Same Compliance Data.
Building your own local Linux repository infrastructure for an isolated environment usually means a separate mirror server per distribution. The Unified Linux Repository replaces all of it with one host JetPatch already knows how to run.
Building it yourself, distribution by distribution
- A separate mirror server or VM provisioned for every distribution you run.
- Hand-built
reposyncandcreaterepojobs, maintained and debugged by your own team. - Manual handling of advisory metadata to keep errata-level detail intact after each sync.
- HTTPS, reverse proxy, and certificate management configured separately for each repository.
- Hardware footprint that grows every time you add a distribution or a version.
One host, every distribution, already built
- One Docker host serves every distribution, each in its own container.
- Sync scripts JetPatch has already built and maintains for each supported distribution.
- Advisory-level metadata (RHSA, RHBA, RHEA) preserved automatically through the sync.
- Nginx reverse proxy with HTTPS termination configured out of the box, once, for the whole host.
- Adding a distribution means adding a container — not a server.
Installed Software. Your Environment. Your Control.
JetPatch is not a vendor-hosted SaaS product. It's installed and runs entirely inside your own infrastructure.
No Vendor-Hosted SaaS
JetPatch is installed software — it does not run in JetPatch's cloud, and no patch data ever leaves your environment through a hosted backend.
No Telemetry, No Phone-Home
The platform does not send usage or environment data outside your network. What stays inside your environment, stays inside your environment.
Your Data Center or Your Cloud
Deploy on-premises or inside your own private cloud tenancy — the architecture is the same either way, and you control where it lives.
Isolation Doesn't Excuse You From Proving Compliance.
Every framework still asks the same question: are all systems patched on a defined cadence, and can you prove it? JetPatch answers that for the systems that are hardest to prove — the isolated ones.
ISO 27001
A.12.6.1 — Management of technical vulnerabilities, with audit-ready reporting across every isolated segment.
NIS2 Directive
Article 21 — Patch management as a mandatory measure, documented the same way regardless of connectivity posture.
PCI-DSS v4.0
Requirement 6.3 — Security vulnerabilities addressed, with evidence generated automatically as part of every patch cycle.
The Full Mechanism, Per Operating System
This page covers the architecture and the value. For more detail on any of these topics, click through to the dedicated page below.
Offline Windows Patching
The full 12-step Windows mechanism — from Manager to local update store to endpoint.
See the Windows mechanism →Linux Patch Management
Advisory-level patching and the Unified Linux Repository, distribution by distribution.
See the Linux repository model →Patch Management Overview
20+ operating systems from one console. The full platform picture.
See the full platform →Air-Gapped Patch Management — What You Need to Know.
Ready to Patch Without Exposing a Single Endpoint?
Tell us about your environment — restricted egress, partially isolated, or fully air-gapped — and we'll show you exactly how JetPatch handles it.