The Virtual Data Diode
for the modern OT.
A software-based, multi-layered replacement for physical data diodes - bringing controlled, identity-verified connectivity between IT and OT environments without opening a single inbound port.
Trusted
From one-way data transfer to controlled operational connectivity.
Traditional data diodes solve a problem from a different era: how to move information in one direction across an air-gap. But modern OT environments need more - they need RDP to a SCADA console, SSH to a production server, real-time API integrations, and controlled vendor access. truePass Gravity is built for that operational reality, while preserving every isolation principle of a classical diode architecture.
Physical diodes solved yesterday's problem. Not today's.
Modern OT operations need interactive, identity-aware connectivity. Here's where the classical approach breaks.
Limited operational flexibility
Unidirectional gateways enforce one-way data flow, but they are restricted to file transfers and replication. When you need RDP to an OT machine, SSH to a production server, or connectivity to an internal web application - diodes cannot deliver.
The workarounds become the real risk
When the sanctioned path cannot support the task, people find an unsanctioned one. USB drives cross the air gap manually. A temporary firewall rule stays open for months. A vendor gets a jump host "just for this maintenance window." The diode remains secure - while the perimeter around it quietly erodes.
No unified identity across IT/OT
Zero Trust principles are applied to user access but rarely enforced for machine-to-machine communication. Without a unified platform, there is no consistent visibility into what is actually flowing between classified or isolated environments.
Compliance burden
Frameworks like NIST SP 800-82 and IEC 62443 require segmented architectures with monitored DMZ communications. When connectivity is spread across multiple vendors with distributed logs, demonstrating compliance becomes a resource-intensive manual process.
A physical diode enforces direction, not intent. Physics can prove which way a bit travelled - it cannot tell you who sent it, whether they were authorized, or what it was meant to do. Those are policy questions, and policy needs a return path the hardware deliberately removed. Gravity closes that gap -preserving the isolation of a one-way architecture while enforcing identity, session and per-request policy in software.
Three layers. One outbound-only path.
truePass Gravity replaces the physical data diode with a software-defined separation layer - built on patented Reverse Access™ and enforced at every access request, across isolated OT, classified, and air-gapped environments.
Reverse Access™ Transport
The connection is opened from the inside. Never from the outside.
Gravity splits into two elements: an Access Gateway in the DMZ or cloud edge, and an Access Controller inside the protected network. The Controller initiates every session outbound over 443 TLS - the Gateway holds no route inward and never accepts an inbound connection.
Because no inbound rule exists, there is nothing to scan, misconfigure, or exploit at the boundary. The protected network is not hardened against the outside - it is unreachable from it, with no changes to existing infrastructure.
- Outbound 443 TLS only
- Zero inbound firewall rules on the protected network
- Access Gateway in DMZ or cloud; Controller stays internal
- Internal network invisible to scanning from the untrusted side
- No re-architecture of existing network infrastructure
- Patented Reverse Access™ - registered in 22 countries
Secure File Exchange
Files cross the boundary. The network path never does.
Bidirectional file transfer between isolated environments is brokered through the proxy rather than routed - the two sides exchange content without a network path ever existing between them. Shares stay hidden: nothing is discoverable by enumeration or scanning.
Content Disarm & Reconstruction can rebuild every inbound file before it lands, stripping active content while preserving the document. Every transfer is recorded with the identity that moved it, the file, and the direction it travelled.
- Bidirectional CIFS/SMB brokered over TLS on port 443
- Content Disarm & Reconstruction (CDR) on inbound files
- All shares hidden — nothing exposed to enumeration
- SMB Signing; Windows and Linux/Samba environments
- Replaces manual media transfer across the air gap
- Full transfer log: identity, file, direction, timestamp
Zero Trust Application Access
Interactive access, brokered - not routed.
RDP, SSH, HTTP/S and API reach their destination without a network path between the two sides. Every request is resolved to a named identity before it touches an internal system - evaluated against Active Directory, MFA, and contextual signals rather than granted once at tunnel setup.
Sessions are scoped to a single application, not to a network, and can be revoked mid-stream. Valid credentials open one door, not the building - and the deployment works clientless or client-based, depending on what the environment allows.
- RDP, SSH, HTTP/S and API brokered per session
- Clientless or client-based deployment
- Native AD, LDAP and SAML integration with MFA
- Per-request policy evaluation - not per-tunnel
- Sessions scoped to one application, revocable mid-stream
- Unified management console, audit trail and SIEM export
truePass Gravity vs. Physical Data Diode
The question is not "which is more secure?" - both can be deployed securely. The question is which architecture matches the operational reality of modern OT. truePass Gravity does not replace the principle of isolation. It extends it - from a physical separation point to an entire operational envelope.
| Criterion | Physical Data Diode | truePass Gravity |
|---|---|---|
| Isolation principle | Physical one-way (laser/optical) | OT-initiated outbound access only |
| Communication type | Data replication only | Controlled operational access |
| Interactive TCP sessions | Not supported | Full TCP session under strict policy |
| Typical use cases | Historian, Syslog, UDP file copy | RDP, SSH, Web, API, SMB |
| Identity & access | Infrastructure-level only | Full per-user RBAC, MFA, AD |
| File & content | One-way transfer | Secure proxy + CDR content control |
| Audit & investigation | Scattered logs across components | Unified audit trail |
| Architectural fit | Optimized for one-way data flow | Optimized for modern OT connectivity |
truePass Gravity does not replace the principle of isolation. It extends it - from a physical separation point to an entire operational envelope.
Everything Gravity does for your isolated networks.
Our software-defined diode provides controlled connectivity, identity enforcement, and full visibility across the separation line — enabling the interactive protocols and file exchange that modern OT and classified environments depend on, without opening a single inbound port.
All connectivity is initiated outbound from inside the protected network over TLS on port 443. No inbound firewall rule exists on the protected side - nothing to scan, misconfigure, or exploit. Patented and registered in 22 countries.
Brokers RDP, SSH, HTTP/S, and API sessions to systems inside the isolated environment - the interactive access a physical diode structurally cannot deliver. Sessions are proxied, never routed: no network path exists between the two sides.
Moves files in both directions across the separation line over CIFS/SMB on TLS 443, with all shares hidden from enumeration. Replaces manual media transfer across the air gap, on Windows and Linux/Samba alike.
Rebuilds inbound files before they reach the protected environment, stripping active content and embedded threats while preserving the usable document. Every file crossing inward is sanitized by policy, not by trust in its source.
Resolves every request to a named identity before it touches an internal system - evaluated against Active Directory, LDAP, SAML, and MFA. Policy is enforced per request rather than granted once at connection setup, and sessions can be revoked mid-stream.
Records every session, command, and file transfer with the identity behind it - closing the blind spot of a hardware diode, which can prove direction but never who sent what. Complete audit trail across the separation point.
Replaces the stack of diodes, proxies, and connectors with a single management console and one policy model. Centralized logging with SIEM export - audit-ready evidence for NIST SP 800-82, IEC 62443, and ISO 27001.
Three outcomes that start on day one.
Replace the Physical Diode
Gravity delivers the isolation a hardware diode provides, plus the interactive connectivity it cannot. RDP, SSH, API, and bidirectional sync work across the separation line - without hardware, without re-architecting the network, and without an inbound port.
Get startedGive Vendors Access Without a Foothold
Maintenance engineers and integrators reach the one OT system they need to service - scoped to a single application, time-boxed, and fully recorded. No jump host, no standing account, no temporary firewall rule that outlives the maintenance window.
Get startedEnd Manual Media Transfer
Updates, patches, and log exports cross the air gap over a controlled, sanitized path instead of a USB drive carried by hand. Every file is disarmed on the way in and logged with the identity that moved it.
Get startedPlugs into the stack you already run.
Gravity integrates with your existing identity, monitoring, and industrial infrastructure - extending controlled connectivity across the separation line with no changes to network architecture and no new inbound rules.
Identity & Access Management
Active Directory · LDAP · SAML · Okta · Microsoft Entra ID · MFA
Security Event Management
Full session & transfer log export · Splunk · IBM QRadar
Industrial Systems
SCADA · Historians · PLC engineering workstations · Level 3/3.5 DMZ
Existing Perimeter
Runs behind current firewalls · No inbound rules · No re-architecture
Compliance Frameworks
NIST SP 800-82 · IEC 62443 · NIST SP 800-207 · ISO 27001
Where Gravity matters most.
Replace your diodes
without losing isolation.
A 30-minute consultation with our security architects. We'll review your OT/IT architecture, identify the right Gravity deployment approach, and propose a tailored Proof of Concept.