If you manage equipment on a network with no route to the internet — a secure facility, a ship, an industrial control network, a lab, a site with no signal — you will have noticed that most asset management advice quietly assumes a problem you do not have. Sign up, invite your team, scan a barcode with the phone app. None of that is available to you.
This is a guide to the options that actually work when nothing can phone home, written by somebody who sells one of them. That last part matters, so the honest comparison comes first and the sales pitch comes last, clearly marked, and you can skip it.
Why cloud tools are out, and why that is not a criticism of them
AssetTiger, Sortly, Cheqroom, EZOfficeInventory, Asset Panda, GoCodes and Snipe-IT's hosted plan are all SaaS. The application runs on the vendor's servers and your browser talks to it. That is a perfectly sensible design for most companies and it is why those products are good at what they do.
It is also unusable on an isolated network, and not in a way a setting can fix. There is no offline mode that survives having no network at all, because the application itself lives on the other side of the gap. A mobile app with offline sync does not help either: it is built to reconcile later, and "later" never comes.
Check this before you rule anything in. "On-premise" and "self-hosted" are sometimes used loosely in sales material to mean "hosted in your cloud tenant", which is still the internet. The question to ask a vendor is narrower and harder to wriggle out of: does any part of this product make an outbound network request, including for licence checks, telemetry, updates, fonts or map tiles? Ask for it in writing.
The options that genuinely work
1. Self-hosted open source
Snipe-IT is free and open source, and although it sells a cloud-hosted plan it can equally be installed on your own server — its own site carries a school district describing exactly that. GLPI is comparable. Installed inside the enclave, either one is a real, capable asset management system with custom fields, attachments, software licence tracking, consumables and a proper permissions model. Nothing in this guide matches them on features.
What it costs you is a server, and on an air-gapped network a server costs more than it does anywhere else. You are responsible for a web server, a database and a PHP runtime, plus backups and restores that you have tested. Most importantly you own the patching — and this is the part people underestimate.
The thing almost everyone underestimates. On a connected network, patching is a scheduled command. On an air-gapped one it is a logistics exercise: every update to the operating system, the database, the runtime and the application has to be fetched outside, transferred across the gap on approved media, and applied by hand. Security teams that mandate the air gap frequently also mandate a patch window. A server that is easy to stand up can be expensive to keep, and an unpatched internal web application is a genuine risk rather than a theoretical one.
Choose this if you have real IT capacity inside the enclave, need the feature depth, and have an answer for who patches it in eighteen months. It is the right answer for plenty of sites.
2. A file
A spreadsheet has no server, no database, no runtime and therefore no patch cycle. It is a document sitting on a share the enclave already has, backed up by whatever already backs that share up. Nobody has to own it in the way somebody has to own a server.
The trade is feature depth and concurrency. One person edits at a time unless the file lives somewhere that supports co-authoring — which, air-gapped, usually means an internal SharePoint or nothing. There are no per-user permissions beyond file permissions, no attachments beyond what you are willing to store next to it, and no audit trail beyond what the file itself records.
Choose this if the register is a handful of people recording a few hundred or a few thousand items, and the alternative is the truth today: a folder of inconsistent spreadsheets, or nothing.
3. Paper, honestly
Plenty of secure sites still run a signed-out log on paper, and for a small store of high-value items with a custodian present it is not stupid. It is auditable, needs no approval, and cannot leak over a network. It does not scale, it cannot be queried, and depreciation is a calculator and an afternoon. If you are here because paper stopped scaling, that is the right reason to move.
What to record
Independent of which option you choose, a register is only as useful as the columns it carries. The minimum that answers real questions:
- An identifier you physically attach — an asset tag number on a label. Serial numbers alone are not enough; they are inconsistent, and reading one off a machine already in a rack is its own small misery.
- Make, model and serial — what an insurer and an auditor will both ask for.
- Who has it and where it is. Both. "Issued to Dana" and "Room 4" answer different questions and you will be asked both.
- Status — in use, in storage, being repaired, disposed of. The most common reason a register stops being trusted is that retired kit never leaves it.
- Purchase date and cost — the only way to produce a book value later without guessing.
- Warranty or support expiry, if you want to be told before it lapses rather than after.
- A dated movement log. Who took it, when, and when it came back. This is the difference between "who has it" and "who had it in March", and the second question is the one that gets asked in an investigation.
Getting data across the gap
You will need to move data in at the start and out at audit time, and the method is usually constrained by policy rather than by technology.
- In: most procurement systems will export CSV. Getting that CSV into the enclave is the approval question, not the technical one. Whatever you choose, make the import repeatable — a one-off manual clean-up you cannot reproduce becomes a reason the register drifts.
- Out: auditors want a fixed document, not a live system. Print to PDF, or export a CSV that is reviewed before it leaves. A file-based register has a quiet advantage here: the thing you hand over is the thing you were using.
- Barcode scanning still works. A USB barcode scanner is a keyboard. It types the number into whatever field has focus and needs no driver, no app and no network. This is worth knowing, because scanning is often assumed to be a cloud feature.
What a spreadsheet will not do
Being straight about this is more useful than a feature list:
- Concurrent editing is the real ceiling. Two people, two changes, one file.
- Per-user permissions do not exist beyond who can open the file. If different teams must see different assets, you want a database and a login.
- Attachments — receipts, warranty PDFs, photos — live beside the file rather than inside it, and the link between them is a convention you have to keep.
- Software licence tracking is a different shape of problem: seats, renewals and entitlements are not assets and a fixed column will not hold them well.
- Scale. Somewhere past a few thousand rows with heavy formula use, a workbook stops being pleasant. If you are tracking tens of thousands of items, run a server.
How to choose, in one paragraph
If you have IT staff inside the enclave, need custom fields, attachments and per-user permissions, and can commit to a patch routine that survives staff turnover, install Snipe-IT or GLPI. If your register is a few people and a few thousand items and the honest alternative is a folder of inconsistent spreadsheets, use a file — the absence of a server is the feature, and on an air-gapped network it is worth more than it is anywhere else. If you are unsure, start with the file: moving a clean CSV into Snipe-IT later is a morning's work, and the register you will have built is exactly what that import needs.
The part where we sell you something
We make one of the options above. Our IT Asset Tracker is an Excel workbook with an interactive dashboard that opens in a browser from the file itself. It makes zero network requests — that is asserted by our build rather than promised in a sentence — so it behaves the same on an isolated network as on a connected one. No server, no account, no licence check to phone home. One payment, and there is a live demo you can try without giving us anything.
It does not have per-user permissions, attachments or software licence tracking, and if you need those you want Snipe-IT and we would rather tell you now than after you have paid. Everything above this heading is true whether or not you buy it.