Can Dependency-Track be used fully offline (air-gapped environment)?

[wataakihforbusiness]

Hello,

I would like to clarify the usage of Dependency-Track in an offline (air-gapped) environment.

Background

• For security and compliance reasons, I need to operate Dependency-Track without any internet connection.
• In particular, I want to avoid sending SBOM or other system information outside the environment.
• Therefore, I am considering a fully offline deployment of Dependency-Track.

Questions

1. Is it possible to run Dependency-Track in a completely offline (air-gapped) environment? If yes, are there any specific limitations or requirements?
2. I understand that some scanners (e.g., Trivy, Grype) may rely on API calls that typically require external communication. If I deploy such scanners inside my own environment, can Dependency-Track work without any outbound connections, or does Dependency-Track itself ever communicate externally?
3. Regarding vulnerability sources (e.g., NVD, OSV): as far as I understand, these are imported into Dependency-Track but no SBOM or other project information is ever sent outside. Is this understanding correct?

Any clarification or reference to official documentation would be greatly appreciated.

Thank you!