diff --git a/environment-setup/security.mdx b/environment-setup/security.mdx
index 2e3992d..ba537d4 100644
--- a/environment-setup/security.mdx
+++ b/environment-setup/security.mdx
@@ -18,7 +18,7 @@ tracebloc is built so your data never has to leave your network. This page is th
 
 - **Data locality.** Training runs against your data on your hardware. Raw data never crosses the boundary.
 - **Isolation.** Each training job runs in its own container with restricted system access; Kubernetes namespaces separate workloads.
-- **Network policy.** Training pods are denied data egress — they can't reach MySQL, other pods, or the Kubernetes API.
+- **Network policy.** The chart applies a Kubernetes `NetworkPolicy` that denies all inbound to training pods and restricts their outbound traffic — arbitrary pod-to-pod connections and the Kubernetes API are blocked, while the in-cluster MySQL that serves the training data and the in-cluster proxy that reports results and FLOPs stay reachable. Direct outbound HTTPS is still allowed by default today; a stricter lockdown that instead routes it through an in-cluster egress gateway ships with the chart and can be enabled per cluster, and enforcement requires a [CNI that honors NetworkPolicy](/environment-setup/eks-client-deployment-guide).
 - **Model scanning.** Submitted models are scanned for vulnerabilities (Bandit) before anything executes.
 - **Encryption in transit.** All workspace ↔ platform traffic is TLS, on an **outbound-only** connection.
 - **Access control.** Only contributors you whitelist by email can join a use case.
diff --git a/tools-help/faqs.mdx b/tools-help/faqs.mdx
index c2d3ce8..2a0f847 100644
--- a/tools-help/faqs.mdx
+++ b/tools-help/faqs.mdx
@@ -28,8 +28,8 @@ Kubernetes 1.24 and above. See the [setup guide](/environment-setup/setup-guide)
 ### Can I run on-premise only?
 Yes. The standalone installer provisions a local cluster on your machine, or you can deploy the unified Helm chart into your existing on-prem Kubernetes. The client never depends on cloud infrastructure for training.
 
-### Do you support air-gapped clusters?
-Yes — see the [packaged-chart install path in tracebloc/client INSTALL.md](https://github.com/tracebloc/client/blob/main/docs/INSTALL.md) for the offline flow.
+### Can I install offline or run behind an egress proxy?
+You can install from a packaged chart `.tgz` rather than the public chart repo, and platform traffic can route through your corporate proxy (set `HTTP_PROXY` / `HTTPS_PROXY` before installing). The environment is **outbound-only** — nothing needs to reach *in* — but it does need outbound HTTPS to the tracebloc platform to run experiments, so it is **not** fully air-gapped. What you get instead is defined, auditable ingress and egress: raw data never leaves your infrastructure, and only the results and weights you choose to share are sent out. See the [install guide](https://github.com/tracebloc/client/blob/main/docs/INSTALL.md).
 
 ## Training & models