Hardware
Expanse Data Diode
Universal hardware enforcement for air-gapped networks. Physically enforce one-way data flow: move data into or out of a protected enclave without opening a return path.
Universal hardware enforcement for air-gapped networks
SFP+ form factor
Standard 10G SFP+ modules slot into existing hosts with no proprietary chassis. Use the same diode hardware across your deployment.
Hardware-enforced security
The Expanse Data Diode is one-size-fits-all hardware enforcement: a physical link that allows data to cross a network boundary in exactly one direction, never both.
Use it on the ingress side to bring logs, telemetry, or files into an air-gapped enclave, or on the egress side to publish data out. The hardware does not care what the payload is; it only enforces that nothing flows back.
Shipped as send-only and receive-only SFP+ modules, the diode plugs into standard cages on the equipment you already run. Fiber between TX and RX makes reverse traffic physically impossible. No firmware update, misconfiguration, or compromise can turn the link bidirectional.
Unsure what you need? We also sell complete bundles: hosts pre-configured with enterprise Linux hardened to a DISA-approved security baseline, ready for plug-and-play deployment.
Technical Specifications
- • Interface: SFP+ Fiber Optic
- • Throughput: Up to 10Gbps per diode
- • Protocols: Syslog, SNMP Traps, NetFlow, sFlow, RTP, NTP (native UDP), and more
- • Power: 0.6–1.0W typical
- • Wavelength: 1310 nm ± 30 nm
- • Reach: 10 km over SMF-28 fiber
What's Included
- • Expanse Data Diode SFP+ modules. Order TX, RX, or a matched pair as needed
- • Lifetime replacement on industrial variants: if an industrial module fails, we replace it at no charge
- • Full documentation and quick-start guides
- • Team guidance to help you get started with your deployment
- • Architecture templates and deployment plans for common use cases
Module Variants
| Model | Type | Temp Range | Power | Reach |
|---|---|---|---|---|
| EDD-10G-TX1310-10 | TX (Standard) | 0°C to 70°C | 0.8W / 1.16W | 10 km |
| EDD-10G-RX1310-10 | RX (Standard) | 0°C to 70°C | 0.6W / 1.0W | 10 km |
| EDD-10G-TX1310-10-I | TX (Industrial) | -40°C to 85°C | 1.0W / 1.25W | 10 km |
| EDD-10G-RX1310-10-I | RX (Industrial) | -40°C to 85°C | 0.8W / 1.05W | 10 km |
Key Features
Air-Gapped Unidirectional Link
Physical SFP fiber link ensures true one-way data transfer, blocking reverse data flow at the hardware layer.
Ingress or Egress Deployment
The same hardware works for data flowing into an air-gapped enclave or out of it. Assign TX and RX roles to match your boundary policy.
Infinite Scalability
Throughput scales with diode count in your switch fabric, growing with your security infrastructure.
Zero Trust Architecture
Physically enforced security policies regardless of software vulnerabilities or configuration errors.
Protocol Agnostic
Transfer files, streams, and database replications between isolated networks with guaranteed directional integrity.
Redundant Implementation
High-availability configurations for mission-critical environments where downtime is not an option.
FAQ
Frequently asked questions
How does a data diode physically enforce one-way data flow?
The Expanse data-diode comes as a pair of devices. One device physically consists of a sending component, and the other consists of a receiver component, making it physically impossible for data to travel in the reverse direction. Software or firmware compromise cannot alter the circuitry to operate in reverse.
What protocols can be used with the Expanse Data Diode?
Some protocols are natively supported in a unidirectional implementation: Syslog over UDP, SNMP Traps, NetFlow v5/v9 & IPFIX, sFlow, RTP Media Streams, and NTP Broadcast Mode. For protocols requiring session management, reliable file transfer, or TCP bridging, our Expanse Network Stack (ENS) provides modular utilities designed for diode links.
How is the Expanse Data Diode different from a firewall?
Unlike firewalls, which rely on software configurations that can be misconfigured or compromised, our data diode enforces unidirectional data flow at the physical level. There is no software to exploit or bypass. The hardware physically prevents data from flowing in the reverse direction.
What do I get when I purchase the Expanse Data Diode?
You choose what you need: individual TX or RX SFP+ modules, or a matched pair for a complete link. Each order includes documentation, deployment architecture templates, and team guidance to help you get started. Industrial variants also include lifetime replacement if a module fails.
What if a diode module fails?
Industrial Expanse modules include a lifetime replacement guarantee: if a TX or RX industrial module breaks or stops functioning for any reason, we replace it at no charge. Standard (commercial-temperature) modules are not covered by that lifetime replacement policy.
Need protocol bridging or enterprise orchestration? Explore ENS and Lattice.
Ready to deploy hardware-enforced security?
Contact our sales team to schedule a consultation and learn how the Expanse Data Diode can address your specific security requirements.