Deployment
On your hosts, operated by your team
The supported production deployment is Docker Compose from a versioned release bundle, on infrastructure you operate. Download the release and install it; no account needed.
Install
Docker Compose from a pinned release
Deploy a signed, version-pinned release and run the preflight check before first boot. Only the web proxy is published; the data services stay on internal networks.
- Publish only ports 80 and 443 through Nginx
- PostgreSQL, Redis, OpenSearch, and the API on internal networks
- Object storage you own and create in advance
- At least 2 vCPUs and 8 GB of memory; 16 GB for the full stack
Operate
Upgrades and backups are yours
To upgrade, verify the new bundle, pull the pinned images, and recreate the containers. Database migrations run on startup. Back up the installation as one recovery set and keep a copy off the Docker host.
- PostgreSQL, including the audit tables
- Every object in your storage bucket
- The .env file, the license secret, and the audit integrity secret
- The pinned image manifest and Compose release
Air gap
No outbound call to activate
Import the container images, signatures, checksums, and SBOM through your approved transfer process, and mirror them in an internal registry with the original digests. Browser activation is local. A paid license key can arrive over an offline channel and be pasted in.
An isolated network does not mean every feature works without one. Here is what stays on your network and what still needs a path out.
- Stays local: installation, activation, and license keys
- Needs a path: each connector and enrichment provider you enable
- Needs a path: a cloud model, if you configure one
- Needs a path: Liveblocks, for real-time co-editing of case documentation
License
Community first, keys when you add analysts
A new installation starts on Community: every feature for one user, issued locally at first boot, with no expiry and no key from us. Pro and Enterprise keys come from CaseBender, set the seat count and term, and are bound to the Installation ID of that appliance.
- The Installation ID is not a secret; send it with a license request
- Never send your .env file or license secret
- After a term ends there is a short grace period, then the install becomes read-only until a renewal key is applied
Cloud
Cloud pages are reference architectures
The docs include reference architectures for OpenShift, AWS, Azure, Google Cloud Run, and DigitalOcean. They are not production-certified procedures, and some predate the current hardening baseline. Running CaseBender in your own cloud account is still your installation. Use them with an architecture and security review of your own.
Questions
Deployment questions
Is there a hosted version?
No. CaseBender runs on infrastructure you operate, and there is no CaseBender account to subscribe to. Demos run on an installation we keep for demos only. The cloud pages in the docs describe how you could run it on your own cloud account.
Does activation need internet access?
No. Activation happens in the browser on your network, and a license key can be pasted in after it arrives over an offline channel. Connectors, enrichment, cloud models, and real-time co-editing still need their own network path.
What happens if we rebuild the host?
Rebuilding on a new host creates a new Installation ID. Ask us for a key bound to the new ID; a key from the previous host will not activate.
Ready for more than one analyst?
Send us your Installation ID, the seats you need, and the term. We will issue a key for that appliance.