PRIVATE DEPLOYMENT

Self-hosted Prism deployment for private capital teams

Prism can be deployed as a private, customer-controlled instance when your team needs stronger data residency, infrastructure control or vendor-risk separation. The application is a Node service backed by PostgreSQL, with file uploads on disk or mounted storage, supervised behind your reverse proxy.

Simple core architecture

Prism runs as a Node application with PostgreSQL as the system of record. Background jobs use PostgreSQL through pg-boss, so a separate Redis dependency is not required for the standard deployment.

Role-separated database access

The runtime server uses a least-privilege PostgreSQL app role. Migrations use a separate owner role, so normal application traffic does not need schema ownership privileges.

Operationally familiar

A private instance can sit behind nginx, Caddy, an ALB or another reverse proxy, with TLS terminated at the edge and health checks wired to the Prism API.

What a private Prism deployment needs

  • PostgreSQL database
    Prism stores application state in PostgreSQL. Production deployments should use separate app and migration roles, TLS for database connections, backups and restore drills.
  • Node application runtime
    The backend is a Node service. It can be supervised with PM2, systemd, Docker, ECS, Kubernetes or an equivalent process manager.
  • Reverse proxy and TLS
    Run Prism behind nginx, Caddy, ALB, Cloudflare or another proxy that forwards the original protocol, host and client IP headers.
  • Upload storage
    Uploaded documents and generated files live under an upload directory. For production, this should be backed up or mounted on durable storage.
  • Secrets and environment variables
    Runtime configuration includes database URLs, JWT signing secret, encryption keys, HMAC index key, SMTP, Stripe and optional AI provider credentials.
  • Email, billing and monitoring
    Transactional email, Stripe webhooks, structured logs, health checks and backups should be configured before production use.

Typical setup path

  1. Provision PostgreSQL and create role-separated credentials.
  2. Deploy the Prism release bundle to the application host or container image.
  3. Set production environment variables and run the preflight check.
  4. Start the backend under a process supervisor.
  5. Place the app behind a TLS reverse proxy and configure allowed origins.
  6. Run migrations, create the first admin, verify health checks and enable backups.

What this means for buyers

  • No opaque black box: the core operating dependency is PostgreSQL plus the Prism app service.
  • Clear separation of duties: runtime access and migration access can be separated.
  • Familiar operations: backups, health checks, logs, TLS and process supervision follow standard SaaS operations patterns.
  • Deployment choice: teams can choose hosted Prism or discuss a private deployment where procurement, data residency or risk policy requires it.

Private deployment checklist

  • Database: PostgreSQL, TLS, role separation, backups and restore drill.
  • Application: Node runtime, release process, process supervisor and restart policy.
  • Security: JWT secret, encryption key, HMAC index key, least-privilege database role and production-only environment mode.
  • Network: TLS reverse proxy, allowed origins, forwarded headers and health check endpoints.
  • Operations: structured logs, uptime checks, backup schedule, audit-log retention and incident-response ownership.
  • Integrations: SMTP, Stripe webhooks and optional AI provider key where those features are used.

Discuss private deployment

Use this page during vendor review when your team needs to understand Prism hosting, database, migration, backup and operational responsibilities before approving a deployment path.