SaaS, cloud & on-prem

One product, hosted by us or run by you

VerticalServe runs InsightAssure as SaaS, or you run the same images in your own cloud or data centre with your Postgres, your object store, your secret manager and your model provider, or no model at all.

Two ways to run it

SaaS or self-hosted

The images, migrations and features are the same. What changes is who operates them and where the data sits.

	VerticalServe SaaS	Self-hosted
Who operates it	VerticalServe, on AWS	You, with Docker Compose (`./install.sh`) or your own orchestration
Tenancy	A workspace per organization; every row carries the organization and Postgres row-level security enforces it	One organization; the same row-level security
Database	A schema on a managed Postgres, connected as an ordinary role so the policies bind	Postgres 16 in the compose stack, or your managed Postgres
Evidence files	Private, encrypted S3 bucket	`file:///data/evidence` by default, or your bucket
Integration credentials	Sealed in AWS Secrets Manager, one secret per connection	Sealed in your secret store, or AES-256-GCM in the row with a key on your data volume
AI	Claude on Amazon Bedrock	Your provider (Bedrock, Azure OpenAI, Vertex, OCI, any OpenAI-compatible endpoint) or none: `ASSURE_AI=false` answers by rule
Consultancies	Portfolio across every client workspace a consultant belongs to	Consultants get accounts in your installation
Upgrades	Rolled out by VerticalServe	`docker compose pull && docker compose up -d`; migrations run on start

By cloud

The service mapping

Self-hosted, each dependency is a URL scheme or a provider name in one environment variable.

	Postgres	Evidence store	Secrets	Model
AWS	RDS for PostgreSQL	S3 (`s3://`)	Secrets Manager (`aws-sm://`)	Bedrock (`bedrock`)
Azure	Database for PostgreSQL Flexible Server	Blob Storage (`az://`)	Key Vault (`azure-kv://`)	Azure OpenAI (`azure_openai`)
Google Cloud	Cloud SQL for PostgreSQL	Cloud Storage (`gs://`)	Secret Manager (`gcp-sm://`)	Vertex AI (`vertex`)
OCI	OCI Database with PostgreSQL	Object Storage (`oci://`)	OCI Vault (`oci-vault://`)	OCI Generative AI (`oci`)
On-premises / air-gapped	Postgres 16 in the compose stack	Local volume (`file://`) or MinIO (`s3+http://`)	Mounted files (`file://`) or HashiCorp Vault	An OpenAI-compatible endpoint you run, or none

Inside a deployment

Three containers and the systems they read

The console, the API and Postgres; the API reaches out read-only to your systems and nowhere else.

Laptops check in to the API with the device agent; the public Trust Center is served by the same console.

Data residency

Where your compliance data lives

Your region

Self-hosted, every byte stays in the account and region you deploy to: database, evidence bucket, secret store and model endpoint.

Secrets as references

The database password and the model key are secret references resolved at start; integration credentials are sealed and never returned by the API.

Your model, or none

Bedrock, Azure OpenAI, Vertex, OCI or an OpenAI-compatible endpoint in your account. With no model, every AI feature answers by rule.

Backups

Back up the Postgres database and the data volume, which holds the signing key, the credential-sealing key and, by default, the evidence.

Private by default

Integrations refuse private, loopback and cloud-metadata addresses unless ASSURE_ALLOW_PRIVATE_INTEGRATIONS is set for a system inside your network.

A pilot on one VM

The compose stack runs on a single machine; move Postgres and storage to managed services when you are ready.