Docs

Deployment guide

Three ways to run sealverity.ai. Each organisation's current model, region and data recipients are shown in Settings → Deployment.

Deployment models

Cloud SaaS

Shared, managed platform. Fastest start; sealverity.ai runs hosting, updates and backups. Data region chosen per organisation.

Third-party detectors and AI available; sovereign mode optional.

Dedicated VPC

A single-tenant installation in a private cloud network (your account or ours), with private networking to your systems.

Same features; outbound access can be limited to approved detectors.

On-premises

Runs entirely in your data centre, including air-gapped networks.

Sovereign mode on: only self-hosted detectors run; no data leaves your network.

Supabase (self-hosted) — Postgres 15+ with pgcrypto, pg_net and pg_cron; Auth with TOTP MFA (and SAML if you use SSO); Storage. Apply the project's database migrations in order.
Object storage — S3-compatible (e.g. MinIO, Ceph) behind Supabase Storage, encrypted at rest, with private buckets for evidence, benchmarks and sealed content. Size for originals plus 30% headroom.
Application server — the sealverity.ai web app (Node 20+ or a Workers-compatible runtime), 2 vCPU / 4 GB RAM minimum, horizontally scalable.
GPU detector service — one or more HTTPS services implementing the self-hosted detector API (e.g. Resemble DETECT or other open-source models). Typically 1× NVIDIA GPU with 24 GB+ memory per service; register each in Settings → Detection Providers.
Reverse proxy — TLS 1.2+ termination (nginx, Traefik, HAProxy) in front of the app, the database API and detectors; forward the client IP (X-Forwarded-For) so IP allow-lists work.
Scheduler — pg_cron calls the nightly retention endpoint at /api/public/cron/retention.
Sovereign mode — turn it on in Settings → Deployment and block outbound internet at the firewall, so external services are refused by both the app and the network.

Variable	Needed	Purpose
SUPABASE_URL / VITE_SUPABASE_URL	Required	Address of the database and auth service (server / browser).
SUPABASE_PUBLISHABLE_KEY / VITE_SUPABASE_PUBLISHABLE_KEY	Required	Public client key.
SUPABASE_SERVICE_ROLE_KEY	Required	Server-only key for privileged jobs (retention, SCIM, public verification).
REPORT_SIGNING_SEED	Required	Seed for the Ed25519 key that signs forensic reports and deletion certificates.
C2PA_SIGNING_CERT, C2PA_PRIVATE_KEY	Recommended	Organisation certificate and key for sealing content (test certificate used if missing).
CUSTOM_DETECTOR_*	Per detector	Auth values for self-hosted detectors.
LOVABLE_API_KEY	Cloud only	Built-in AI (review, intelligence, Ask assistant, text checks). Omit on air-gapped installs.
AIORNOT_API_KEY	Optional	AI or Not detector.
HIVE_API_KEY	Optional	Hive detector.
REALITY_DEFENDER_API_KEY	Optional	Reality Defender detector.
SIGHTENGINE_API_USER, SIGHTENGINE_API_SECRET	Optional	Sightengine detector.
RESEMBLE_API_KEY	Optional	Resemble AI Detect (cloud).
GPTZERO_API_KEY	Optional	GPTZero text detector.
ASSEMBLYAI_API_KEY	Optional	Transcription and audio intelligence.
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION	Optional	AWS Rekognition for face boxes and face match.

Secrets are kept server-side only. Values starting with VITE_ are public and reach the browser.