Operations

Deployment shapesPermalink to this section

Hosted

Baobyte operates the platform. Tenants resolve from the subdomain, and each institution's data is isolated by the five layers described in the security model.

Private cloud

The institution's own cloud account and network boundary, operated by Baobyte or jointly. Data residency is a deployment decision rather than a product limitation.

On-premise, air-gapped

Inside the institution's data centre with no outbound network. The platform ships as a bundle carried in on physical media, which is why nothing in the request path may depend on a hosted service.

Background workPermalink to this section

Jobs run on a Postgres-backed queue whose tables sit in the same database as the domain, so a job can be enqueued in the same transaction as the work that caused it. Screening a newly onboarded customer either both happens or neither does. Worker health is observable separately from the API's.

MigrationsPermalink to this section

Schema migrations run through a dedicated mode of the same binary, so the migration and the application it is migrating for cannot be different versions. Migrations are forward-only and are applied before the serving version starts.

ObservabilityPermalink to this section

Structured logs carry the request id that also appears in every problem response and in the audit trail, so a customer-reported failure resolves to one record rather than a time range. Operational telemetry carries tenant identifiers and no subject data.

ContinuityPermalink to this section

Backup, restore and the drill that proves the restore are operational commitments agreed per deployment rather than product defaults, and are covered in the continuity plan released under agreement. A restore duration measured on a developer machine is a floor, not a service level, and is presented as such wherever it appears.