High availability, on your cluster
TypeScript end to end, stateless and scalable services — plus the security & compliance demanding IT departments expect. 100% self-hosted.
High availability, on your cluster
Docker Swarm or Kubernetes orchestration, HA PostgreSQL, Redis cache and S3 object storage — all on your side, with no mandatory SaaS dependency.
Traefik v3
Reverse proxy · TLS · ACME · ports 80/443 only
Web — React 18
Vite · Tailwind · Radix
API — NestJS
REST + WebSocket · RBAC
Worker — BullMQ
Emails · webhooks · crons
MCP
Streamable-HTTP · AI agents
PostgreSQL 17
Patroni + etcd · HAProxy · Primary + 2 replicas
Redis 7
Cache · pub/sub · BullMQ queues
Garage S3
On-premise object store · attachments
Docker Swarm
3 hosts · zero-downtime rolling updates
Kubernetes
Helm chart · portable S3 + Postgres
100% on-premise
No mandatory SaaS dependency. Only optional external connections: identity (Entra ID) and SMTP.
Zero downtime
Rolling updates via Docker Swarm, automatic database failover (Patroni), services replicated across 3 hosts.
Backup & DORA
RPO tiers, at-rest encryption (LUKS + envelope), internal TLS. Built for operational resilience.
Built for demanding IT departments
Server-side RBAC on every route and every real-time event. Your data never leaves your infrastructure.
SSO · OIDC · SAML · SCIM 2.0
Entra ID, JIT provisioning, group-to-role mapping, local break-glass. Certificate-based authentication (private_key_jwt) with no shared secret. Local accounts + TOTP 2FA.
Audit log & SIEM
Append-only log, daily chained integrity anchor, JSON Lines / CEF export, RFC 5424 syslog forwarder over mTLS.
GDPR — anonymization & portability
Pseudonymize rather than delete (Art. 17), personal-data export (Art. 20), audit integrity preserved.
DORA encryption
Envelope encryption (per-tenant DEK, KEK/DEK rotation), LUKS at-rest, internal PG/etcd TLS, encrypted overlay.
RBAC & API tokens
Roles + granular scopes, user PATs (RBAC ∩ scopes) and org keys, distributed rate-limiting, mandatory expiry.
Backup & restore
RPO tiers, native PostgreSQL scripts, backup.failed alerting, encrypted cold archival to object storage.
Deploy Vaks-PM on your infrastructure
Docker Swarm or Kubernetes, high availability, your data on your side. Let's talk about your target environment.