Enterprise Hybrid Deployment

Provision Azure Resources

Deploy the Veriproof Bicep templates from the enterprise package:

az deployment group create \
  --resource-group your-rg \
  --template-file veriproof-hybrid.bicep \
  --parameters \
    environment=production \
    postgresAdminPassword="<strong-password>" \
    keyVaultName="your-kv-name"

This provisions:

• Azure Database for PostgreSQL Flexible Server
• Azure Key Vault with soft delete and purge protection
• Azure Functions deployment slots
• Azure Static Web Apps resource (for the portal frontend)
• Managed Identity with Key Vault access policies

Apply the Database Schema

Run the database migration scripts against your new PostgreSQL instance:

psql "postgresql://veriproof_admin:<password>@your-server.postgres.database.azure.com/veriproof" \
  -f migrations/001_initial_schema.sql \
  -f migrations/002_enterprise_tables.sql

Migrations are idempotent (use IF NOT EXISTS guards) and can be re-run safely.

Initialize the Pepper Key

Generate your tenant pepper key and store it in your Key Vault:

# Generate a 256-bit pepper key
PEPPER=$(openssl rand -hex 32)
 
az keyvault secret set \
  --vault-name your-kv-name \
  --name "veriproof-pepper" \
  --value "$PEPPER"

Deploy the Function Apps

Deploy the Customer Portal API and Ingest API Function Apps from the enterprise package:

# Customer Portal API
func azure functionapp publish your-customer-api-app
 
# Ingest API
func azure functionapp publish your-ingest-api-app

Configure each Function App’s Application Settings with:

Generate and Deploy the Signed Deployment Config

Generate the signed deployment-config.json using the enterprise tooling:

veriproof-enterprise config generate \
  --mode hybrid \
  --setup-complete false \
  --portal-url https://portal.your-domain.com \
  --signing-key $DEPLOYMENT_SIGNING_KEY \
  --output ./dist/deployment-config.json

Deploy this file to the static assets directory of your portal frontend. It is served alongside the React SPA.

Deploy the Portal Frontend

Deploy the portal frontend (React SPA) to Azure Static Web Apps or your Nginx host:

az staticwebapp deploy \
  --name your-portal-swa \
  --source ./dist

Ensure deployment-config.json is included in the deployment.

Complete Setup via the Portal

Navigate to your portal URL in a browser. Because isSetupComplete is false in the deployment config, the setup wizard appears.

1. Create the initial CustomerAdmin account
2. Connect the test Enterprise API key
3. Run the connection validation check
4. Mark setup as complete

After setup completion, regenerate the signed deployment config with --setup-complete true and redeploy it. This prevents the wizard from reappearing.

Configure the SDK

Update your AI application to use Enterprise Hybrid mode:

builder.Services.AddVeriproof(options =>
{
    options.Mode = DeploymentMode.EnterpriseHybrid;
    options.LocalDatabaseConnectionString = connectionString;
    options.LocalKeyVaultUri = "https://your-kv-name.vault.azure.net/";
    options.CommitmentOnlyEndpoint = "https://api.veriproof.app/v1/enterprise/commitments";
    options.ApiKey = "vp_enterprise_...";
});

Validate End-to-End

Send a test session and confirm:

• Session data appears in your PostgreSQL tables
• Commitment hash appears in the Veriproof commitment queue (check the portal)
• Solana transaction signature is returned and verifiable