Hosting and deployment
How a Tallify installation is hosted in South Africa or on a practice's own server: what runs on it, how practices are kept apart, what is reachable.
Two options
- Hosted by Tallify. A server in South Africa that Tallify operates, under an operator agreement. Each practice is its own installation on that server, with its own database, vault, backups, services, sign-in and address; one practice's data is never in another's.
- A server the practice controls. At the practice or in a South African data centre, joined to the practice's private network. The practice owns the hardware and the data on it.
Plans are priced per adviser a month, with a 7-day free trial and no setup fee: see Pricing.
What runs on the server
- The console and API, and the client pages: the onboarding link, the guided fact find and review, and the signing pages.
- A worker that builds documents, reads intakes and writes drafts from a job table, so a restart re-runs a job rather than losing it.
- A mail service that holds each mailbox open and hands every new message to that practice's own installation.
- Local models, for search embeddings, the names check before anything is sent to Claude, reading an uploaded Astute CCP report, reading ID documents, and the assisted channel. Nothing they read leaves the server. On an installation with a public address the names check must run: if it cannot, a draft or a reply stops before anything is sent.
- Scheduled jobs, backups and the monitor.
How practices are kept apart
Each practice's services run as a Unix user of its own, which can read only that practice's folder and cannot write the program code. Secrets live in root-owned files that only that practice's services can read, never in code. The shared services (mail, scheduling) never open a practice's database or vault.
Network
What can be reached from the internet, and nothing more:
- the practice's sign-in page, with the emailed sign-in code (a hosted practice; a practice on a server it controls can keep the console on its private network only);
- the client's onboarding, review and signing links and the sign-up form;
- a health check that carries no client data.
Every other page needs a signed-in console session. On the client pages the client's personal link is the key, and a page shows only that client's own steps. A hosted practice's address runs through Cloudflare (tunnel, DNS and TLS), so its web traffic passes through Cloudflare's network. A practice on a server it controls reaches its console over the practice's private network (Tailscale), over HTTPS.
Updates
Updates are deployed from the Tallify repository as releases. Each new release is checked on a test installation first and can be rolled back. The worker is restarted only when no draft is in flight. Changes that affect how users work are described before they are applied, as the terms say.