Deployment Models

Clevermore supports a deployment continuum from fully managed to on-prem, using the same application architecture in both modes.

The Deployment Continuum

Every Clevermore deployment uses the same infrastructure components: PostgreSQL, Redis, Web PubSub, and a Container App running the backend services. The only variable is which Azure tenant hosts the infrastructure.

Model	Infrastructure Location	Best For
Centralized	Clevermore's Azure tenant	Fast onboarding, no Azure subscription required from the firm
On-prem	Firm's own Azure tenant	Full data sovereignty, regulatory compliance, maximum control

Firms start with centralized hosting and can migrate to on-prem as needs evolve. The migration path is straightforward because the underlying architecture is identical — only the hosting location changes.

Centralized Deployment

In a centralized deployment, all backend infrastructure runs in Clevermore’s Azure tenant. The firm does not need an Azure subscription or any Azure infrastructure.

What the firm provides

A Global Administrator to grant admin consent
An IT administrator to deploy the add-in manifest via the Microsoft 365 admin center

What Clevermore provides

Dedicated PostgreSQL database with row-level security isolation
Dedicated Redis cache with scoped key prefixes
Dedicated Web PubSub instance for real-time updates
Container App running the backend services
Automated backups, monitoring, and maintenance

Even in centralized mode, each firm gets fully isolated infrastructure — separate database, separate cache, separate real-time channel. There is no shared-tenancy database.

On-Prem Deployment

In an on-prem deployment, the firm’s backend infrastructure runs entirely within their own Azure tenant. Clevermore manages operations remotely via Azure Lighthouse delegation.

What the firm provides

An Azure subscription with an Owner who can deploy the Lighthouse template
A Global Administrator to grant admin consent
An IT administrator to deploy the add-in manifest

What gets deployed in the firm’s tenant

A resource group containing all infrastructure
A virtual network with private endpoints fronting every data store
PostgreSQL Flexible Server (AAD-only auth, PgBouncer, RLS)
Azure Managed Redis (TLS enforced, scoped key prefixes)
Azure Web PubSub (OAuth-only, no access keys)
Azure Key Vault holding the deployment’s application secrets
Azure Container Apps running the Clevermore backend and its background job server
Azure Lighthouse delegation granting Clevermore ops access

Azure Lighthouse Delegation

Azure Lighthouse enables Clevermore to manage infrastructure in the firm’s Azure tenant without needing direct credentials. The firm’s subscription Owner deploys a one-time Lighthouse template that grants Clevermore delegated access to a specific resource group.

What Lighthouse provides

Capability	Description
Resource group access	Clevermore can deploy and manage resources within the delegated resource group
RBAC assignments	The Clevermore service principal receives Contributor access to the resource group
Resource provider registration	Required Azure providers (DocumentDB, SignalRService, etc.) are registered automatically
Auditability	All actions by Clevermore are logged in the firm's Azure activity log under a cross-tenant identity

What Lighthouse does not provide

No access outside the delegated resource group — Clevermore cannot see or modify other resources in the subscription
No Global Administrator privileges — Clevermore cannot modify Azure AD, users, or policies
Revocable at any time — the firm can remove the Lighthouse delegation from the Azure portal

Container Image Management

The Clevermore backend runs as a Docker container on Azure Container Apps. Container images are managed centrally:

CI/CD builds and pushes container images to a centralized Azure Container Registry (ACR) in Clevermore’s tenant on every merge to main.
On-prem Container Apps pull images cross-tenant using service principal credentials. The firm’s Container App authenticates against Clevermore’s ACR to fetch the latest image.
Updates are automatic — restarting a Container App revision pulls the latest image.

On-prem tenants do not need their own container registry. All tenants pull from the same centralized ACR.

Side-by-Side Comparison

Aspect	Centralized	On-Prem
Azure subscription required	No	Yes
Infrastructure location	Clevermore's tenant	Firm's tenant
Data residency	Clevermore's Azure region	Firm's chosen Azure region
Operational responsibility	Fully managed by Clevermore	Managed by Clevermore via Lighthouse
Onboarding time	Hours	Days (includes Lighthouse setup)
Frontend hosting	Vercel (shared)	Vercel (shared)
AI processing	Clevermore's AI provider config	Configurable per deployment (including private Azure OpenAI)
Firm IT involvement	Admin consent + manifest deployment	Admin consent + manifest + Azure subscription + Lighthouse
Cost to firm	Included in subscription	Azure infrastructure costs + subscription

Migration Path

Migrating from centralized to on-prem is a zero-downtime process. The frontend (Vercel) does not change — the deployment resolver handles the routing switch transparently.

Provision Target Infrastructure

The firm deploys the Lighthouse template, then Clevermore ops provisions PostgreSQL, Redis, Web PubSub, and a Container App in the firm’s Azure tenant using the same Bicep templates as the centralized deployment.

Replicate Data

The PostgreSQL database is migrated using logical replication. Data flows from the centralized database to the new on-prem database until they are in sync.

Update Routing

The organization-to-deployment mapping is updated so the Vercel frontend routes API requests to the firm’s Container App instead of the centralized backend.

Cut Over

Traffic switches to the new deployment. The centralized backend remains available for immediate rollback by reverting the routing configuration.