Deploy Maestro in your environment.
Maestro is deployed on customer-controlled infrastructure — on-premises or in your cloud subscription. This reference gives IT, database, network, and security teams the architecture, minimum requirements, preparation checklists, and deployment procedure required for go-live.
One deployment provides all four products.
Studio, Journey, Pulse, and Compass ship on one platform and one data model — there are no separate installations to integrate. A single-server installation is intended for evaluation and testing; production deployments separate the data tier.
Studio
The authoring environment. AI agents extract, research, ground, and generate adaptive course content from institutional syllabi and references, with faculty approval required at every stage.
Journey
The learner runtime. An adaptive engine evaluates learning evidence in real time and updates each learner's Bayesian model; an integrated AI companion provides text and voice support.
Pulse
Cohort-level learning analytics: live mastery by concept, early identification of shared misconceptions, and a structured intervention workflow for academic staff.
Compass
Curriculum governance: a complete audit trail, node split and merge with record preservation, and improvement recommendations aligned to institutional standards.
Designed for institutional environments.
A self-contained application tier, one required database, and controlled outbound connections. The same architecture applies across every supported topology.
Delivered as a complete product
PostgreSQL as the single source of truth
Graceful degradation
Customer-controlled AI services
A minimal, well-defined network surface.
Users reach the platform exclusively over HTTPS on port 443. Outbound connections are limited to AI service endpoints under customer-owned accounts. All remaining traffic is confined to the private network.
Inbound
443HTTPS and WSS from user networks to the application gateway. All Studio, Journey, Pulse, and Compass traffic — including realtime voice — is served on a single port.
Outbound
443HTTPS to the configured AI service endpoints, the institutional LMS where LTI is enabled, and web ingestion. Endpoint hostnames are supplied during deployment planning for firewall allow-listing.
Internal
3001 · 5432 · 7687Gateway to application services, application services to PostgreSQL, and the optional graph database. Private network only — no internal port is ever exposed externally.
From single server to high availability.
The architecture is identical across all three topologies; the topology determines where each tier runs and the level of availability it provides. The Maestro team sizes and validates the selected topology during deployment planning.
Standard
Single serverAll tiers — gateway, application services, database, and file storage — on one server or VM. Intended for evaluation and testing environments.
Production
Separated data tierThe application tier on one server; PostgreSQL on a dedicated server or an existing institutional database service. The recommended production baseline — each tier is sized, secured, and maintained independently.
High availability
Multi-server estateMultiple application servers behind an institutional load balancer, PostgreSQL with streaming replication or managed HA, and replicated storage. Recovery objectives of RPO ≤ 24 hours and RTO under one hour are achievable.
Validated baselines for every server role.
Sizing is driven by cohort size, reference-library volume, and content-generation activity. The figures below are validated starting points; larger estates are sized with the Maestro team during deployment planning.
| Evaluation — up to 200 learners | Production — up to 2,000 learners | |
|---|---|---|
| CPU | 4 vCPU | 8+ vCPU |
| RAM | 16 GB | 32 GB |
| Storage | 100 GB SSD | 250–500 GB SSD (NVMe recommended) |
| Database | Co-located on the same server | Dedicated server — 4 vCPU / 16 GB baseline |
| Network | 1 Gbps internal | 1 Gbps internal · outbound ≥ 50 Mbps |
Operating system. Ubuntu 22.04 LTS or an equivalent modern 64-bit Linux distribution, patched and NTP-synchronized.
Database engine. PostgreSQL 15+ with the pgvector extension — installed with the platform, or provided by an existing institutional database server.
TLS certificate. A valid certificate for the platform hostname, issued by an institutional or public CA.
Application tier. All application services, web applications, gateway, and runtime components are included in the installation package.
Generative AI service
Course engineering, Evidence Check judging, AI companion, and rubric grading.
Embedding & realtime voice
Text embeddings for reference retrieval (RAG) and realtime voice features.
AI video rendering
Rendering of AI presenter videos. Without it, video briefs are still produced for conventional production.
Locally hosted model endpoint
On-premises inference where institutional policy requires it.
Checklists and responsibilities before deployment.
The items below are the customer's responsibility ahead of the deployment session. Completing them in advance is the strongest predictor of an on-schedule go-live; the complete checklists are provided in the PDF.
Infrastructure
- Linux server(s) provisioned, patched, and NTP-synchronized
- Database arrangement decided — platform-installed or institutional
- DNS record created for the platform hostname
- TLS certificate issued for that hostname
- Firewall rules applied: inbound 443, outbound 443 to AI endpoints
- Storage volume mounted and included in backup scope
- Backup target available with 30-day retention
Accounts, keys & secrets
- Generative AI service credentials, provisioned with billing limits
- Embedding and voice service credentials
- Video rendering credentials — only if in scope
- Database role and password — existing server only
- Initial administrator email and strong password
Project owner
Approves scope, pilot course selection, and go-live.
System administrator
Operates the servers and holds the first Maestro administrator account.
Database administrator
Provisions PostgreSQL, enables pgvector, and owns backup and restore.
Network / security officer
DNS, TLS, and firewall egress rules.
Faculty & SMEs
Author and approve courses in Studio; own every academic approval gate.
LMS administrator
Registers Maestro as an LTI 1.3 tool and configures NRPS and AGS. Optional.
A structured, jointly executed procedure.
Deployment is performed together with the Maestro team once the preparation checklists are complete. The high-level procedure comprises eight steps.
Servers, network, DNS, TLS, and firewall rules per the selected topology.
Platform-installed, or an institutional PostgreSQL server with an application role and pgvector.
Run the installation package. Nothing is built or downloaded from source on site.
Hostname, TLS, database connection, AI service credentials, and the capabilities in scope.
First start applies and verifies the database schema and creates the initial administrator account.
The health endpoint reports all services connected; the end-to-end platform check passes on a sample course.
Enable LTI, companion voice, or video rendering as scoped.
Administrator walkthrough, monitoring and backup verification, and sign-off.
A self-contained security posture.
Learner data remains within the customer environment, secrets are managed server-side, and the only traffic leaving the deployment is AI-provider traffic under customer-owned accounts.
Access control
Learner data protection
Platform hardening
Data boundaries
Standard operational procedures.
Routine operation relies on established practices: PostgreSQL backups, a single health endpoint for monitoring, and scheduled maintenance tasks.
Health monitoring
Poll GET /api/health; alert on any non-OK status.
Database backup
Logical dump with 30-day retention; file storage backed up alongside.
Restore verification
Restore the latest dump into a scratch database and verify.
Telemetry pruning
Raw telemetry is pruned at 180 days; evidence records are permanent academic records.
Defined behaviour under partial failure.
Every failure mode has documented, predictable behaviour, and learner evidence is never lost.
PostgreSQL unreachable
The server fails fast at startup by design — the database is the source of truth. Restore the connection and restart.
Background jobs unavailable
The API continues serving; an hourly evidence sweep folds in any records submitted in the interim. No learner evidence is lost.
Graph database unavailable
Only the curriculum graph visualization degrades. All entity reads and writes continue.
AI service outage
Authoring and generation pause; delivery of already-produced content continues uninterrupted.
Capabilities are configured per deployment.
Platform capabilities are individually configurable — set during installation and adjustable afterwards. A configuration change requires a brief service restart.
Journey runtime
Learner delivery: enrollment, sessions, adaptive path delivery.
Background processing
Learner-model updates, scheduled re-checks, mining, and sync jobs.
LTI 1.3 integration
LMS launch, roster sync (NRPS), and grade return (AGS).
AI companion
Learner chat, proactive support triggers, and voice.
Misconception mining
Cohort misconception pattern mining feeding the Pulse review queue.
Universal ingestion
Reference ingestion across formats and the AI research pass.
The full deployment guide, ready for your technical teams.
The complete reference as a PDF: hardware profiles, full port listings, LTI prerequisites, verification criteria, and the incident quick reference — suitable for distribution to IT, database, network, and security teams.
Plan your deployment with our engineering team.
We validate infrastructure, AI service accounts, topology sizing, and LMS integration with your teams before go-live.