Skip to content
Maestro.

Deploy Maestro in your environment.

Maestro is deployed on customer-controlled infrastructure — on-premises or in your cloud subscription. This reference gives IT, database, network, and security teams the architecture, minimum requirements, preparation checklists, and deployment procedure required for go-live.

Download the guide (PDF)Version 1.1 · Platform release 3.0 · July 2026
443Single inbound port exposed to users (HTTPS)
4Products delivered by one installation
3Supported deployment topologies
0Learner data leaving your environment
Platform scope

One deployment provides all four products.

Studio, Journey, Pulse, and Compass ship on one platform and one data model — there are no separate installations to integrate. A single-server installation is intended for evaluation and testing; production deployments separate the data tier.

Course authoring

Studio

The authoring environment. AI agents extract, research, ground, and generate adaptive course content from institutional syllabi and references, with faculty approval required at every stage.

Learner delivery

Journey

The learner runtime. An adaptive engine evaluates learning evidence in real time and updates each learner's Bayesian model; an integrated AI companion provides text and voice support.

Analytics

Pulse

Cohort-level learning analytics: live mastery by concept, early identification of shared misconceptions, and a structured intervention workflow for academic staff.

Governance

Compass

Curriculum governance: a complete audit trail, node split and merge with record preservation, and improvement recommendations aligned to institutional standards.

Platform characteristics

Designed for institutional environments.

A self-contained application tier, one required database, and controlled outbound connections. The same architecture applies across every supported topology.

Delivered as a complete product

Maestro ships as a pre-built installation package containing the application services, both web applications, and all runtime components. The customer provides infrastructure and configuration — never source code or build tooling.

PostgreSQL as the single source of truth

All entities, settings, authentication, audit events, pipeline artifacts, and vector embeddings reside in PostgreSQL 15+ with the pgvector extension — installed with the platform or on an existing institutional database server.

Graceful degradation

The optional graph database and the background job system degrade gracefully if unavailable. Core platform operation continues without interruption.

Customer-controlled AI services

All AI capability is consumed through service accounts the customer owns — generative, embedding and voice, and optional video rendering. Browsers never contact AI services directly; all traffic is server-mediated.
Network architecture

A minimal, well-defined network surface.

Users reach the platform exclusively over HTTPS on port 443. Outbound connections are limited to AI service endpoints under customer-owned accounts. All remaining traffic is confined to the private network.

Inbound

443

HTTPS and WSS from user networks to the application gateway. All Studio, Journey, Pulse, and Compass traffic — including realtime voice — is served on a single port.

Outbound

443

HTTPS to the configured AI service endpoints, the institutional LMS where LTI is enabled, and web ingestion. Endpoint hostnames are supplied during deployment planning for firewall allow-listing.

Internal

3001 · 5432 · 7687

Gateway to application services, application services to PostgreSQL, and the optional graph database. Private network only — no internal port is ever exposed externally.

Deployment topologies

From single server to high availability.

The architecture is identical across all three topologies; the topology determines where each tier runs and the level of availability it provides. The Maestro team sizes and validates the selected topology during deployment planning.

Topology I

Standard

Single server

All tiers — gateway, application services, database, and file storage — on one server or VM. Intended for evaluation and testing environments.

Topology II

Production

Separated data tier

The application tier on one server; PostgreSQL on a dedicated server or an existing institutional database service. The recommended production baseline — each tier is sized, secured, and maintained independently.

Topology III

High availability

Multi-server estate

Multiple application servers behind an institutional load balancer, PostgreSQL with streaming replication or managed HA, and replicated storage. Recovery objectives of RPO ≤ 24 hours and RTO under one hour are achievable.

Minimum requirements

Validated baselines for every server role.

Sizing is driven by cohort size, reference-library volume, and content-generation activity. The figures below are validated starting points; larger estates are sized with the Maestro team during deployment planning.

Hardware per server role
Evaluation — up to 200 learnersProduction — up to 2,000 learners
CPU4 vCPU8+ vCPU
RAM16 GB32 GB
Storage100 GB SSD250–500 GB SSD (NVMe recommended)
DatabaseCo-located on the same serverDedicated server — 4 vCPU / 16 GB baseline
Network1 Gbps internal1 Gbps internal · outbound ≥ 50 Mbps

Operating system. Ubuntu 22.04 LTS or an equivalent modern 64-bit Linux distribution, patched and NTP-synchronized.

Database engine. PostgreSQL 15+ with the pgvector extension — installed with the platform, or provided by an existing institutional database server.

TLS certificate. A valid certificate for the platform hostname, issued by an institutional or public CA.

Application tier. All application services, web applications, gateway, and runtime components are included in the installation package.

AI services — provisioned under customer-owned accounts
Required

Generative AI service

Course engineering, Evidence Check judging, AI companion, and rubric grading.

Required

Embedding & realtime voice

Text embeddings for reference retrieval (RAG) and realtime voice features.

Optional

AI video rendering

Rendering of AI presenter videos. Without it, video briefs are still produced for conventional production.

Optional

Locally hosted model endpoint

On-premises inference where institutional policy requires it.

Customer preparation

Checklists and responsibilities before deployment.

The items below are the customer's responsibility ahead of the deployment session. Completing them in advance is the strongest predictor of an on-schedule go-live; the complete checklists are provided in the PDF.

Infrastructure

  • Linux server(s) provisioned, patched, and NTP-synchronized
  • Database arrangement decided — platform-installed or institutional
  • DNS record created for the platform hostname
  • TLS certificate issued for that hostname
  • Firewall rules applied: inbound 443, outbound 443 to AI endpoints
  • Storage volume mounted and included in backup scope
  • Backup target available with 30-day retention

Accounts, keys & secrets

  • Generative AI service credentials, provisioned with billing limits
  • Embedding and voice service credentials
  • Video rendering credentials — only if in scope
  • Database role and password — existing server only
  • Initial administrator email and strong password

Project owner

Approves scope, pilot course selection, and go-live.

System administrator

Operates the servers and holds the first Maestro administrator account.

Database administrator

Provisions PostgreSQL, enables pgvector, and owns backup and restore.

Network / security officer

DNS, TLS, and firewall egress rules.

Faculty & SMEs

Author and approve courses in Studio; own every academic approval gate.

LMS administrator

Registers Maestro as an LTI 1.3 tool and configures NRPS and AGS. Optional.

Deployment procedure

A structured, jointly executed procedure.

Deployment is performed together with the Maestro team once the preparation checklists are complete. The high-level procedure comprises eight steps.

1
Provision

Servers, network, DNS, TLS, and firewall rules per the selected topology.

2
Prepare the database

Platform-installed, or an institutional PostgreSQL server with an application role and pgvector.

3
Install

Run the installation package. Nothing is built or downloaded from source on site.

4
Configure

Hostname, TLS, database connection, AI service credentials, and the capabilities in scope.

5
Initialize

First start applies and verifies the database schema and creates the initial administrator account.

6
Verify

The health endpoint reports all services connected; the end-to-end platform check passes on a sample course.

7
Enable options

Enable LTI, companion voice, or video rendering as scoped.

8
Handover

Administrator walkthrough, monitoring and backup verification, and sign-off.

Security and compliance

A self-contained security posture.

Learner data remains within the customer environment, secrets are managed server-side, and the only traffic leaving the deployment is AI-provider traffic under customer-owned accounts.

Access control

All platform APIs require authentication, with role-based access control for administrator, professor, and student roles — and a complete audit log queryable from the admin centre.

Learner data protection

Assessment answer keys and grading maps never reach the browser. Voice interactions are server-mediated with single-use, 60-second authorization tickets; audio is never stored — only transcripts.

Platform hardening

SSRF-hardened ingestion, server-side secret management, an unprivileged system user, and a single exposed port (443).

Data boundaries

Only AI-provider traffic leaves the deployment, under the customer's own accounts. No learner data is transmitted to the vendor, and there is no telemetry callback.
Operations and maintenance

Standard operational procedures.

Routine operation relies on established practices: PostgreSQL backups, a single health endpoint for monitoring, and scheduled maintenance tasks.

Health monitoring

Poll GET /api/health; alert on any non-OK status.

Continuous

Database backup

Logical dump with 30-day retention; file storage backed up alongside.

Nightly

Restore verification

Restore the latest dump into a scratch database and verify.

Quarterly

Telemetry pruning

Raw telemetry is pruned at 180 days; evidence records are permanent academic records.

Monthly
Resilience

Defined behaviour under partial failure.

Every failure mode has documented, predictable behaviour, and learner evidence is never lost.

PostgreSQL unreachable

The server fails fast at startup by design — the database is the source of truth. Restore the connection and restart.

Background jobs unavailable

The API continues serving; an hourly evidence sweep folds in any records submitted in the interim. No learner evidence is lost.

Graph database unavailable

Only the curriculum graph visualization degrades. All entity reads and writes continue.

AI service outage

Authoring and generation pause; delivery of already-produced content continues uninterrupted.

Configurable capabilities

Capabilities are configured per deployment.

Platform capabilities are individually configurable — set during installation and adjustable afterwards. A configuration change requires a brief service restart.

Default on

Journey runtime

Learner delivery: enrollment, sessions, adaptive path delivery.

Default on

Background processing

Learner-model updates, scheduled re-checks, mining, and sync jobs.

Default off

LTI 1.3 integration

LMS launch, roster sync (NRPS), and grade return (AGS).

Default on

AI companion

Learner chat, proactive support triggers, and voice.

Default on

Misconception mining

Cohort misconception pattern mining feeding the Pulse review queue.

Default on

Universal ingestion

Reference ingestion across formats and the AI research pass.

The complete document

The full deployment guide, ready for your technical teams.

The complete reference as a PDF: hardware profiles, full port listings, LTI prerequisites, verification criteria, and the incident quick reference — suitable for distribution to IT, database, network, and security teams.

Download the guide (PDF)
Deployment planning

Plan your deployment with our engineering team.

We validate infrastructure, AI service accounts, topology sizing, and LMS integration with your teams before go-live.