BlocklogAI Compliance
Documentation Topics
OverviewQuickstartCore ConceptsPython SDKTypeScript SDKREST API ReferenceIncident ReconstructionVPC DeploymentOpenTelemetry Integration
Self-Hosting & Enterprise

Run Blocklog in Your Private VPC

Deploy the backend and compliance dashboard inside your isolated cloud perimeter (AWS, GCP, Azure, or bare metal). Your audit logs never leave your infrastructure.

Zero Data Exfiltration Guarantee

When self-hosted, all agent logs, decision traces, payloads, and cryptographic state stay entirely within your private subnet. Blocklog only validates your license key against licenses.blocklog.dev — zero customer log payload is ever transmitted externally.

Licensing & Image Delivery

After completing onboarding, you will receive an enterprise delivery email containing:

blocklog-backend.tar

Core FastAPI, Celery workers, and cryptographic engine

blocklog-dashboard.tar

Next.js engineering dashboard & audit portal

BLOCKLOG_LICENSE_KEY

30-day evaluation trial key, upgradeable to enterprise

Prerequisites & Infrastructure Requirements

Container Runtime

Docker 24+ & Docker Compose v2 (single-node) or Kubernetes 1.26+

Relational Database

PostgreSQL 14+ (Amazon RDS, Cloud SQL, Azure Database, or native)

In-Memory Broker

Redis 6.2+ (Amazon ElastiCache, MemoryStore, or standalone)

Secrets / KMS

AWS KMS / Secrets Manager, GCP Secret Manager, or HashiCorp Vault

Step-by-Step Guide

Deploying via Docker Compose

Step 01

Load the Backend Docker Image

Load the secure Docker artifact from your delivery bundle, then generate your environment file.

terminal
bash
# You will receive the Docker image via email after license activation.
# Load the image, then set up your environment:
docker load -i blocklog-backend.tar
cp .env.example .env
Step 02

Configure Backend Environment Variables

Populate your .env file with your database URI, Redis credentials, license key, and signing salts.

.env
bash
# License (provided via email — 30-day free trial, then paid)
BLOCKLOG_LICENSE_KEY=bl_live_your_key_here

# Security — generate long random strings for each
JWT_SECRET_KEY=generate_a_long_random_string
API_KEY_SALT=generate_another_random_string

# Database
DATABASE_URL=postgresql://user:password@db_host:5432/blocklog

# Redis
REDIS_URL=redis://redis_host:6379/0

# CORS — add your dashboard domain here
CORS_ORIGINS=http://localhost:3000,https://your-dashboard-domain.com

Production Security Recommendation

Never store cryptographic salts or signing secrets in plain text in production. Use AWS Secrets Manager, HashiCorp Vault, or your cloud provider's key management service.
Step 03

Initialize Database & Start Backend Services

Execute database schema migrations and boot the API workers, hash sealer, and TLS reverse proxy.

terminal
bash
# Run database migrations
make migrate

# Start the full stack
make prod-up
apiCore FastAPI engine on port 8000
workerCelery workers for cryptographic sealing
beatPeriodic batch anchoring scheduler
nginxReverse proxy handling TLS & headers
Step 04

Deploy Compliance Dashboard

Load the dashboard container and wire it to your backend API endpoint.

.env.dashboard
bash
# Load the dashboard image received via email:
docker load -i blocklog-dashboard.tar

# Configure backend URL
NEXT_PUBLIC_BLOCKLOG_API_BASE_URL=https://your-backend-url/api/v1
terminal
bash
docker-compose up -d
# Dashboard available at http://localhost:3000
Step 05

Verify Services Health

Confirm container health status, query the readiness probe, and access the compliance web UI.

terminal
bash
# Check service health
docker compose ps
docker compose logs -f api

# Test the API
curl http://localhost:8000/health

# Open the dashboard
open http://localhost:3000

Production Secrets Management

For production deployments, store cryptographic signing keys and database connection strings in AWS Secrets Manager, HashiCorp Vault, or Google Cloud Secret Manager rather than unencrypted environment files.

aws-secretsmanager.sh
bash
aws secretsmanager create-secret \
  --name blocklog/jwt-secret \
  --secret-string "your_jwt_secret"

Upgrading to a New Release

When receiving updated release bundles, load the new container images and perform zero-downtime rolling service restarts:

upgrade.sh
bash
# Backend
docker load -i blocklog-backend-vX.Y.Z.tar
docker compose up -d

# Dashboard
docker load -i blocklog-dashboard-vX.Y.Z.tar
docker-compose up -d

Data Isolation Matrix

Telemetry / Data AssetBlocklog Cloud (External)Your Private VPC
Agent Execution Logs & Inputs✗ Never transmitted✓ Persisted locally
Decisions & Tool Arguments✗ Never transmitted✓ Persisted locally
Cryptographic Merkle Roots✗ Never transmitted✓ Generated locally
Instance Version & Uptime✓ Telemetry only✓ Stored locally
License Validation State✓ Ping status only✓ Cached locally

Sizing & Hardware Recommendations

Evaluation / Staging
  • 2 vCPU
  • 4 GB RAM
  • 50 GB NVMe SSD
  • Single-instance SQLite / Postgres
Production Standard
  • 4 vCPU
  • 8 GB RAM
  • 100+ GB SSD
  • Managed PostgreSQL (RDS / Cloud SQL)
High-Volume Enterprise
  • 8+ vCPU
  • 16+ GB RAM
  • Multi-AZ Postgres
  • Dedicated Redis cluster

Troubleshooting Common Issues

Services won't start

Check for missing environment variables or database connection errors.

troubleshoot
bash
docker compose logs api
# Check for missing env variables or DB connection errors

License validation timeout

Ensure outbound HTTPS access to licenses.blocklog.dev is permitted through your VPC security group.

troubleshoot
bash
# Ensure outbound access to licenses.blocklog.dev is not blocked
docker compose logs api | grep license

Dashboard CORS error

Add the dashboard domain to CORS_ORIGINS in your backend .env, then restart.

troubleshoot
bash
# Add your dashboard URL to CORS_ORIGINS in backend .env, then restart
docker compose restart api