Deployment options
The two ways to run PIEDAP Consent, the shapes a self-hosted deployment can take, and what each choice means for responsibility and data location.
PIEDAP Consent runs as a deployment that someone operates. Either an operator runs it for you, or you run it on your own infrastructure. The choice decides who holds the keys, who makes the backups and where the records sit.
Two ways to run it#
| Question | An operator runs it for you | You run it yourself |
|---|---|---|
| Your role under the DPDP Act | Data Fiduciary | Data Fiduciary and operator |
| The operator's role | Data Processor, acting on your instructions | None. There is no processor for the consent records |
| Who holds the deployment secrets | The operator | You |
| Who runs backups, TLS and updates | The operator | You |
| Who approves live keys | The operator | You, with the platform key |
| Where the records sit | In the region the operator hosts in. Ask your account contact | On the infrastructure you choose |
The software is the same in both. The country the data sits in is decided by where the deployment runs, not by the software.
What every deployment needs#
| Part | Why |
|---|---|
| The API and the console | Built from the repository as two container images |
| PostgreSQL 18 | Holds everything. The schema uses the uuid-ossp extension |
| Redis 7 | Console sessions and shared rate-limit counters. It must be the Redis that IAM writes sessions to |
| The PIEDAP IAM service | Signs your team in. The console has no accounts of its own |
| A reverse proxy with TLS | The API speaks plain HTTP inside the deployment |
| A public HTTPS hostname | Your sites load the runtime from it and send consent to it |
| Outbound HTTPS | To webhook endpoints, scanned sites, the translation service if used, and the IAB vendor list |
| A place to keep secrets | Several of them can never be changed later |
The product sends no email and has no mail settings.
Shapes of a self-hosted deployment#
One host with Docker Compose. The supplied compose file runs the API, the console, PostgreSQL and Redis. Only the console is published beyond loopback, and your reverse proxy sits in front of it. Data is kept in two named volumes.
Your own database and Redis. An override file points the API at an existing PostgreSQL, or at the Redis that IAM uses.
Several API replicas. Apart from short-lived caches and counters, the API keeps no state in memory except the queue of site scans, so replicas can sit behind a load balancer. Redis makes the rate limits shared. Scheduled jobs take a PostgreSQL advisory lock and run on one replica at a time. Each replica opens up to 20 database connections by default.
Another platform. The console's nginx finds the API by the name consent-api on port 3003. On a platform other than Compose, you change web/nginx.conf to match your service name and resolver.
Build choices#
| Choice | Effect |
|---|---|
| A CDN for the runtime files | Released runtime files never change and may be served from a CDN. Install snippets then point at it |
| An API image without the scanner | The image is smaller and leaves Chromium out. Site scans then fail |
| The console under a path prefix | The console image can be built to be served under a path such as /consent/ |
| Retention enforcement | Off by default. When on, a daily job deletes evidence past its retention period |
What is not supplied#
- No published images. The repository contains Dockerfiles and a compose file. You build your own images and tag each build with its commit.
- No orchestration files beyond Compose. For another platform you write your own.
- No backup tooling. Backups, restore tests and disk encryption are done with your own tools.
- No TLS inside the deployment. The API has no setting for TLS on its PostgreSQL and Redis connections, so both must sit on a private network.
- No button that deletes a whole project. Removing a project's data is done in the database.
- No mobile SDK in a public registry. Your account contact provides the source.
The demo compose file
compose.lan.yml is for demos on a trusted network. It turns sign-in off and allows the demo data generator. Never use it for a real deployment.
An example#
A retailer in Mumbai wants its consent records kept in India. It runs the compose file on a host in an Indian region, behind its own proxy with TLS. It sets dedicated evidence keys before the first consent is recorded, and takes a database backup every day.
Its webhook endpoints and its translation service also decide where data travels. Notice wording goes to the translation service, and events go to the endpoints.