Runs inside your hospital, on your machine, with nothing phoning home
On-premise means one machine inside your network, no other tenant present, and no dependency on a vendor cloud for anything — not the identity server, not the object store, not the DICOM server, not the database, not the AI.
01 · On-premise
Every part of it was chosen so it could be self-hosted
This was a constraint from the first line of code, not a deployment option bolted on afterwards. The identity server is self-hostable because a software-as-a-service identity provider cannot run inside a hospital network. The cache is Valkey rather than Redis because Redis relicensed in a way that rules out on-premise redistribution. The DICOM server, the object store and the database are all local, all open source, and all redistributable.
An air-gapped bundle exists for hospitals whose network has no route to the internet at all. AI assistance, where it is used, runs against a self-hosted model on your own hardware; there is no call to a third-party model provider from an on-premise installation.
- What runs
- The application, the API, the de-identification worker, PostgreSQL, the object store, the DICOM server and the identity server — on one machine, behind your own reverse proxy and your own certificate.
- What leaves the building
- Nothing. There is no telemetry path out of an on-premise installation and no cross-hospital index for anything to be written into.
- The PACS gateway
- A separate appliance on your network that accepts DICOM C-STORE, so a radiologist sends a study from the workstation they already report on. It ships switched off and is commissioned per hospital.
- Updates
- Delivered as a versioned bundle you apply, with database migrations that run in order and a schema assertion that fails the deployment rather than the tenant isolation.
02 · Data residency
Where the data sits is a fact about your building, not a setting we honour
Plenty of hospitals are bound by rules about where patient data may physically sit — by national health-data law, by a group policy, by a clause in a research agreement, or simply by an information-governance officer who will not sign otherwise. RadBase does not interpret any of that for you and will not tell you what your obligation is.
What it does is make the question answerable structurally. An on-premise installation runs on hardware you own, in a location you chose, under your own network policy. There is no telemetry path out of it, no cross-hospital index for anything to be written into, and no vendor cloud any part of it depends on — not the identity server, not the object store, not the DICOM server, not the database, not the AI. Residency is not a promise we make about our infrastructure; it is a consequence of the data never reaching any.
Either way, confirm the specific obligation with your own compliance office rather than with us. We will build to whatever it says, and we would far rather you read it than take our summary of it.
03 · Single sign-on
Your directory, your password policy, your session rules
Enterprise installations sign in through your existing identity provider over OpenID Connect. The bundled identity server federates to it, so the accounts, the password policy, the multi-factor requirement and the leaver process stay where your organisation already runs them.
The binding to a specific directory is a configuration task in that identity server, scoped with you during onboarding. Nothing in the application changes to accommodate it, which is why it is a deployment conversation rather than a development project.
04 · Support and review
The parts of a hospital purchase that are not software
- Priority support, with a named contact and an agreed response time written into the agreement rather than into a help page.
- Security review support. We answer your questionnaire, and we hand over the deployment topology, the data-flow diagram and the residual-risk register — including the items still open, which are on the security page already.
- Procurement support. Purchase orders, invoices by bank transfer, multi-year terms, and whatever form your finance department needs the quotation in.
- Negotiated limits. A hospital’s subscription carries its own user, storage and case ceilings and its own feature grants, so a bespoke arrangement does not require a bespoke build.
- Onboarding. Installation, the first owner account, the taxonomy, and the word list of local names and institutions that report de-identification depends on. That list is collected with you, and it is the control that regular expressions cannot be.
05 · What we need from you
So the first conversation is short
- A host
- One Linux machine, virtual or physical, with enough disk for the archive you expect. We size it with you against your case volume.
- A certificate and a name
- A hostname on your network and a TLS certificate for it.
- An outgoing mail server
- For e-mail verification and password resets. Invitations work without one — the join link can be sent however the department already communicates.
- A decision on the gateway
- Whether radiologists should be able to send studies straight from the reporting workstation, and if so, which nodes may.
- A consultant who owns review
- The gate is a person. The installation needs someone accountable for it before the first case is published.