Deploy AnkaSecure On-Premise

Complete control over your cryptographic infrastructure - deploy in your data center in 30 minutes

🚀 Get deployment guide: Start trial to access installation scripts

Quick Start: Evaluate On-Premise in 30 Minutes

Estimated time: 30 minutes
What you'll achieve: AnkaSecure running in your environment, ready for testing Requirements: Linux server (Ubuntu 24.04 or RHEL 8+), root access

Step 1/5: Check system requirements (2 minutes)

Minimum specifications:

# Verify your server meets these requirements:
CPU: 8 cores (16+ recommended)
RAM: 16 GB (32 GB+ recommended)
Disk: 100 GB SSD (200 GB+ for production)
OS: Ubuntu 24.04 LTS or RHEL 8+
Network: Outbound HTTPS (443) for package downloads

✅ Quick check command:

# Run this on your server to verify specs
lscpu | grep "^CPU(s):"
free -g | grep "^Mem:"
df -h / | tail -1

Expected output: 8+ CPUs, 16+ GB RAM, 100+ GB disk

Step 2/5: Download installer (3 minutes)

Register for trial to receive installation bundle:

📥 Register for on-premise trial (email required)

What you'll receive:

• Automated installation script (one command)
• Configuration templates
• Docker Compose files
• 30-day evaluation license

✅ After registration, you'll get:

# Download link sent to your email
curl -fsSL https://get.ankatech.co/install.sh | sudo bash

Step 3/5: Run automated setup (10 minutes)

One-command installation (abstracts infrastructure complexity):

# Installation script handles:
# - Prerequisites (Docker, dependencies)
# - Platform bootstrap
# - Service deployment
# - Health verification

sudo ankasecure-install --mode trial --domain your-company.com

✅ Installation progress:

[1/5] Installing prerequisites... ✓
[2/5] Bootstrapping platform... ✓
[3/5] Deploying services... ✓
[4/5] Generating certificates... ✓
[5/5] Running health checks... ✓

Installation complete!
Access: https://ankasecure.your-company.com

Step 4/5: Verify installation (5 minutes)

Health check:

# Verify all services running
ankasecure-admin status

✅ Expected output:

Service                 Status    Health
----------------------  --------  --------
Core API                Running   Healthy
Authentication          Running   Healthy
Key Management          Running   Healthy
Admin Console           Running   Healthy
Database                Running   Healthy
Cache                   Running   Healthy

Overall Status: ✓ Healthy

Web UI test:

# Access admin console
open https://ankasecure.your-company.com/admin

# Default credentials (change immediately!):
Username: [email protected]
Password: (sent to your email)

Step 5/5: Test cryptographic operations (10 minutes)

Generate first key:

# Using CLI (included in trial)
ankasecure-cli key generate --algorithm ML_KEM_1024

Encrypt test data:

# Encrypt file
ankasecure-cli encrypt --key-id <generated-key-id> --input test.txt

Decrypt to verify:

# Decrypt file
ankasecure-cli decrypt --key-id <generated-key-id> --input test.txt.enc

✅ Success: Original file recovered → Installation working!

🎯 What's next?

• Integrate your app: SDK integration guide
• Production deployment: Enterprise deployment guide
• Migrate from cloud: AWS KMS to on-premise migration

Why Deploy On-Premise?

Control & Sovereignty

Full control over:

• ✅ Cryptographic keys (never leave your infrastructure)
• ✅ Data location (compliance with data residency laws)
• ✅ Infrastructure (custom hardware, HSMs, network topology)
• ✅ Update schedule (deploy when YOU decide, not vendor-driven)

Use cases:

• Government agencies (FISMA, FedRAMP requirements)
• Financial institutions (regulatory capital requirements)
• Healthcare (HIPAA, patient data sovereignty)
• Defense contractors (classified data processing)

Cost Optimization

SaaS vs On-Premise cost comparison:

Break-even point: ~500K operations/month (on-premise becomes cheaper)

📊 Interactive cost calculator - Compare for your volume

Air-Gapped / Offline Environments

Fully disconnected deployment for classified networks:

Capabilities:

• ✅ No internet connectivity required (after initial download)
• ✅ Offline license validation (cryptographic license files)
• ✅ Manual updates (via USB/secure file transfer)
• ✅ Internal PKI support (bring your own CA certificates)

Example: Classified government network:

Internet-connected system (download installer)
        ↓
USB drive (transfer installer + license)
        ↓
Air-gapped network (deploy offline)

Use cases: SCIF environments, classified data processing, defense systems

Hybrid Deployment

Best of both worlds: SaaS control plane + on-premise data plane

Architecture:

Your Data Center          AnkaSecure Cloud
┌─────────────────┐      ┌──────────────────┐
│ Data Encryption │      │  Key Management  │
│ (on-premise)    │◄────►│  (SaaS control)  │
│                 │ mTLS │                  │
│ • Process data  │      │ • Generate keys  │
│ • Never leaves  │      │ • Audit logs     │
│   your network  │      │ • Analytics      │
└─────────────────┘      └──────────────────┘

Benefits:

• ✅ Data never leaves your network (compliance)
• ✅ Managed key lifecycle (reduced operational burden)
• ✅ Centralized audit logs (SOC 2 compliance)
• ✅ Auto-updates for control plane (reduced maintenance)

Use case: Financial services with strict data residency but need centralized key management

Deployment Models Comparison

SaaS (Fully Managed)

Best for: Startups, small teams, rapid prototyping

When to choose:

• ✅ Need to start immediately (< 1 day)
• ✅ Unpredictable workload (auto-scaling)
• ✅ Small team (no DevOps resources)
• ✅ Compliance not strict (standard regions OK)

🚀 Start SaaS trial (5 minutes)

On-Premise (Self-Hosted)

Best for: Enterprises, regulated industries, high-volume users

When to choose:

• ✅ Data sovereignty required (regulatory)
• ✅ High-volume operations (> 1M ops/month)
• ✅ Custom hardware (HSMs, TPMs)
• ✅ Air-gapped networks (classified environments)

📥 Get on-premise trial (email registration)

Hybrid (Split Architecture)

Best for: Large enterprises needing both control and convenience

When to choose:

• ✅ Need data residency but want managed services
• ✅ Multiple data centers (centralized management)
• ✅ Gradual cloud migration (keep data on-prem temporarily)

📧 Contact for hybrid setup

System Requirements

Development / Evaluation

Minimum specs (single-node, trial workloads):

Hardware:
  CPU: 8 cores (Intel Xeon or AMD EPYC)
  RAM: 16 GB
  Disk: 100 GB SSD
  Network: 1 Gbps

Software:
  OS: Ubuntu 24.04 LTS (preferred) or RHEL 8+
  Kernel: 5.15+
  Container runtime: Docker 24+ or Podman 4+

Optional:
  HSM: SoftHSM (included) or Luna/nShield (supported)

Supports: ~1,000 operations/second, 100 concurrent users

Production (Small)

Recommended specs (3-node cluster, production workloads):

Per Node:
  CPU: 16 cores
  RAM: 32 GB
  Disk: 200 GB NVMe SSD
  Network: 10 Gbps

Cluster:
  Nodes: 3 (high availability)
  Load balancer: HAProxy or NGINX
  Database: PostgreSQL 15+ (dedicated server)
  Cache: Redis 7+ (Sentinel mode)

HSM:
  Production-grade: Luna, nShield, or Cloud HSM

Supports: ~10,000 operations/second, 1,000 concurrent users

Production (Large)

Enterprise specs (10+ node cluster, high-volume workloads):

Per Node:
  CPU: 32 cores
  RAM: 128 GB
  Disk: 500 GB NVMe SSD (RAID 10)
  Network: 25 Gbps

Cluster:
  Nodes: 10-50 (horizontal scaling)
  Load balancer: F5 or AWS ALB
  Database: PostgreSQL cluster (Patroni HA)
  Cache: Redis cluster (6+ nodes)

HSM:
  Dedicated: Luna HSM cluster (3+ nodes)
  Backup: Secondary datacenter with DR HSM

Supports: 100,000+ operations/second, 10,000+ concurrent users

Architecture Overview

Logical Components

High-level system architecture (abstracts implementation):

┌──────────────────────────────────────────────────────┐
│                  Client Applications                  │
│         (SDK, CLI, REST API, Direct Integration)      │
└───────────────────┬──────────────────────────────────┘
                    │ HTTPS (TLS 1.3)
                    ↓
┌──────────────────────────────────────────────────────┐
│                   API Gateway Layer                   │
│  • Authentication (JWT, OAuth2, mTLS)                │
│  • Rate limiting (per-tenant)                        │
│  • Request routing                                   │
└───────────────────┬──────────────────────────────────┘
                    │
                    ↓
┌──────────────────────────────────────────────────────┐
│              Cryptographic Services                   │
│  • Key generation & management                       │
│  • Encryption / Decryption                           │
│  • Digital signatures                                │
│  • Migration operations                              │
└───────────────────┬──────────────────────────────────┘
                    │
                    ↓
┌──────────────────────────────────────────────────────┐
│                Security Boundary                      │
│  • HSM integration (Luna, nShield, SoftHSM)         │
│  • Key wrapping (AES-256-GCM)                       │
│  • Access controls (RBAC)                           │
└───────────────────┬──────────────────────────────────┘
                    │
                    ↓
┌──────────────────────────────────────────────────────┐
│                   Data Layer                          │
│  • Encrypted key storage                             │
│  • Metadata database                                 │
│  • Audit logs (tamper-proof)                        │
└──────────────────────────────────────────────────────┘

Key design principles:

• ✅ Separation of concerns: API, crypto, storage isolated
• ✅ Defense-in-depth: Multiple security layers
• ✅ Zero-trust: All components authenticate mutually
• ✅ Audit everything: Complete trail of operations

Note: Detailed implementation architecture provided in trial documentation

Security Features

Built-In Security

No configuration needed (secure by default):

• ✅ TLS 1.3: All communication encrypted
• ✅ mTLS: Service-to-service authentication
• ✅ HSM integration: Keys never in plaintext in memory
• ✅ Multi-tenant isolation: Database + application layer
• ✅ Audit logging: Tamper-proof operation trails
• ✅ Rate limiting: Per-tenant DoS protection
• ✅ OWASP compliance: 100% REST API Security Cheat Sheet

Optional Security Enhancements

Available in production deployments:

Licensing & Support

Trial License (30 days)

Included in trial:

• ✅ Full product features (no limitations)
• ✅ 10,000 operations/day limit
• ✅ Email support (48-hour response)
• ✅ Community forum access
• ✅ Documentation access

Get trial: Register here

Production License

Pricing models:

Included:

• ✅ Production license key
• ✅ Software updates (security patches)
• ✅ Technical support (SLA-based)
• ✅ Documentation updates
• ✅ Upgrade assistance

📧 Contact sales for pricing

Support Tiers

Production Deployment

Pre-Deployment Checklist

Before deploying to production, ensure:

• [ ] Infrastructure ready: Servers provisioned, specs meet requirements
• [ ] Network configured: Firewall rules, DNS, load balancer
• [ ] HSM available (if using): Luna/nShield credentials obtained
• [ ] Certificates ready: TLS certificates for HTTPS
• [ ] Backup strategy: PostgreSQL backup, key recovery procedures
• [ ] Monitoring setup: Health checks, alerting, log aggregation
• [ ] Disaster recovery: Secondary datacenter, failover plan
• [ ] Security review: Penetration testing, compliance audit
• [ ] License obtained: Production license key from sales team

Timeline: 2-4 weeks for full production readiness (after trial)

Deployment Steps (High-Level)

Phase 1: Infrastructure preparation (1 week)

• Provision servers (physical or VMs)
• Configure networking (VLANs, firewalls, load balancers)
• Set up HSM (if using production-grade hardware)
• Install OS and prerequisites

Phase 2: Platform deployment (3-5 days)

• Run automated installer (trial script)
• Configure production settings (database, cache, HSM)
• Generate production certificates
• Deploy services

Phase 3: Integration & testing (1 week)

• Integrate with your applications (SDK/API)
• Performance testing (load tests)
• Security testing (vulnerability scans)
• Failover testing (disaster recovery)

Phase 4: Go-live (1 day)

• Final validation
• Cutover from staging to production
• Monitor for 24-48 hours

Total timeline: 2-4 weeks (depends on complexity)

Migration from SaaS to On-Premise

Already using AnkaSecure SaaS? Migrate to on-premise without downtime:

Step 1: Deploy on-premise instance (parallel to SaaS)

Step 2: Export keys from SaaS (secure transfer)

# SaaS export (via Admin Console or API)
ankaSecure export-keys --destination secure-usb.dat

Step 3: Import keys to on-premise

# On-premise import
ankaSecure import-keys --source secure-usb.dat

Step 4: Dual-run period (validate functionality)

• 1 week: 10% of traffic to on-premise
• 2 weeks: 50% of traffic
• 3 weeks: 90% of traffic
• 4 weeks: 100% cutover, decommission SaaS

Zero data re-encryption needed (keys are portable)

Get Installation Guide

Option 1: Free Trial (Evaluation)

Register to receive:

• Automated installation script
• 30-day evaluation license
• Trial documentation
• Community forum access

📥 Register for trial

What we need:

• Name & email
• Company name
• Planned use case (helps us provide better support)

You'll receive within 5 minutes:

• Download link for installer
• Trial license key
• Quick start guide (PDF)

Option 2: Production Deployment (Enterprise)

Schedule consultation for production deployments:

What we'll discuss (1-hour session):

• Your requirements (volume, compliance, HSM)
• Architecture design (single vs multi-datacenter)
• Timeline (trial → production)
• Pricing (perpetual vs subscription)
• Support options (standard vs premium)

📧 Schedule consultation

Include in email:

• Company name
• Number of applications integrating
• Expected operation volume (ops/month)
• Compliance requirements (FIPS, FedRAMP, etc.)

Option 3: Proof of Concept (POC)

Extended evaluation for large enterprises:

What's included (60-90 day POC):

• Full production features
• Higher operation limits (100K ops/day)
• Technical account manager
• Architecture review
• Integration assistance
• Custom feature demos

Requirements: Signed POC agreement (no cost)

📧 Request POC

Frequently Asked Questions

Can I run AnkaSecure on my existing Kubernetes cluster?

Yes! AnkaSecure supports Kubernetes deployment (Helm charts provided in production license).

Trial installer uses Docker Compose for simplicity, but production deployments can use:

• ✅ Kubernetes (native)
• ✅ Docker Swarm
• ✅ OpenShift
• ✅ Nomad

What databases are supported?

Supported databases:

• ✅ PostgreSQL 15+ (recommended, included in trial)
• ✅ PostgreSQL-compatible (AWS Aurora, Google Cloud SQL)
• ⚠️ MySQL/MariaDB (experimental, contact support)

Trial includes PostgreSQL automatically.

Can I use my existing HSM?

Yes! Production deployments support:

• ✅ Thales Luna HSM (network or PCIe)
• ✅ Entrust nShield (network or PCIe)
• ✅ AWS CloudHSM (via PKCS#11)
• ✅ Azure Dedicated HSM
• ✅ Google Cloud HSM

Trial includes SoftHSM (software emulation, not for production).

Configuration guides provided after production license purchase.

How do I upgrade from trial to production?

Simple upgrade path: 1. Purchase production license (contact sales) 2. Replace trial license key with production key 3. Configure production settings (HSM, database replication) 4. Restart services (zero data loss)

No reinstallation needed - trial and production use same software.

What about high availability?

Production deployments support HA:

• ✅ Multi-node clustering (3+ nodes)
• ✅ Load balancing (HAProxy, F5, cloud LBs)
• ✅ Database replication (PostgreSQL streaming)
• ✅ HSM failover (Luna HA, nShield groups)
• ✅ Geographic redundancy (active-active or active-passive)

HA architecture design included in enterprise support tier.

Can I test on AWS/Azure before deploying on-premise?

Yes! Deploy trial on cloud VMs to evaluate:

AWS:

# Launch EC2 instance (Ubuntu 24.04, t3.xlarge minimum)
# SSH into instance
# Run trial installer
sudo ankasecure-install --mode trial --domain test.example.com

Azure/GCP: Same process (provision Ubuntu VM, run installer)

Benefit: Validate functionality before committing to on-premise hardware.

What's Next?

Ready to deploy on-premise?

• 📥 Register for trial (receive installer in 5 minutes)
• 📊 Cost calculator: SaaS vs on-premise
• 📧 Schedule architecture review (free 1-hour consultation)
• 📘 Download deployment checklist (PDF, 15 pages)

Compare deployment options:

• SaaS overview - Fully managed option
• Hybrid deployment - Split architecture

Explore use cases:

• Government/defense - Air-gapped deployments
• Financial services - Regulatory requirements
• Healthcare - HIPAA compliance

Have questions? Email [email protected] or join our community forum

Last updated: 2026-01-07 | Version: 3.0.0