Platform
Deployment.
Two editions, one rule: the connection into your ERP is made from inside your network, never from outside it.
Self-hosted edition
One Linux VM. Podman runs the Redflow services, the database and the stream store. You bring the TLS certificate and the SMTP relay. The GP adapter pulls from the cleared stream and posts into GP from the same network segment it lives on.
Payroll and personal data never leave the LAN, because the platform never receives them: aggregation happens at the edge, before anything is written to a stream.
Hosted single-tenant
A dedicated instance per customer, operated by us. The pull worker and the adapter still run inside your network, so the inbound rule holds: your ERP is reached only from a machine you control.
Ask for it when you would rather not run a VM. We will say honestly whether it fits.
What you provide, what we provide
| A Linux VM | Your standard image. Podman, not Docker, so no daemon runs as root. |
|---|---|
| TLS certificate | Yours, from your CA. The console and the API are served only over it. |
| SMTP relay | Yours. Redflow sends approval notices through it and refuses to send without TLS. |
| A GP service account | Least privilege: create unposted batches in the companies you choose. Posting stays with your accountants. |
| Install bundle | We provide a versioned bundle and an install guide. You apply updates on your schedule. |
| Job configuration | We build each interface as a manifest, a rule pack and a job template, in shadow first. |
| Support | Included in the subscription. See Pricing. |
Network posture
- No inbound connection to the ERP, the CIS or WAMS from outside your network.
- The pull worker opens outbound connections only, to the Redflow instance you run.
- Approvers are notified by email or Teams and approve in the console or by reply.
- Everything written to a stream is visible in the console and exportable, so you can check for yourself what the platform holds.
Security details, including disclosure, are on the Security page.
Want the install guide?
Ask and we will walk your infrastructure team through the VM, the bundle and the network rules.