See what a professional incident evidence pack looks like
Request a sample CasePack evidence pack or book a 20-minute workflow review to see how CasePack fits next to your PSA, SIEM, EDR, or existing incident process.
Deployment & data control
Self-hosted incident reporting for MSPs that need control
The private design-partner preview runs CasePack on your infrastructure with a supported Docker Compose profile while incident data and evidence remain under your operational control.
Why self-host incident reporting?
Some MSPs and security-sensitive clients are not comfortable sending incident evidence, logs, screenshots, exports, or audit records into a generic SaaS tool.
CasePack Self-Hosted Connected is a private design-partner preview for the same core product flow: incidents, evidence, timelines, reports, NIS2 milestones, audit logs, and exports.
What you deploy
A typical self-hosted CasePack deployment includes:
| Component | Default option | Purpose |
|---|---|---|
| CasePack web app | CasePack SPA | Browser user interface |
| CasePack API | CasePack API | REST API, license checks, evidence, reports, exports |
| Database | PostgreSQL 17 | Incidents, tenants, users, audit log, metadata |
| Identity | Keycloak / OIDC | Sign-in and user authentication |
| Object storage | SeaweedFS S3 gateway by default | Evidence files and generated exports |
The first preview supports the bundled single-server Docker Compose / Podman profile with one API replica. Alternative infrastructure and cluster profiles remain demand-gated.
Docker Compose
Accepted design partners receive the pinned Compose configuration and guided onboarding.
- 1
Clone the self-host wrapper
- 2
Copy .env.example to .env
- 3
Set required passwords
- 4
Enroll with a short-lived code through the protected licensectl prompt
- 5
Start the stack with Docker Compose
- 6
Sign in with the bootstrap admin account
- 7
Create users and tenant workspaces from CasePack administration
Licensing modes
Connected is the only mode available in the MVP. Air-Gapped and Broker are documented roadmap seams, not current products.
- 1
Connected: daily refresh with a 30-day signed credential continuity window
- 2
Air-Gapped: roadmap; no availability date or price
- 3
Broker / HA: roadmap; no availability date or price
Object storage for evidence and exports
CasePack stores evidence in S3-compatible object storage. Self-host deployments can use the bundled SeaweedFS S3 gateway or another compatible backend such as Ceph RGW, AWS S3, or another S3-compatible service.
For browser uploads and downloads, configure a browser-reachable public S3 endpoint when the API and users' browsers reach object storage through different routes.
Smoke-test checklist after installation
After deploying CasePack, verify the workflow:
- 1
Open the CasePack app and sign in as the bootstrap admin
- 2
Confirm the API health endpoint is healthy
- 3
Create or open the first tenant workspace
- 4
Create an incident
- 5
Upload a small evidence file
- 6
Generate an evidence pack export
- 7
Download the export
Operations checklist
For production self-host deployments:
- protect enrollment-code files and runtime passwords
- rotate bootstrap and Keycloak admin passwords after installation
- use HTTPS for app, API, identity, and S3 endpoints
- back up PostgreSQL and object storage together
- back up the API-owned licensing-state volume with the customer data
- keep CasePack images pinned to the tested compatibility set
- monitor API health, object storage capacity, and export job status
Hosted vs self-hosted
| Requirement | Hosted CasePack | Self-hosted CasePack |
|---|---|---|
| Fastest start | Best fit | Possible, but more setup |
| Data residency control | Depends on hosted environment | Stronger control |
| Existing OIDC/Keycloak alignment | Limited/custom | Stronger fit |
| Reference deployment | Managed by CasePack | Single-server Compose / Podman |
| Private object storage | Not required | Supported |
| Security-sensitive clients | Possible | Strongest fit |
Bring the evidence workflow into your own environment
CasePack self-host is designed for MSPs that want a controlled incident reporting stack with PostgreSQL, OIDC, S3-compatible evidence storage, audit history, and exportable evidence packs.
Frequently asked questions
CasePack Self-Hosted Connected is recruiting a private design-partner cohort for the supported single-server Docker Compose / Podman profile.
A typical deployment includes the CasePack web app, CasePack API, PostgreSQL, Keycloak/OIDC, and S3-compatible object storage such as SeaweedFS.
The self-hosting model is designed so teams can use the bundled stack for a fast start or connect to existing PostgreSQL, OIDC, and S3-compatible infrastructure where supported.
Evidence files are stored in S3-compatible object storage and linked to the relevant incident and tenant workspace.
Self-hosting can be a better fit when your MSP or client requires stronger operational control over incident data, evidence files, identity, storage, and deployment location.
Related pages
MSP Evidence PacksTurn scattered incident notes, logs, screenshots, and PSA tickets into client/auditor-ready evidence packs for MSP security incidents.Sample Evidence PackRequest a sample CasePack incident evidence pack and see how MSPs can package timelines, evidence, reports, audit history, and client-ready outputs.NIS2 ReportingHelp MSP teams organize NIS2-style 24h, 72h, and final-report incident evidence workflows with timelines, reports, audit logs, and exports.