Deployment
How Conclave runs in production — Phala TEE CVMs and a TLS-passthrough ingress.
Production runs on Phala dstack TEE (Intel TDX). Each service runs in its own confidential VM; encryption keys are sealed to the measured enclave and survive redeploys.
Topology
| Component | Where |
|---|---|
| Conclave — API + Redis + capture + ingress | Phala CVM |
| VFTEE — voice identity | Phala CVM (reached only by Conclave) |
| Post-pass worker (TD) | External GPU box |
| Dashboards | Vercel |
In-person WebSockets
Long-lived recording WebSockets are held open through a TLS-passthrough ingress
(wss://capture.conclavehq.org → an in-CVM HAProxy that terminates a browser-trusted certificate).
That ingress is what survives the gateway's connection recycling.
Engine
Diarization is our own diart (live) + TD (our trained GPU post-pass model); a managed engine (Deepgram) is a temporary fallback while we scale our own models on TEE GPUs. Engine selection is flag-gated.
Deploys run from CI; database migrations apply automatically on boot. See Status for what's live.