Vercel
Next.js and public assets
Pages, SSR, PWA, and static resources. NEXT_PUBLIC variables are set at build time; private clinical files never belong here.
Platform architecture
Where every service runs after deployment
Choose a scenario, select a component, and inspect its placement, data, connections, and operational owner.
Next.js separated from APINestJS + FFmpegPostgreSQL + private disk
Interactive topology
Request and data paths
Select a node. Connected services remain highlighted while its responsibilities and flows open alongside the map.
Recommended
The web app runs on Vercel while the API, FFmpeg, and private media run on a container host with persistent storage. PostgreSQL is managed separately.
Public boundaryApplicationData and providers
The API controls private data and external integrations
SQL/TLS ↔
private I/O ↔
URL signature →
SMTP →
invoice + webhook ↔
Web Push →
Application runtimeData storeExternal providerSensitive data
Critical separation
What can run on Vercel — and what cannot
The boundary follows process duration, secrets, and durable-storage needs rather than programming language.
Separate runtime
NestJS, FFmpeg, and private disk
The API needs long-running processes, stable outbound connections, FFmpeg/ffprobe, and a quarantine volume: use a container or VPS.
Data boundary
PostgreSQL separated from compute
A managed database simplifies backups, upgrades, and recovery. With Compose, its data must live in a persistent volume.
Launch order
How the platform is deployed
Each lower layer must be ready before its dependants start.
- 1
Database, disk, and secrets
Provision PostgreSQL, persistent media storage, domains, TLS, and production secrets.
- 2
API and migrations
Start the API container; it validates configuration and applies migrations under an advisory lock.
- 3
Build and publish the web app
Build Next.js with final NEXT_PUBLIC_SITE_URL and NEXT_PUBLIC_API_URL values.
- 4
Verify every flow
Check health, CORS/cookies, email, payments, video, backups, and recovery.
Before production
What must remain disabled for now
Clinical-media and DICOM uploads must not open until the de-identification profile, malware scanning, retention policy, and incident procedures are accepted. Transcoding is implemented, but it does not replace those safeguards.