FACEIO On-Premises Deployment
Run FACEIO with PixLab Insight on infrastructure you control for private biometric hash processing, data residency, DNS/TLS control, REST API access, and webhooks.
Use the FACEIO Console to request access and review server, DNS, TLS, and integration requirements with the support team.
Self-Hosted Facial Authentication
A private deployment path for organizations with strict infrastructure and security requirements
FACEIO On-Premises includes PixLab Insight as the facial recognition engine and allows organizations with restrictive IT policies, data residency requirements, or tighter infrastructure integration needs to run the complete recognition layer on their own servers. Biometric hashes and recognition data are processed and stored within the customer-controlled deployment and do not leave its servers.
The on-premises option is intended for organizations that need a private facial authentication system while keeping the developer workflow close to the standard FACEIO integration. Application teams can start from the Getting Started guide, implement the browser flow with the fio.js integration guide, protect deployments with the security best practices, plan user controls with the privacy best practices, and connect backend processes through FACEIO webhooks.
This page summarizes what the deployment includes, the server requirements, and the DNS/TLS configuration work needed before the FACEIO Widget and API routing service can communicate with your installation.
Important Note
FACEIO On-Premises is intended for established organizations that require private infrastructure. Teams that do not need to operate the recognition layer themselves can use the FACEIO cloud plans ↗. The FACEIO Console manages application settings and Facial IDs, while the selected facial recognition engine manages biometric hashes.
Implementation Path
Prepare the standard FACEIO application flow first, then deploy the recognition layer inside your infrastructure after your security, privacy, and operations teams approve the environment.
1. Prepare the App Flow
Use Getting Started and the Integration Guide to map enrollment, authentication, callbacks, and frontend behavior before the deployment request.
2. Review Controls
Align consent, deletion, account recovery, domain restrictions, and backend verification with the privacy and security best-practice guides.
3. Request Deployment
Use the FACEIO Console ↗ or support channels to review server requirements, DNS/TLS setup, and integration assistance.
Features & Advantages
FACEIO On-Premises gives teams control over infrastructure, deployment boundaries, server sizing, DNS, and TLS while retaining the standard FACEIO enrollment and authentication workflow. Before launch, review application-level notices and deletion workflows in privacy best practices, then secure the deployment using security best practices.
- Private biometric hash processing with PixLab Insight. Biometric hashes and recognition data are processed and stored within the customer-controlled deployment environment.
- User enrollment capacity sized by your server resources**
- Facial authentication handled by your deployment environment
- FACEIO Widget instantiation routed to your configured installation
- Access to FACEIO REST API endpoints for the deployed environment
- TLS-encrypted browser and API traffic***
- Automated installation wizard and deployment package
- Webhooks and documented security options
- Deployment package updates and fixes under the applicable support terms
- Priority email and integration support
- Telemetry removed from the on-premise package
FACEIO On-Premises uses PixLab Insight as its facial recognition engine. Refer to the Facial Recognition Engine section for additional information.
**Bounded by your server capacities. Refer to the requirements below.
***You must install your own TLS certificates for each hostname where the solution is deployed.
System Requirements
The On-Premises version of FACEIO can be deployed on bare metal servers, CPU or GPU-enhanced machines, modern virtual environments such as VMware, or managed instances from cloud vendors including AWS, Google Cloud, Azure, and OVH.
The table below lists the minimum technical requirements for deploying FACEIO on your own infrastructure. Actual sizing depends on concurrent enrollment, authentication volume, the application workflow described in the Integration Guide, and the facial recognition engine selected for the installation.
Technical Requirements
Deployment Instructions
When you request On-Premises deployment for your application through the FACEIO Console ↗, the deployment package includes the components required to install, configure, update, and operate the self-hosted facial authentication service. If your team has not implemented FACEIO before, start with Getting Started and the Integration Guide so the frontend and backend flow is clear before infrastructure work begins:
- Precompiled binary packages for deployment
- Download tokens for updates
- Automated installation wizard
- Installation instruction PDFs
- Commercial License Agreement
- Email contacts for technical and integration assistance
Configure DNS & TLS Certificates
After deployment on the target server(s), you must install your own TLS certificates, register the hostname linked to the running server, and update the package configuration accordingly. The automated wizard installation script shipped with the deployment package guides you through this configuration process. If you have deployed on more than one server, install the certificates on each server where the solution is deployed. Treat DNS, TLS, firewall rules, and backend access controls as part of the production checklist documented in security best practices.
The section below explains the TLS certificate configuration for a FACEIO on-premise installation. Configuration generation is automated: provide the certificate paths, the fully qualified domain name linked to the running machine, and the other values requested by the installation script.
What You'll Need
1. Your Server Certificate
This is the certificate issued by the certificate authority for your domain. Use a certificate trusted by the browsers that access your application; a self-signed certificate requires explicit trust configuration on every client.
2. Your Intermediate Certificate
These files allow browsers to validate the issuing certificate authority. There may be more than one intermediate certificate. If your certificate was delivered in a ZIP archive, it may include the intermediate certificates, also called a CA bundle.
3. Your Private Key
This file should be on your server or in your possession if you generated your CSR from an external generator tool.
Configure the WebSocket Service
Once the TLS certificate is deployed on the target server, adjust the package WebSocket configuration accordingly:
-
The main configuration file is named
fioconfig.jsonand is usually located in the root directory where the On-Premises solution has been deployed. The default path is typically/usr/local/share/fio/, or the directory selected during installation. - The automated installation and configuration script performs the required changes to your configuration file after you provide the TLS certificate locations.
- A fully qualified domain name (FQDN) linked to the machine where the solution is deployed is required so the On-Premises package can register with the FACEIO Widget and API routing service.
Request FACEIO On-Premises Access
Open the FACEIO Console to submit your request. The support team then reviews your infrastructure, DNS, TLS certificate, and integration requirements with you.