Install in Azure
Run Isomer in your own Azure subscription as a managed application: your data, network and keys stay in your tenant while Isomer operates the platform.
Isomer is available as an Azure managed application. The platform runs in a subscription you own, in your Entra tenant, and Isomer operates it: updates, monitoring and support. Your claim data, documents and databases never leave your subscription.
Most of an install is preparation you do once in your own Azure tenant. The install itself is a Marketplace wizard that takes under an hour.
What gets deployed
The install creates one managed resource group in your subscription, in East US 2, holding:
| Component | Azure service |
|---|---|
| Application and workflow engine | Azure Kubernetes Service, with host-encrypted node disks |
| Databases | Azure Database for PostgreSQL flexible server |
| Cache | Azure Managed Redis, in East US |
| Documents and email | Azure Storage |
| Secrets | Azure Key Vault |
| Container images | Azure Container Registry |
| Document understanding and AI | Azure AI Foundry and Document Intelligence |
| Monitoring | Log Analytics and Azure Monitor, plus monitoring inside the cluster |
| Network | A virtual network with private endpoints for the data services, and a NAT gateway for outbound traffic |
Everything else runs in East US 2, but Azure often has no Managed Redis capacity there, so the cache is created in East US, East US 2's paired region. It stays in the install's managed resource group and is reached only through a private endpoint in the install's virtual network.
The data services are reached over private endpoints inside the install's virtual network. Infrastructure costs appear on your Azure bill like any other resource.
Private or public access
You choose how your users reach the platform when you install.
Private. The platform is reachable only from your network. You peer your network with the install's, add DNS records in your own DNS, and supply the TLS certificate for the hostnames you choose. This is the mode for most enterprise installs.
Public. The platform is published on Isomer hostnames through an outbound-only Cloudflare Tunnel: nothing in your subscription accepts inbound connections from the internet. No peering, DNS or certificate work is needed on your side.
In both modes Isomer serves the web app and sign-in at your own address under isomer.ai. With private access, the web app calls your API from the user's browser, so it works only in browsers inside your network that trust your certificate authority.
Who does what
| You | Isomer | |
|---|---|---|
| Provide the subscription, quota and network range | ✓ | |
| Run the install wizard | ✓ | |
| Peer your network and add DNS records (private access) | ✓ | |
| Supply the TLS certificate and its renewals (private access) | ✓ | |
| Sign-in, the web app and user accounts | ✓ | |
| Platform configuration, releases and updates | ✓ | |
| Monitoring, alerting and incident response | ✓ |
The managed resource group is locked against changes from your side, so the platform stays in the state Isomer operates and supports. The one exception is network peering, which private access needs. You keep read access to everything in it.
How an install goes
Send Isomer your details
Your subscription and access mode, and for private access your hostnames and network range. See Before you install.
Prepare your subscription
While Isomer sets up its side: register host encryption, request quota and, for private access, get your certificate.
Isomer confirms you're ready
Isomer adds your subscription to the private plan, so the offer appears in your Azure Marketplace under Private plans, and sends you the organization name to enter in the wizard.
Install from the Marketplace
Under an hour. See Install from the Marketplace.
Isomer completes setup
Sign-in, configuration and the first release of the platform.
Connect your network (private access)
Peering and DNS. See Connect your network.