Skip to main content
Collabase runs entirely on your server. No data leaves your infrastructure. This page explains what is running, how it is connected, and what you need to know to operate it reliably.

​
Services overview

Collabase starts several services when it launches. Each one has a specific role: All services run as isolated processes with restricted permissions. None of them have access to your host system beyond what they need to function.
AI features (CollabaseAI, chat, AI automation) run inside the application and use the AI provider you configure under Settings → AI settings. There is no separate AI service to size or manage.

​
Memory and CPU

The installer checks that your server meets the minimum and starts everything. The 4 GB minimum assumes live collaboration is on, which is the default. The collaboration relay adds roughly 200–500 MB; the rest is the application, database, queue, document processor, and proxy sharing the server. On a 2 GB server, only turn collaboration on if the box has headroom — otherwise turn it off, which brings the minimum back down to 2 GB. To match resources to your team size — and to move the database, uploads, or the application onto separate servers as you grow — see Sizing & scaling.

​
Disk usage

Plan for at least 20 GB of free disk space to start. Monitor disk usage as your team adds content and uploads files.

​
Networking

Collabase listens on two ports: No other ports are exposed to the network. All internal communication between services happens inside an isolated network on your server — nothing is accessible from outside.

​
HTTPS certificates

If you enter a real domain name during installation (e.g. https://collabase.yourcompany.com), Collabase provisions a free TLS certificate automatically using Let’s Encrypt. The certificate renews itself before it expires — no manual action required. If you use an IP address or localhost, a self-signed certificate is used instead. Browsers will show a security warning in this case.

​
Rate limiting

Authentication endpoints are rate-limited to prevent brute-force login attempts. If a single IP address sends too many login requests in a short period, further requests from that address are temporarily blocked. This happens automatically — no configuration is required.

​
Data persistence

All data is stored in named volumes on your server. These volumes survive container restarts, updates, and even full reinstalls of the application files — as long as the volumes themselves are not deleted.
Deleting Docker volumes removes all data permanently. Never run docker volume rm on your Collabase volumes unless you intend to wipe the installation completely.

​
Security model

Collabase is designed for self-hosted, private deployment:
  • All services run as non-root users. If a service is compromised, the attacker cannot access the rest of the host system.
  • Your content stays on your server. Documents, tasks, files, and user data are stored only in your own database and file storage. Product usage statistics are the one exception — see Usage statistics below, including how to switch them off.
  • Authentication endpoints are rate-limited. Brute-force attacks against login are blocked automatically.
  • Security headers are set on all responses. The reverse proxy adds headers that protect against common web attacks (clickjacking, MIME sniffing, etc.).
  • The database is not accessible from the network. It only accepts connections from other services on the same internal network.

​
Updating Collabase

Updates are applied with a single command that handles everything automatically. See Updates for the full procedure.

​
Monitoring your installation

To check whether all services are running:
A healthy installation shows all services with a healthy or running status. If any service shows restarting, check its logs:

​
Usage statistics

Collabase reports how the product is used, so we can see which features are worth improving and what the built-in AI costs to run. This is switched on after installation. What is sent:
  • Which features are opened, and errors the application runs into
  • For every request to the built-in AI: the model used, how long it took, how many tokens it consumed, and whether it failed
  • The text sent to and received from the AI. This is what lets us measure answer quality, and it means excerpts from your pages and tasks can be included whenever someone uses the AI assistant
Nothing else leaves your server. Your documents, files, tasks, and user records are never uploaded.

​
Switching it off

Go to Administration → Feedback & Privacy and turn telemetry off. This stops all reporting immediately, in the browser and on the server alike, including everything about AI requests.
If you operate Collabase under a data processing agreement that does not permit content to be shared with a third party, switch usage statistics off before your users start working with the AI assistant.
Last modified on July 30, 2026