Self-Managed Azure Deployment of Parsewise
For organizations that cannot send documents to a vendor-hosted service, Parsewise offers a self-managed deployment that runs entirely inside your own Azure subscription. All documents, extracted data, and model inference stay within your tenant. Parsewise supplies the software, infrastructure-as-code, and updates; your team controls the environment.
This page covers the architecture, data boundaries, licensing, and procurement path for the Azure self-managed option. For the full picture of deployment models (managed cloud, VPC, on-premises), see VPC and On-Premises Deployment Options.
What Stays in Your Tenant
Everything. The self-managed deployment is designed so that no customer data leaves your Azure subscription:
- Documents and extracted data are stored in your own Azure Blob Storage and Azure Database for PostgreSQL.
- Model inference runs against your own Azure OpenAI / Azure AI Foundry deployment. Parsewise supports an Azure-only model mode, so extraction and reasoning never call external LLM providers.
- Networking is private. Services run in private subnets with private endpoints and private DNS. No public endpoints are required for processing.
- No phone-home. The platform does not require a connection back to Parsewise to operate (see licensing below).
Architecture
The deployment is delivered as infrastructure-as-code (Terraform/OpenTofu modules) targeting standard Azure managed services:
| Function | Azure service |
|---|---|
| Application compute (API, workers, frontend) | Azure Container Apps |
| Database | Azure Database for PostgreSQL Flexible Server |
| Cache and task queue | Azure Cache for Redis |
| Document storage | Azure Blob Storage |
| Secrets | Azure Key Vault |
| Container images | Your Azure Container Registry (ACR) |
| Logs and monitoring | Azure Log Analytics |
| LLM inference | Your Azure OpenAI / Azure AI Foundry deployment |
Service-to-service authentication uses Azure managed identity throughout, so there are no static credentials to rotate. Ingress and egress rules, VNet topology, and region selection are under your control.
Updates work through your container registry: Parsewise builds and tests images, publishes them to your ACR, and a Terraform apply performs a zero-downtime rolling deployment with automatic database migrations. Updates can run through your own DevOps tooling or a shared pipeline.
Licensing: Offline and Degrade-Safe
Self-managed installs are activated with a cryptographically signed offline license key supplied by Parsewise and stored as a secret in your Key Vault.
- Stateless verification. The license is verified locally from the signed key at request time. There is no license server, no phone-home, and no periodic revalidation, so the deployment works in restricted-egress environments.
- Degrade, never destroy. If a license expires, the platform blocks only new document processing. Existing projects, extracted results, exports, and administration remain fully accessible, and no data is ever deleted. Renewal warnings begin 30 days before expiry.
- Simple rotation. Renewing is a secret update and restart, with no downtime for stored data.
Procurement: Microsoft Commercial Marketplace
Parsewise is available through the Microsoft Commercial Marketplace. Enterprise customers purchase via a privately negotiated Marketplace offer, which means the transaction runs through your existing Microsoft billing relationship and standard Azure procurement processes rather than a new vendor onboarding cycle.
To receive the private offer for your organization, contact sales. The offer activates automatically on acceptance, and deployment can begin immediately afterwards.
Security Posture
The self-managed deployment inherits the platform’s security controls and adds tenant-level isolation:
- Encryption at rest (AES-256, Azure-managed or customer-managed keys) and in transit (TLS 1.2+).
- Private networking with no public endpoints, private DNS zones, and configurable egress.
- SSO via your identity provider, including Microsoft Entra ID, with role-based access control.
- No training on customer data, under any deployment model.
- Auditability. Full application audit trails plus your own Azure activity logs, Log Analytics, and SIEM integration.
Parsewise’s platform certifications (SOC 2 Type II, GDPR) are covered in the Trust Center overview; in a self-managed deployment, infrastructure controls operate under a shared responsibility model since the environment is yours.
When to Choose Self-Managed Azure
Choose self-managed Azure when:
- Policy or regulation requires documents and model inference to remain inside your own cloud tenant
- Your organization has Azure OpenAI capacity and wants LLM traffic to stay on it
- Procurement strongly prefers buying through the Microsoft Marketplace
- You want vendor-supported software with customer-controlled infrastructure
Choose the managed cloud service when:
- You want zero infrastructure ownership and the fastest path to production
- Parsewise’s standard security posture (SOC 2 Type II, GDPR, encryption, no-training policy) satisfies your compliance requirements
Both models run the same platform: the Parsewise Data Engine, Navi, extraction agents, and the full API surface.
Frequently Asked Questions
Does any document data leave our Azure subscription?
No. Documents, extracted data, and metadata are stored in your Blob Storage and PostgreSQL instance, and model calls go to your own Azure OpenAI / AI Foundry deployment. The license check is local and does not transmit data.
Which LLMs does the self-managed deployment use?
It runs in an Azure-only model mode against your Azure OpenAI / Azure AI Foundry deployment, using current Azure-hosted model families. Model selection is configurable per deployment.
How do upgrades work?
Parsewise publishes tested container images to your Azure Container Registry. Applying the updated infrastructure-as-code performs a zero-downtime rolling deployment, including database migrations. You control when upgrades happen.
What happens if our license lapses?
New document processing pauses until the license is renewed. Nothing is deleted: existing projects, results, exports, and administration remain available throughout.
Can we buy through the Microsoft Marketplace?
Yes. Parsewise is sold through the Microsoft Commercial Marketplace as a privately negotiated offer. Contact sales to have the offer extended to your tenant.
Ready to see Parsewise in action? Request a demo or contact sales to discuss your use case.