Deployment and release readiness
Move from a development evaluation to an approved operational integration.
Deployment modes
CEBS ID Secure is available in cloud, on-premise and hybrid deployment modes across SENSE, GUARD and SHIELD. Choose the infrastructure model independently from the edition that fits your document workflow.
| Mode | Operating model | Plan with your team |
|---|---|---|
| Cloud | Host the application and supporting components in a cloud environment. | Cloud account ownership, hosting region, access boundaries, monitoring and recovery. |
| On-premise | Deploy within your organization infrastructure. | Network access, local asset delivery, capacity, upgrades and operational ownership. |
| Hybrid | Combine cloud and on-premise components in an agreed architecture. | Component placement, data movement, connectivity, credentials and failure recovery. |
Browser-local OCR describes where document processing runs; it does not require a particular hosting model. The current hosted Test Studio demonstrates browser-local processing. It is not a cloud OCR API, and selecting a deployment option does not automatically provision infrastructure or activate a production license. Agree data residency, retention, responsibilities and any service integrations for the chosen architecture.
Hosting model
Host the SDK and model assets on the same origin as your application. Keep the complete versioned directory and license notices together. A browser-local deployment still needs a protected application session, secure result handling and a separate authorization decision.
HTTPS and runtime headers
| Control | Requirement |
|---|---|
| Transport | HTTPS for remote camera capture. Use valid certificates and verify renewal. |
| Runtime MIME types | Serve JavaScript and module files as JavaScript, WebAssembly as application/wasm and images using the correct image type. |
| Worker isolation | Use compatible opener and embedder policies when enabling supported multi-threaded execution. |
| Content security policy | Allow only required same-origin assets and worker sources. OpenCV function construction requires a narrowly scoped OCR worker policy. |
| Cache and upgrades | Version runtime assets, validate hashes and avoid mixing files from different builds. |
| Embedding | If embedding capture, explicitly authorize camera use on the intended origin and test the complete permission flow. |
Data handling
Decide where captures and extraction results are held, who can access them and when they are removed. Browser-local OCR does not grant consent or a lawful basis to process identity documents. Keep sensitive information out of logs and browser persistence unless your approved application policy requires it. Review privacy and contractual requirements for each market.
Release checklist
- Confirm supported documents, languages and representative physical devices.
- Exercise first load, warm load, camera denial, interruption, rescan and tab-background recovery.
- Measure latency and extraction accuracy on authorized samples with independent ground truth.
- Verify role boundaries, session expiry, password recovery and email delivery to a real inbox.
- Confirm commercial licensing, target origins, security review, data retention and support responsibilities.
- Verify monitoring, backups, restoration and application rollback.
- Keep originality and fraud outcomes unavailable or inconclusive until the required models and evidence architecture are independently qualified.
Production review
Engineering checks on this portal do not qualify document authenticity or fraud detection. Request CEBS review with the intended edition, deployment, markets, volume and test evidence. Production entitlements and registration authorization remain separate controlled decisions.