Customer-owned deployment

Run HeyAI inside your Azure subscription

Private Azure Deployment is for teams that want HeyAI's User Story analysis, test intelligence, and RBT workflow without storing project data in HeyAI-hosted infrastructure.

Download private package See install steps Request setup review

Customer owns

API and UI resources
PostgreSQL database, vectors, and embeddings
Azure DevOps connector credentials
Azure OpenAI or OpenAI keys
Logs and diagnostics

How users choose it

Presented as a data mode during project initialization

In HeyAI, users choose a security/data mode before connecting project data. Private Azure Deployment is the choice for enterprise teams that need a customer-owned data plane.

Choose Private Azure Deployment

The Initialize Project wizard explains that no project data will be imported into hosted HeyAI.

Deploy HeyAI in Azure

The customer runs the Bicep and PowerShell package with their Azure identity and subscription.

Connect project sources

Azure DevOps, Git, docs, tests, and other project data connect to the customer's private HeyAI API.

Install the ADO extension

The Azure DevOps extension is packaged with the customer's private UI and API URLs.

Architecture

Same HeyAI product, customer-owned Azure data plane

HeyAI ships versioned API, UI, database migration, and extension artifacts. The customer deploys them into their subscription and controls when updates are applied.

UserHeyAI UI and Azure DevOps extension

Customer AzureApp Service API, Static Web App, Key Vault, PostgreSQL, App Insights

AI providerCustomer Azure OpenAI deployment or customer OpenAI key

Project systemsAzure DevOps, repos, docs, tests, pipelines, incidents

Install path

What the customer runs

Customers do not need repository access. Download the private deployment ZIP, unzip it, and run the included Bicep and PowerShell scripts with Azure CLI access. The ZIP includes the deployable HeyAI API package, static UI files, database SQL, and deployment scripts.

Download heyai-private-deploy.zip

1. Download and unzip

Download heyai-private-deploy.zip, unzip it on an admin workstation or build agent, then open PowerShell in the unzipped folder. The customer does not need HeyAI source code.

Expand-Archive .\heyai-private-deploy.zip -DestinationPath .\heyai-private-deploy
cd .\heyai-private-deploy

2. Prepare Azure

Create or select a subscription, choose regions, confirm Azure OpenAI or OpenAI access, and decide whether a DBA admin IP should be temporarily allowed.

3. Deploy infrastructure

.\private-deploy\scripts\deploy-private.ps1 `
  -ResourceGroupName "rg-heyai-private" `
  -EnvironmentName "prod" `
  -AiProvider "azure_openai" `
  -AzureOpenAiEndpoint "https://contoso-openai.openai.azure.com" `
  -AzureOpenAiDeployment "heyai-gpt"

4. Apply database schema

.\private-deploy\scripts\migrate-db.ps1 `
  -PostgresServerName "<postgres-server-name>"

5. Deploy API and UI

These commands deploy the compiled API ZIP and static UI files already included in the release bundle.

.\private-deploy\scripts\deploy-api.ps1 `
  -ResourceGroupName "rg-heyai-private" `
  -ApiAppName "<api-app-name>"

.\private-deploy\scripts\deploy-ui.ps1 `
  -ResourceGroupName "rg-heyai-private" `
  -StaticWebAppName "<static-web-app-name>" `
  -ApiBaseUrl "https://<api-app-name>.azurewebsites.net"

6. Validate deployment

.\private-deploy\scripts\validate-private-deploy.ps1 `
  -ApiBaseUrl "https://<api-app-name>.azurewebsites.net" `
  -UiUrl "https://<static-web-app-host>"

7. Package the Azure DevOps extension

.\private-deploy\scripts\package-ado-extension.ps1 `
  -HeyAiUrl "https://<static-web-app-host>/app.html" `
  -ApiBaseUrl "https://<api-app-name>.azurewebsites.net"

Security posture

Designed for enterprise review

The first private package prioritizes transparency and customer control. Customers can inspect the Bicep, scripts, app settings, and migration steps before deployment.

No HeyAI-hosted project data

Project context, embeddings, vectors, generated intelligence, connector credentials, and logs stay in the customer's Azure resources.

Customer-owned AI keys

Azure OpenAI is recommended. Standard OpenAI is supported as a fallback. Keys are stored in customer Key Vault.

No telemetry by default

Private deployment does not send project data or diagnostics back to HeyAI unless the customer explicitly exports information for support.

Customer-pulled updates

HeyAI publishes versioned artifacts. The customer reviews and applies API, UI, extension, and migration updates when approved.

Auditable database changes

Schema updates are script-driven and explicit. The API does not silently apply private deployment migrations on startup.

Delete by deleting resources

Customers can remove private deployment data by deleting the customer-owned resource group or following their internal retention process.

MCP and private data

Hosted MCP is not enabled for private deployment data

The hosted HeyAI MCP endpoint is designed for hosted HeyAI projects. Private Azure deployments should not route customer-owned project data through hosted MCP. Customers that need Copilot or agent access to private HeyAI data should deploy a customer-owned MCP service in their Azure subscription.

Current private package

The v1 private deployment package deploys API, UI, PostgreSQL, Key Vault, monitoring, database scripts, and the Azure DevOps extension. It does not deploy MCP runtime yet.

Recommended enterprise path

Add a customer-owned MCP App Service that calls the private HeyAI API and uses the customer's Entra app registration and tenant policy.

Hosted MCP docs

For hosted HeyAI users, use the public MCP setup page and endpoint.

Read hosted MCP setup

Future private package update

Private MCP should add Bicep resources, deployment scripts, app settings, validation checks, and customer Entra instructions before it is bundled.

Common questions

What enterprise users usually ask

Does HeyAI support access exist by default?

No. The private deployment is customer-operated. Support starts from customer-shared diagnostics or a customer-approved access path.

Is this Azure Marketplace managed app?

Not in v1. The first package is Bicep plus scripts so security teams can inspect and run it directly.

Can this run with private endpoints later?

Yes. The first template uses secure public endpoints. A VNet/private endpoint template is a planned enterprise hardening path.

How do updates work?

Customers pull approved HeyAI releases, run migration scripts, deploy API/UI artifacts, and update the extension when needed.

Ready for a private review?

Bring HeyAI to your Azure subscription

We can walk your Azure admin, security reviewer, and ADO owner through the package and first deployment path.

Request private deployment review