Runs on your servers,
under your control
Ace HR is a standard Node.js application backed by PostgreSQL. If your team can run a web app, you can run this — and if you would rather not, installation is available as an add-on.
What you need
- Server
- Any Linux host that can run Node.js 20+ — a 2 vCPU / 4 GB VM is comfortable for most organizations
- Database
- PostgreSQL 14 or newer, managed or self-hosted
- Storage
- Optional object storage (S3-compatible or Cloudinary) for employee photos and documents
- Optional SMTP or transactional email provider for invitations and password resets
- TLS
- A domain and certificate — any reverse proxy you already use will do
- Backups
- Your existing PostgreSQL backup routine covers Ace HR entirely
From licence key
to first login
The full installation documentation ships with the licence. This is the shape of it.
- 01
Purchase and receive your licence
You receive a licence key, the full source, and access to the release channel for updates.
- 02
Provision a server and database
A single small VM is enough for most organizations. Point Ace HR at your own PostgreSQL instance — managed or self-run, whichever you already use.
- 03
Configure your environment
Set your database URL, JWT secret, and optionally an email provider for transactional mail and object storage for employee photos.
- 04
Run migrations and seed your first admin
One command applies the schema, another creates the initial super-admin account. There is no public sign-up endpoint to lock down afterwards.
- 05
Invite your team
Sign in, create departments, invite employees by email, and they set their own passwords. You are running.
Would rather we did it?
Installation & Setup is Free included with every licence. We deploy it, configure it, and hand it over running.
Running it is the easy part
and it stays that way
Self-hosting only pays off if the ongoing operation is boring. This is what that looks like.
Upgrades happen on your schedule
New releases arrive through the release channel while your support is current. You decide when to apply them — nothing is pushed to your server, and no upgrade happens during your payroll run because a vendor scheduled it.
Backups are your existing routine
All state lives in PostgreSQL, plus whatever object storage you configure for photos and documents. If you already back up a Postgres database, Ace HR is covered by the same job.
The perimeter is yours
Put it behind your VPN, restrict it to your office network, or expose it publicly behind your usual reverse proxy — the deployment topology is entirely your decision, not a vendor's.
What the application does
inside your perimeter
- Short-lived access tokens with rotating refresh tokens held in httpOnly cookies
- Server-side session revocation on logout — not just a cleared browser key
- Passwords hashed with bcrypt; reset tokens are single-use and expiring
- Rate limiting on authentication, and security headers applied globally
- No public registration endpoint — accounts are only created by an administrator
- Errors never leak stack traces or internal detail in production responses
Have a question about your environment?
Unusual database setup, an air-gapped network, a compliance requirement we should know about — tell us and we will give you a straight answer before you buy.
We will tell you if Ace HR is the wrong fit. That is cheaper for both of us.