Deployment Guide

System requirements

File scanning (images, PDFs, Office documents, text files) uses Bleep's built-in engines — OCR with embedded ML models, plus pure Rust PDF and document extractors. No additional software required.

Individual setup

The Individual plan runs as a standalone desktop application. No server or IT infrastructure required.

1. Download the installer from your dashboard (Windows .msi/.exe, macOS .dmg (coming soon), or Linux .AppImage/.deb/.rpm)
2. Run the installer and follow the setup process
3. Sign in with your email (one-time code) or enter your license key directly (format: LIC-XXXX-XXXX-XXXX-XXXX)
4. Install the CA certificate (required for HTTPS inspection of AI traffic)
5. Bleep starts protecting - runs in your system tray

Team deployment

Team plans include a centralized admin server for policy management and monitoring. The admin server runs on your infrastructure via Docker. It uses a local SQLite database — no external database server required. All data stays on your infrastructure.

Admin server setup (Docker)

Set your license key and start the server:

Replace LIC-XXXX-XXXX-XXXX-XXXX with your license key from the Licenses page. The dashboard defaults to port 8081 — override with BLEEP_WEB_PORT if needed.

Direct setup (no Docker)

Run the admin server directly with Python. Use --bind to make it accessible on your network:

By default the server listens on 127.0.0.1 (localhost). The --bind 0.0.0.0 flag makes it listen on all interfaces so other machines can connect. Docker deployments handle this via port mapping.

Open the dashboard at http://YOUR-SERVER-IP:8081. Use the server's LAN IP so employee machines can reach it.

Endpoint deployment

Deploy the endpoint app to team devices using your existing tools (SCCM, Intune, Jamf, etc.) or have users install manually.

• Available as .msi (Windows), .dmg (macOS) (coming soon), .AppImage/.deb/.rpm (Linux)
• Each endpoint requires a license key for activation
• License is bound to the instance on first validation
• Endpoint ports are managed from the admin dashboard and pushed to all devices automatically
• After enrollment, assign devices to tiers (e.g., Engineering, Sales) for role-based policy targeting

Environment variables

Bleep can be configured via environment variables or a YAML config file (config.yaml).

Network configuration

Firewall rules

Bleep needs outbound HTTPS access for license validation and updates:

Local ports

All bind to 127.0.0.1 by default. Use --bind 0.0.0.0 to accept connections from other devices. All ports are configurable.

Only AI traffic is routed through the proxy via PAC-based selective routing. All other traffic goes direct. For team deployments, endpoint ports are managed centrally from the admin dashboard.