Run ROSASIS AI yourself

• Node.js 20 LTS or 22 LTS (the package declares >=20.9.0 <23)
• PostgreSQL 14 or newer, reachable from the app
• Optional: Docker Desktop for the PostgreSQL container
• Optional: Google Cloud, Azure, Stripe, PayPal, NOWPayments and OpenAI accounts for those integrations

npm install
copy .env.example .env      # PowerShell
npm run db:migrate
npm run db:seed             # optional demo workspace
npm run dev                 # http://localhost:3000

The demo workspace created by the seed script signs in with demo@rosasis.local / DemoPass123! and contains only labelled demo records.

Local development requires DATABASE_URL and SESSION_SECRET; set DIRECT_URL for Prisma generation and migrations. Production also requires a separate ENCRYPTION_KEY, a public HTTPS APP_URL, DIRECT_URL, and PostgreSQL URLs configured for certificate-verifying TLS. Optional integrations report when their configuration is missing.

AI: OPENAI_API_KEY, OPENAI_MODEL, AI_DAILY_REQUEST_LIMIT. Mailboxes: GMAIL_CLIENT_ID/GMAIL_CLIENT_SECRET, MICROSOFT_CLIENT_ID/MICROSOFT_CLIENT_SECRET. Email delivery: SMTP_*. Payments: STRIPE_*, PAYPAL_*, NOWPAYMENTS_*. See .env.example for the full annotated list.

Queued work (classification, indexing, automations, retention) runs in a worker process:

npm run worker

Alternatively, if JOBS_HTTP_TOKEN is set, a scheduler can call POST /api/jobs/run with a bearer token. Without either, jobs stay queued — the UI shows their state rather than pretending they finished.

• Gmail: OAuth client with redirect URI https://rosasis-ez044snkq-rosasis-ai.vercel.app/api/integrations/gmail/callback
• Microsoft 365: app registration with redirect URI https://rosasis-ez044snkq-rosasis-ai.vercel.app/api/integrations/outlook/callback
• Stripe webhook: https://rosasis-ez044snkq-rosasis-ai.vercel.app/api/webhooks/stripe
• PayPal webhook: https://rosasis-ez044snkq-rosasis-ai.vercel.app/api/webhooks/paypal
• NOWPayments IPN: https://rosasis-ez044snkq-rosasis-ai.vercel.app/api/webhooks/nowpayments

A mailbox is only marked connected after a live API call succeeds.

All authenticated endpoints return { ok: true, data } or { ok: false, error: { message, code, details } }. Sessions are HTTP-only cookies; there is no client-side token to leak.

Public endpoints: POST /api/auth/*, POST /api/chat (rate limited, origin-restricted), GET /api/health and the payment webhooks (signature verified).

Representative plans and limits: Starter (3,000 AI requests/month), Business (20,000 AI requests/month), Enterprise (100,000 AI requests/month).

• Passwords hashed with scrypt; sessions are server-side records with HTTP-only, SameSite cookies.
• Authorization is enforced per route with an explicit permission check; the UI hiding a button is never the control.
• All tenant queries are scoped to the caller’s organization; cross-tenant IDs return 404.
• OAuth tokens are encrypted with AES-256-GCM; the browser never receives them.
• Payment plans activate only from verified webhooks (Stripe HMAC, PayPal verification API, NOWPayments HMAC-SHA512).
• Email and document content is wrapped as untrusted data before reaching a model.
• Uploads are validated by extension and magic bytes and stored outside the web root.

• Dashboard body copy is English; navigation, authentication, marketing and the chat widget are translated into all nine languages.
• Background jobs require the worker process (or the HTTP trigger) to run.
• Without an embeddings key, knowledge retrieval uses a local hashed vector — usable, but not semantic.
• Demo mode blocks outbound email and live payment creation by design.
• No mobile app and no inbound email webhook receiver: Gmail and Microsoft 365 are pulled by sync.

The full list, including anything discovered during testing, is in FUNCTIONALITY_AUDIT.md in the repository.