Infrastructure and security
JetEncode runs in your cloud account. Secure deployment depends on the published image and the identity, network, storage, and lifecycle choices made around it.
Network boundary
Place instances in an appropriate subnet, restrict ingress to trusted sources, and document any required egress by hostname, protocol, and purpose.
The browser UI and HTTP API use TCP port 80. Restrict inbound access to trusted operator and application source ranges.
The base image starts without a licensing or telemetry service. Jobs connect only to the HTTP or object-storage sources and destinations configured by the customer.
Identity and access
Attach a least-privilege workload identity where the provider supports one. Avoid static credentials, broad resource wildcards, and shared operator keys. Separate launch permissions from job-data permissions.
Attach a least-privilege IAM instance role when a job uses Amazon S3. JetEncode must use the role through the AWS default credential provider chain.
Encryption and storage
Enable provider encryption controls for disks and object storage where required, use TLS for network paths, and define temporary-media removal. Distinguish JetEncode behavior from cloud configuration.
HTTP authentication protects application access. Put TLS in front of port 80 for untrusted networks and enable encryption for buyer-created EBS and S3 storage where required.
The AMI default root volume is suitable for evaluation. Increase it for the largest expected source, outputs, and concurrent `/tmp` working sets; keep durable media in object storage.
Instance selection and scaling
Start from a verified instance recommendation, measure representative media, and scale using observed queue time, throughput, CPU, memory, disk, and GPU metrics where applicable.
Start with a current-generation compute-optimized instance with at least 4 vCPUs, then size from representative jobs and expected concurrency.
The AWS edition is CPU-only and does not require or use a GPU.
Throughput varies with source media, output settings, storage paths, instance capacity, and active jobs. Benchmark a representative workload before production.
Plan concurrency and `/tmp` capacity against the EC2 instance and the S3, EBS, networking, and public-IP quotas used by the deployment.
Data residency
You choose the provider region and storage resources. Confirm that inputs, outputs, logs, backups, telemetry, and dependencies meet your residency requirements.
Launch in any Region enabled for the JetEncode Marketplace listing, choosing one that meets your latency, residency, and storage requirements.
JetEncode sends no automatic analytics, telemetry, diagnostics, or customer media to JetEncode.