Deployment

FIPS-Compliant Deployment

Deploy Deepgram self-hosted with FIPS-capable images for environments that require FIPS 140-3 cryptography.

Deepgram provides FIPS 140-3 self-hosted images for the API, Engine, License Proxy, and Billing containers, plus models encrypted using FIPS-approved algorithms.

Container Images

Use the FIPS variants of the release-260728 images (the -fips tag suffix):

ComponentImage
APIquay.io/deepgram/self-hosted-api:release-260728-fips
Enginequay.io/deepgram/self-hosted-engine:release-260728-fips
License Proxyquay.io/deepgram/self-hosted-license-proxy:release-260728-fips

See the release changelog for the equivalent component versions.

Configuration

Enable FIPS Mode

FIPS mode is set per service. Add the following block to the configuration file of every service you deploy:

1[fips]
2mode = "enabled"

Set it in each of:

  • api.toml (API)
  • engine.toml (Engine)
  • license-proxy.toml (License Proxy)
  • billing.toml (Billing — airgapped deployments only)

The FIPS images do not enable FIPS mode on their own. A service whose configuration omits this block runs OpenSSL in standard (non-FIPS) mode, even on a FIPS image. Confirm each service logs openssl_fips_enabled=true at startup.

Engine Environment Variables

As with any self-hosted Engine deployment, the Engine container requires these NVIDIA environment variables:

NVIDIA_VISIBLE_DEVICES=all
NVIDIA_DRIVER_CAPABILITIES=compute,utility

These are set in your container orchestration configuration. See the reference configs for Docker and Kubernetes.

TLS Certificate

Customers must provide their own full-chain PKI certificate for the API’s HTTPS endpoint.

Models

Your Deepgram account team provides download links for the FIPS-encrypted models compatible with these images. FIPS models use the .dgv2 encrypted file format.

.dgv2 and .dg models are not interchangeable. The FIPS Engine loads only .dgv2 models — it will not load .dg models.

Caveats

TLS 1.3 Only

The FIPS API image enforces TLS 1.3 exclusively. It rejects TLS 1.2 connections outright and rejects non-FIPS cipher suites (such as ChaCha20). Any TLS-1.2-only client, SDK, or proxy in front of the API will fail to connect.

Ensure your entire client stack negotiates TLS 1.3 before cutover.

The [fips] configuration flag does not control TLS behavior. TLS 1.3 enforcement is baked into the FIPS image itself, so disabling the [fips] flag will not restore TLS 1.2 support.

Airgapped (Offline) Deployment

The deployment above reaches Deepgram’s hosted license server through the License Proxy, which requires outbound internet access. If you require running FIPS-compliant self-hosted Deepgram deployments in environments without public internet connectivity, contact your Deepgram account team to inquire about airgapped access, which uses the FIPS Billing image (quay.io/deepgram/self-hosted-billing:release-260728-fips) to run license validation offline.

What’s Next