Go-live checklist

Everything that must be ready before real client data goes into Rollout. Tick off what you've done; your progress is kept in this browser (nothing is sent to a server) and is shared with the Dutch version of this page.

0 of 35 checked

Database (step 1)

0/5

Supabase project in Frankfurt, on the Pro planDaily backups; no pause after a quiet week.Guide
All migrations up to 0017 appliedWith deploy/migrate.sh or the setup files in the SQL Editor.Guide
bootstrap_admin_email setOtherwise whoever signs in first becomes administrator.Guide
Email sign-in is off
The service_role key is nowhere

Sign-in (step 2)

0/5

Rollout – Login is single-tenantGuide
Assignment required: Yes, only the engineers groupOtherwise anyone in your tenant can sign in.
Azure Tenant URL in Supabase is filled inEmpty = any Microsoft account in the world.
Conditional Access: MFA required
Tested: an account outside your tenant can't get in

Client tenants (step 3)

0/4

Rollout – Readiness has read permissions onlyGuide
Federated credential, no client secret or certificate
GRAPH_ALLOWED_TENANTS only contains your clients
Test connection on a test tenant is green

Hosting and gateway (steps 4 and 5)

0/6

Vercel project in fra1, on the Pro planGuide
check-env.mjs says: Configuratie in orde (configuration OK)
HEALTH_DETAILS=minimal and SECURITY_CONTACT set/.well-known/security.txt shows your reporting address.
Server gateway on: /api/ready shows "gateway": "ok"Guide
Tested: a direct call is refused
ROLLOUT_LICENSE set; the license card is greenGuide

Domain (step 6)

0/4

Domain in Vercel: Valid ConfigurationGuide
APP_URL is the final address
Supabase: Site URL and Redirect URL are right
Entra: redirect URI /toestemming is right

In the app

0/6

Organization created by the administrator; creating is closed after that
Security page: all green (except what's deliberate)Guide
A booking link works in a private window; a made-up link doesn't
Client portal works; after Revoke the link stops working
Teams alerts on, test alert receivedGuide
Sessions: no unexpected rows "Niet via de app" (not via the app)

Organization

0/5

A second administrator with access to Vercel, Supabase, GitHub and Entra
Uptime monitor on /api/ready that calls or texts
Restore test done once (deploy/restore-test.sh)Guide
Audit log head hash stored outside the database
Data processing agreement with the client signed