Set up an Outpost

From an empty machine to the first searchable folder — with the Outpost application for Windows, macOS and Linux.

An Outpost is a machine at your site that makes your documents searchable. You install the Outpost application on it — a program with a user interface, for Windows, macOS and Linux — and point it at folders. The program reads the documents and builds a search index; both stay on that machine.

This installs an Outpost, not Cloud Vault

This page keeps its former URL so existing bookmarks continue to work. The product installed here is the self-hosted Outpost. Cloud Vault is a separate meinGPT service and is not installed on this machine — see Data sources (RAG) for what it is. See the canonical Outpost overview for the product boundary and supported environments.

Only as much leaves as you release

"On-premise" does not mean nothing leaves your network — it means only what you release leaves it. Source files and the search index are not centrally synchronised, but every answer carries at least the matching passage out, or there would be no answer. Exactly how much is decided exclusively per folder on the Outpost by the release level below.

Early access — free to try

The Outpost is in early access. It is usable day to day and we ship quickly — expect frequent updates and expect individual screens to change.

You can walk the whole setup below for free: 100 documents are included. That is a preview, not a plan — it is sized so you can see once that the setup works: pair, release a folder, let it index, search. For production use, talk to us (enterprise@meingpt.com).

What you need

The machine reads your documents and answers search queries. It should stay on: while it is off — or while the Outpost is stopped — its documents cannot be found. meinGPT keeps working; only these sources are missing.


Operating system	Windows 10/11 or Windows Server 2019+ (64-bit), macOS on Apple Silicon, or Linux x86-64 with glibc 2.39+ and libstdc++ providing `GLIBCXX_3.4.31`. Linux is verified on Ubuntu 24.04 LTS and Debian 13. Physical or a VM.
Memory	At least 8 GB RAM and 2 cores. We recommend 16 GB for production and 32 GB for large or OCR-heavy collections. No GPU required.
Disk	About a third of the total size of your documents, at least 10 GB. The search index lives in the application's data folder.
Access to your storage	Local path, UNC path or mount readable by the runtime identity. On Windows, the unattended service accesses domain shares as the computer account `DOMAIN\HOSTNAME$`.
Optional services preview	Only when enabled for your workspace: databases and local MCP servers must be reachable from this machine.
Privileges	On Windows, local administrator rights once for the installation. On macOS you drag the application out of the disk image into your Applications folder — depending on the account, macOS asks for administrator rights while you do. On Linux the AppImage starts without elevated rights. No reboot needed.

There is no database, no container and no runtime to install alongside it. Server, search index and the built-in embedding model are inside the application.

There is no Outpost for Intel Macs

The macOS build runs on Apple Silicon only (M1 and newer). There is no download for a Mac with an Intel processor, and Rosetta does not help here — it translates in the other direction.

Check this before you download: Apple menu → About This Mac. If it lists Chip and an "Apple M…", you are fine. If it lists Processor and an Intel model, use a Windows or Linux machine for this Outpost — the application is the same on all three.

What the firewall has to allow

Two outbound connections, both on port 443. No inbound port, no port forwarding.

Host	Port	Type	Purpose
`bridge.meingpt.com`	443	HTTPS/WSS	The tunnel meinGPT sends search queries through
`app.meingpt.com`	443	HTTPS	meinGPT API and pairing

This list is also in the application

The Outpost prints it on the Connection tab under Network requirements — with a Copy button. That is the most reliable way to hand it to IT: it states what this machine in this version actually needs, including a different meinGPT URL if you run your own instance.

Step 1 — Install the program

Download the application on the prepared machine, not on your own workstation. You find the download in meinGPT under Settings → On-premise → Add Outpost:

System	What you get	What you do with it
Windows	an installer	run it, follow the wizard
macOS	a disk image (`.dmg`) for Apple Silicon	open it, drag the application into Applications
Linux	a verified install command	copy it from meinGPT and run it in a terminal

How you can tell you installed the right thing

The Windows installer is signed with a publicly trusted certificate for SelectCode GmbH; Windows shows the publisher before installing. The macOS application is signed with a Developer ID certificate and notarized by Apple — so it opens on a plain double-click. There is no Gatekeeper block to work around and no right-click detour. On Linux, meinGPT first checks the downloaded bootstrap script against the SHA-256 from its authenticated release response. That script verifies an Ed25519-signed installation descriptor and then the AppImage size and SHA-256 before installing it. The AppImage itself carries no operating-system code signature. The manual AppImage link is therefore a recovery path only: compare the complete SHA-256 shown beside it before starting the file.

Updates are protected on all three systems: the Outpost verifies every update against an Ed25519-signed manifest plus the checksum of the individual artifact. After that it keeps itself current — there is no manual update step.

Step 2 — Pair

On first start the application walks three pages: an overview, an explanation of the connection (the page you can show to IT security) and the pairing.

In meinGPT, under Settings → On-premise → Add Outpost, you give it a name and get an eight-character pairing code. Read it out to whoever is at the machine — they type it in and press Pair. No meinGPT login is needed on the machine, and the code expires.

The pairing step of the setup wizard: one field for the eight-character code from meinGPT

The wizard is only done once pairing succeeds

Finish in the bottom right triggers the pairing when none exists yet — it does not skip it. Without a valid code you cannot get past this page, and that is deliberate: pairing is the one step that can fail on a proxy, a firewall or a certificate. When it does, the page offers a button that runs the network check — see Console & operations.

Create and pair an Outpost

The flow in meinGPT, step by step.

What gets read is decided in the program on the machine, not in meinGPT. The Shares tab holds one list and, above it, one button: Share.

A folder — documents on this machine, or on a share it can reach. The Outpost reads them and makes them searchable.

Services are a separate preview

Databases and local MCP servers only appear when we have enabled the controlled services preview for your workspace. Seeing only folders here is the expected state in the general early access.

You decide about your content, not about our structure — which machinery runs behind it is a question you do not have to answer.

There is no ID to copy any more

Earlier builds required creating a data source in meinGPT first and typing its data source ID into the Outpost by hand. That is gone. The machine reports its folders itself; meinGPT adopts one of them in the next step.

Step 4 — Adopt it in meinGPT

In meinGPT, open Settings → On-premise, click Manage on your Outpost and switch to Shares. What this machine has reported is listed there — with the path, exactly as it is named on the machine.

A folder that has not been adopted yet offers Use as source. You give it a name, and from then on it is a document collection like any other: it is where you control who may find the documents.

This is the split that runs through the whole product:

On the Outpost machine	In meinGPT
which folders and systems are shared	which collections exist and who may see them
which path is behind them	how much an Outpost may release
when reading happens, what was skipped	which Outposts exist and whether they are connected
troubleshooting, rebuilding the search index	who a collection is shared with

The machine decides what exists — meinGPT decides who sees it

The platform cannot create a folder. A folder is bound where someone can see the disk and knows whether they may read it. Conversely, the machine does not decide who finds the documents — that is a permissions question and belongs in the platform.

A folder on this machine

Pick the path, done.

An SMB share

Host, service account, password.

Step 5 — Start it and watch it index

After setup the Outpost is paired but stopped. The status bar along the bottom of the window shows Stopped on the left with a Start button; only after that does it read, index and answer.

Press Start and open your folder under Shares. The row shows when it becomes usable; Processing tracks file discovery, text extraction or OCR, the keyword index and the vector index separately. Source documents names skipped or failed files and their reason.

The console: verify and operate

What the seven areas show, how you verify that it works, and what support needs from you.

How much may leave?

Applies per folder, and the decision is made in the Outpost: Shares → open the folder → "What this folder releases". Not in the web console — the person who binds the folder is the one who knows whether its files may leave the building. The higher level includes everything from the lower one.

Level	Leaves your network	What for
Text only (default)	the matching paragraphs, the file name and the complete text of the documents found	The file itself stays with you.
Original files	everything from “Text only” plus the file itself	People can open the file from a citation and reuse it. For a quote template, the file is the answer.

A third, lower level used to release only individual passages. It is gone: whoever may read one passage can ask a second question for the next one and assemble the document that way — the level cost answer quality and protected nothing. Existing sources still set to it keep working unchanged.

The difference between "Text only" and "Original files" is text versus artifact, not machine versus human — anyone who releases the text can have the assistant read the content back. What "Text only" protects is the form: the layout, the signed PDF, the letterhead.

File system permissions do not travel

Releasing a folder for a data source releases it to everyone allowed to see that data source in meinGPT — including people who could not open it in Explorer or on the share. NTFS, Active Directory and POSIX permissions are not carried over. Check which folder is assigned to which team before you release it.