// Use when anyone asks about KoNote hosting costs, deployment options, per-agency pricing, budget scenarios, cost assumptions, managed service model, Azure vs OVHcloud comparison, onboarding costs, or needs to update cost figures. Also use when a new developer or manager needs deployment context.
Use when proposing new features, reviewing code changes, evaluating integration requests, or onboarding to KoNote — checks proposals against Design Rationale Records (DRRs) to identify conflicts with established architectural decisions, rejected anti-patterns, and privacy/security constraints before implementation begins.
Check web pages and code for WCAG 2.2 AA accessibility compliance. Use when the user mentions accessibility, WCAG, a11y, screen readers, colour contrast, keyboard navigation, alt text, or asks to check if something is accessible or usable by people with disabilities.
Generate a beginner-friendly overview of a codebase or project. Use when the user asks to understand a project, wants an overview, is new to a codebase, asks what a project does, or wants to know how code is organised.
Convenes expert panels for problem-solving. Use when user mentions panel, experts, multiple perspectives, MECE, DMAIC, RAPID, Six Sigma, root cause analysis, strategic decisions, or process improvement.
Use when making aesthetic decisions for web interfaces - choosing design direction, color palettes, typography, spacing systems, visual hierarchy, or UI polish. Use when user asks to make something look nicer, improve UX, choose a style, or needs guidance on crafted interface design. NOT for writing implementation code (use frontend-design for that).
Provide clear, personalised explanations of code, concepts, or architecture. Use when the user asks to explain something, wants to understand how code works, asks why something is done a certain way, or says they don't understand something.
| name | deployment-planning |
| description | Use when anyone asks about KoNote hosting costs, deployment options, per-agency pricing, budget scenarios, cost assumptions, managed service model, Azure vs OVHcloud comparison, onboarding costs, or needs to update cost figures. Also use when a new developer or manager needs deployment context. |
Answer questions about KoNote deployment options, hosting costs, and cost assumptions by reading the authoritative source documents listed below. Never guess figures — always read the current file.
/deploy-to-vps insteaddesign-rationale skill instead (it has the full DRR review workflow)konote-ops/deployment/runbook.md directlyEvery agency's participant data is fully isolated. Agencies never share a KoNote instance, database, or encryption key — even when they share hosting infrastructure. Multiple instances can run on the same VPS for cost and operational efficiency, but data never crosses instance boundaries.
This is enforced by:
tasks/design-rationale/multi-tenancy.md)This principle is non-negotiable. Any deployment option that combines participant data across agencies violates PHIPA and KoNote's design rationale. See the design-rationale skill for the full DRR review process.
KoNote supports a range of deployment options, from bare-bones self-hosted to fully managed. All tiers maintain the same data isolation and encryption guarantees — the difference is who manages the infrastructure and what operational support is included.
Who: Nonprofits with technical capacity (or a volunteer/consultant) who want the lowest cost.
What they get: The open-source repo, deployment documentation, and Docker Compose stack. The agency deploys to their own VPS or server, manages their own backups, updates, and monitoring.
Why it's secure enough: KoNote's security is built into the application, not bolted on by the hosting layer:
.env)Cost: VPS hosting + Key Vault (~$17 CAD/mo for OVHcloud VPS-1 + per-agency Key Vault). No LO support fees.
Docs: docs/deploy-ovhcloud.md, docs/deploying-konote.md
Who: Most agencies. LO handles infrastructure; the agency focuses on using KoNote.
What they get: A fully hosted, maintained KoNote instance on OVHcloud Beauharnois (QC). LO provides setup, updates, backups, monitoring, and incident response.
Shared infrastructure, isolated data: Multiple agencies can run on the same bare VPS, sharing:
What is never shared: databases, encryption keys, application instances, participant data.
Cost: ~$96/agency/mo (5-agency network) to ~$67/agency/mo (30-agency network), Year 2+. See hosting-budget-scenarios.md for current figures.
Docs: tasks/p0-managed-service-plan.md, tasks/deployment-protocol.md
Who: Agencies that require or prefer Azure — typically those with existing Microsoft agreements, Azure nonprofit grants, or specific compliance requirements.
What they get: Same KoNote application deployed on Azure VM with Azure-managed PostgreSQL, Azure Key Vault, and Azure Monitor. Higher cost but leverages the Azure ecosystem.
Why choose Azure over OVHcloud:
Trade-off: Azure's parent company (Microsoft) is US-incorporated and subject to the US CLOUD Act. Data is in Canada (Toronto/Canada Central), but the corporate jurisdiction is American. See tasks/design-rationale/data-access-residency-policy.md.
Cost: ~$173/agency/mo (list price) or ~$79/agency/mo (with nonprofit grant). See hosting-budget-scenarios.md.
Docs: docs/archive/deploy-azure.md (archived but still accurate for Azure path)
| Service | Description | Availability |
|---|---|---|
| Penetration testing | Third-party security audit of the agency's KoNote instance | On request, for agencies or networks willing to fund it |
| Evaluation framework setup | CIDS Full Tier configuration with impact model, counterfactuals, and reporting profiles | Per-program, requires evaluation interview (see tasks/deployment-protocol.md Interview 3) |
| Self-hosted LLM | Dedicated or shared Ollama server for AI suggestions and translation | Included in Tier 2; optional for Tier 1/3 |
| Cross-agency reporting | Aggregate reporting dashboard for funder networks (k>=5 cell suppression) | Requires consortium setup; see tasks/design-rationale/cids-privacy-architecture.md |
Files prefixed konote-prosper-canada/ are in a separate repo. Locate it relative to the konote repo (typically ../konote-prosper-canada/ or search for it under the user's GitHub directory). Files prefixed konote-ops/ are in the private ops repo (../konote-ops/).
Read the files relevant to the question. Always start with the source-of-truth for the topic.
| File | Role | What it contains |
|---|---|---|
tasks/hosting-cost-comparison.md | Primary source — component pricing | Azure vs OVHcloud pricing tables, VPS tiers, AI costs, scenarios at 1/5/10 agencies, data sovereignty analysis |
tasks/p0-managed-service-plan.md | Managed service model | What LO provides vs agency, support tiers, deployment protocol summary, scaling plan |
konote-prosper-canada/deliverables/costing-model.md | Detailed scenarios | 5-agency and 30-agency network costing, support hour breakdowns, Azure vs OVHcloud per-agency |
konote-prosper-canada/deliverables/hosting-budget-scenarios.md | Client-facing summary | Polished per-agency tables, onboarding costs, 3-year TCO, funding model options |
| File | How to use |
|---|---|
konote-prosper-canada/deliverables/tools/costing-model-calculator.py | python costing-model-calculator.py — change assumptions at top of file, re-run for updated figures |
konote-prosper-canada/deliverables/tools/costing-model-calculator.html | Open in browser — interactive version with sliders |
| File | Governs |
|---|---|
tasks/design-rationale/ovhcloud-deployment.md | Full OVHcloud stack, 4-layer self-healing, backup strategy, encryption key management, VPS sizing, risk registry |
tasks/design-rationale/multi-tenancy.md | Schema-per-tenant architecture — prerequisite for cost reduction at 5+ agencies |
tasks/design-rationale/data-access-residency-policy.md | Canadian data residency, who can access production, CLOUD Act analysis |
tasks/design-rationale/self-hosted-llm-infrastructure.md | Self-hosted LLM costing (Ollama + Qwen on shared VPS), why not cloud AI APIs |
| File | Purpose |
|---|---|
docs/deploy-ovhcloud.md | Step-by-step OVHcloud VPS deployment (16 steps, 45-90 min) |
docs/deploying-konote.md | General deployment overview |
docs/deploy-dev-vps.md | Dev/demo VPS setup |
docs/llm-deployment-guide.md | Self-hosted LLM (Ollama) deployment |
docs/archive/deploy-azure.md | Azure deployment (archived — for reference only) |
| File | Purpose |
|---|---|
tasks/deployment-protocol.md | 5-phase onboarding: Discovery -> Permissions -> Infrastructure -> Customisation -> Go-Live -> 30-Day Check-In |
tasks/deployment-workflow-design.md | Workflow design for deployment process |
tasks/saas-service-agreement.md | SaaS agreement template (required before first managed agency) |
| File | Purpose |
|---|---|
konote-ops/deployment/runbook.md | Deployment runbook, troubleshooting, checklists |
konote-ops/deployment/vps-migration-runbook.md | VPS migration procedures |
konote-ops/deployment/hardening-guide.md | VPS security hardening |
konote-ops/deployment/update-checklist.md | Update verification checklist |
konote-ops/deployment/env-template.md | Environment variable reference |
Cost data flows upstream to downstream. When updating any cost file, reconcile from upstream first.
tasks/hosting-cost-comparison.md <-- PRIMARY SOURCE (component pricing)
|
v
tasks/p0-managed-service-plan.md <-- managed service model
|
v
konote-prosper-canada/deliverables/costing-model.md <-- detailed scenarios
|
v
konote-prosper-canada/deliverables/hosting-budget-scenarios.md <-- client summary
konote-prosper-canada/deliverables/tools/costing-model-calculator.* <-- calculator
Each file has a <!-- COST_VERSION --> header. Before updating, compare key values across the chain. If values don't match, reconcile upstream first, then cascade downstream.
Cross-repo constraint: konote and konote-prosper-canada cannot be updated in the same session. Note in the commit message which downstream files need updating.
| Network size | OVHcloud | Azure (list) | Azure (nonprofit grant) |
|---|---|---|---|
| 5 agencies | ~$96/agency | ~$173/agency | ~$79/agency |
| 30 agencies | ~$67/agency | ~$144/agency | ~$50/agency |
Key Vault is $2/agency/month (per-agency vault, not shared). These figures include Key Vault in the per-agency hosting cost.
These figures change. Always read hosting-budget-scenarios.md for current numbers.
Read tasks/design-rationale/ovhcloud-deployment.md for the full analysis. Summary:
Read the COST_VERSION header in tasks/hosting-cost-comparison.md for current values. Key assumptions:
One-time per agency: $800-$2,200 depending on size. See hosting-budget-scenarios.md Section "One-Time Onboarding Costs".
tasks/hosting-cost-comparison.md (the primary source)python konote-prosper-canada/deliverables/tools/costing-model-calculator.py to regenerate figuresp0-managed-service-plan.md -> costing-model.md -> hosting-budget-scenarios.mdCOST_VERSION date in each updated file