What you need in front of you
Two install profiles - pick one before step 1
Standard (self-updating). Prism updates itself by replacing its own program folder: it renames Prism\ to Prism.old\, moves the new build into place, and relaunches. That requires a dedicated root the service account can write to - not Program Files. Your data lives in a sibling folder that updates never touch:
Hardened (managed environments, Prism 1.97+). If AppLocker / WDAC policy is the reason you are reading this, run the opposite layout: the application goes under C:\Program Files\Prism, admin-owned and read-only to the service account (read + execute), and every writable path moves elsewhere via one environment variable:
In this profile Prism cannot modify its own executable code: self-update is off, and the apply path detects the read-only program folder before it downloads anything and refuses with a clear "managed install" message rather than failing halfway. No AppLocker path exception or endpoint-protection exclusion is needed - Program Files is already covered by default allow rules. Updates become a change-controlled admin action: download the new build from phrizm.com/downloads, verify it against the SHA-256 published there for that release, replace the folder as admin, restart the service. The data folder never participates.
Seven steps
Create the folder
Make C:\Prism and grant your service account Modify on it. That single permission is what lets Prism update itself later.
Verify the download, then extract
Every release publishes the SHA-256 of its archive at phrizm.com/versions.json. Check it before you run anything - it takes ten seconds and it is the only way to know you have what we shipped.
Extract so that Prism.exe lands at C:\Prism\Prism\Prism.exe.
Expect a SmartScreen prompt, and allow the binary
Prism.exe is not yet code-signed. On a managed machine that means SmartScreen will warn, and in an AppLocker or WDAC default-deny estate it will be blocked until you allow it. We would rather you read that here than discover it at 5pm.
Allow it by path (C:\Prism\*) or by the published SHA-256, and add the same path as an exclusion in your endpoint protection - self-extracting Python bundles are a common heuristic false positive. Signed builds are on our roadmap; when they land, the publisher rule replaces the path rule.
Put the licence where Prism will look
Copy license.key into C:\Prism\PrismData\ and set the path explicitly. Prism otherwise looks in its working directory, which is not what you expect once it runs as a scheduled task.
Start it once, by hand
Confirm it runs before you automate it. It prints the LAN URL other machines should use.
Browse to http://localhost:8080 on the host and create the first account - that first user becomes the workspace admin. Then stop it with Ctrl+C.
Make it start with the machine
Register a scheduled task that runs at startup whether or not anyone is logged on. Run this elevated, once:
If you prefer a real Windows service with automatic restart, nssm install Prism C:\Prism\Prism\Prism.exe --server works and gives you recovery options. Either is fine; the scheduled task needs nothing extra installed.
Open one port, and give the host a name
Allow TCP 8080 inbound from your LAN (or 8443 if you enable HTTPS below). That is the only inbound rule Prism needs, ever.
Then add a DNS A-record - prism.yourcompany.local - pointing at the host. Prism also advertises itself as prism.local over mDNS, but that is multicast and does not cross VLANs or VPNs, so remote and multi-subnet users need real DNS.
Users now browse to the host. There is nothing to install on their machines.
Firewall, in and out
| Direction | Allow | Why |
|---|---|---|
| Inbound | TCP 8080 (or 8443) from the LAN | Users reaching Prism. Prism never needs to be reachable from the internet - licensing and updates are both outbound-initiated. |
| OutboundSERVER ONLY | licenses.reportil.com:443 the build CDN host |
Licence validation and updates. This is the whole allowlist for a standard install. |
| OutboundOPTIONAL | your AI provider your mail server your Jira |
Only if you switch those on. All are off out of the box, and all point wherever you point them. |
The complete per-destination inventory, including what each request carries, is on the network & egress reference.
Four settings to consider
What you do not have to do
No database server to install, patch or tune - the database is a file. No IIS or nginx in front. No software on user machines; it is a browser. No scheduled jobs to create - backups, digests and updates are internal. No schema migration steps at upgrade time; it migrates itself on start. And no telemetry agent, because there is no telemetry.
One thing that is not yet on this list: Prism has its own user accounts, so today it is a separate directory to provision and offboard. SSO (SAML/OIDC, with LDAP for sites without an IdP) is on the roadmap - ask us where it sits before you plan around it.
The host is smaller than you think
Seat count is not the driver. What matters, in order: write rate, CAD and attachment volume, how long the database has been accumulating, and bulk imports. A hundred seats is typically five to fifteen people active at once.
| Up to | CPU / RAM | Disk | Notes |
|---|---|---|---|
| 20 seats | 6-8 cores, 32 GB | 1 TB NVMe | A small-form-factor desktop is genuinely enough. Clock speed beats core count. |
| 100 seats | 8-16 cores, 64 GB | 2 TB NVMe | Size the disk for CAD, not for rows. |
| More | Talk to us | Write rate is the ceiling, and it is worth a conversation rather than a guess. | |
If something is wrong
| Symptom | Almost always |
|---|---|
| Blocked or quarantined on launch | The unsigned binary, step 3. Allow C:\Prism\* in AppLocker/WDAC and add the same path to your AV exclusions. |
| Updates never install | Either the update policy is deliberately notify_only or manual_download - check Settings → About first - or the service account cannot write the program folder, which is almost always an install under Program Files. Move to C:\Prism. |
| The update banner runs and the version never changes | On Prism 1.125.0 and later this is fixed - the updater now stops a Prism that the service manager restarted underneath it, and reports the failure instead of going quiet. Getting to 1.125.0 from an earlier build needs one manual pass, because the update is driven by the swapper in the version you are updating from: stop the service (nssm stop Prism or schtasks /End /TN Prism), run Prism.exe directly, let it update, then start the service again. Every update after that applies on its own. The evidence, if you want it, is PrismData\_update\update.log - copy that folder aside first, each attempt overwrites it. |
| "This install is set to manual download" | The rollout is manual_download and the server is refusing to fetch the archive, by design. Take it from the downloads page, or change the setting. |
| "License not found" as a service | PRISM_LICENSE_PATH is unset, so it looked in the task's working directory. Step 4. |
| Reachable on the host, not from desks | The inbound firewall rule, or the wrong profile on it (Domain vs Private). |
| prism.local does not resolve | mDNS does not cross subnets or VPN. Use the DNS record. |
Send us the step number.
We would rather spend twenty minutes on your install than have you work around something we could fix in a release. Support response times are in the Service & Guarantee plan.