Self-hosted deployment

1. Enable WeCom Conversation Content Archive under the customer's policy and configure employee notice/external-party consent as required.
2. Register the archive RSA public key with WeCom. Inject every matching private key version through a customer secret manager.
3. Install the official Finance SDK only in a loopback-local sidecar. The sidecar implements /get_chat_data and /decrypt_data as described in the source.
4. Provision encrypted PostgreSQL storage/backups and apply infra/postgres/migrations/001_initial.sql.
5. Put TLS and network authentication in front of the service. Use a separate token for /v1/admin/sync.

The reference PostgreSQL provider keeps encrypted payloads and performs a bounded, authorized candidate scan before decryption. It deliberately does not silently add a plaintext full-text projection. Larger installations should replace ArchiveSearchRepository with a separately assessed search provider.

Treat SYNC_*, CRYPTO_*, audit-chain, consent, and database errors as fail-closed incidents: repair the dependency and retry; do not skip records.