Production checklist

Set NODE_ENV=production. The server refuses to start without RESEND_API_KEY, RESEND_FROM_EMAIL, at least one ADMIN_EMAILS address and a KEY_ENCRYPTION_SECRET of 16+ characters. A set ADMIN_API_KEY must be 16+ characters too.
Serve over HTTPS (Caddy, nginx or your platform's proxy) and set TRUST_PROXY=1.
Back up PostgreSQL and keep KEY_ENCRYPTION_SECRET safe. Together they restore every app, key and WhatsApp login. data/ is only a working copy.
Changing KEY_ENCRYPTION_SECRET makes stored sessions unreadable. Those apps show a new QR instead of failing.
Monitor GET /health.
Keep data/ private. Session folders grant full access to the linked accounts.
Run exactly one gateway per database. Two servers would start the same WhatsApp clients and log each other out. Do not scale past one replica.
Give the host at least 4 GB of RAM for one or two numbers. Each session uses about 1 to 1.2 GB of Chromium.
Allow a graceful stop (about 90 seconds). On SIGTERM the gateway saves every session to the database before exiting.

Moving between servers

Start the new server with AUTOSTART_CLIENTS=0. It serves the dashboard and API but starts no WhatsApp clients.
Stop the old server.
Set AUTOSTART_CLIENTS=1 and redeploy. Sessions restore from the database with no QR scan.