Your services run on servers that Alf runs for you. There's nothing to install and nothing to keep up to date: you choose where a service runs, or let Alf choose.
Alf has servers in several regions. Servers in the sidebar lists them: the region, whether it's online, which of your services run there, and on how many servers each of them runs. See The servers page.
Every organization's services run on them, each project in its own private network: your services can't be reached by anyone else's, on the same server or across servers. See Private networking and Security.
By default Alf places each service on as many online servers as its instances say, spreading them over regions and towards the servers with the fewest services. With several instances, visitors reach the nearest one that's awake. Where services run has every rule and every case: what makes a service move, and what doesn't.
A busy server takes no new services until its load is down; new ones go to servers with room, and if none has any, creating the service is refused with a message saying so. See When a server is full.
Alf groups its servers into regions, like Europe (servers in Falkenstein and Nuremberg, say) or US; the picker shows where each region's servers are. Regions lists the ones open today. Regions, when you create a service and in its Scaling settings, is where it runs: one instance in each region you pick, on a server of its own there. Anywhere, the default, is one instance where Alf picks. Changing them moves the service: it starts on a server in its new regions and leaves the old one, and its instances are spread over them again.
web is kept to Europe and US, so it runs one instance in each, on a server of its own there; db is kept to Europe. A visitor in Berlin reaches web on a server in Falkenstein, which also runs db with its volume; a visitor in New York reaches web on a server in the US. If the Falkenstein server goes away, another server in Europe, like Nuremberg, takes web. Anywhere, the default, is one instance where Alf picks. Databases, computers and services with a volume run on one server, in one region, where their data is.
regions on create_service, update_service, add_database and create_computer.When a server goes offline, its services move to another server in the same region, and to another of their regions only when none there can take them. Those with a volume wait for it instead: their data is on that server. The room every server keeps free is there for exactly this. See Where services run.
All services of a project run on servers that can share its private network. Now and then that means a server on the list can't be chosen for a project that already runs elsewhere; the message says so.
If you want machines that run only your organization's services, Alf can set up private servers for you: write to contact@runalf.com.
Once your organization has a private server:
Alf installs, updates and watches private servers the same way as the shared ones, including how much room they have: if yours fills up, it says "Full right now" and we'll be in touch about a bigger or another one.
Servers update themselves: when a new version of the program that runs your containers is released, each server restarts into it at a quiet moment (no builds running, no requests open). Your containers keep running meanwhile.
Now and then a feature needs a version a server doesn't have yet. It's then refused for services on that server with a message saying so, and works a few minutes later.