Take back control.
Your platform. Open source. In Switzerland.
Linux and Kubernetes as a sovereign foundation: Swiss-hosted, fully open source, cancel any time. No foreign control, no lock-in.
Replaces SaaS subscriptions like
Why we offer this
Security finds gaps. The biggest one is foreign control.
In every audit we hit the same gap no patch can close: your most important systems belong to someone else. Email, files, identities, backups, all of it sits with Microsoft or a US hyperscaler, under foreign law and outside your control.
This platform is the logical answer to that. The same values as our security work, open source, in Switzerland, verifiable, just one layer deeper: the foundation everything else runs on.
The Problem
Dependency sold as convenience.
Lock-in builds quietly. Proprietary formats, licensing models that get more expensive with every renewal, data in foreign data centres under the CLOUD Act. When you want to leave, you realise: you can't.
Foreign law
Your data sits under US jurisdiction. The CLOUD Act permits access even when the servers are located in Europe.
Rising cost
Licence and cloud prices only move one way. The cost of switching is deliberately priced in by the vendor.
No exit
Proprietary formats and APIs tie you in. Migrating gets more expensive and riskier every year you wait.
The Solution
A foundation that belongs to you.
We build your platform on Linux and Kubernetes, the same technology the world's largest infrastructures run on, only under your control. Fully open source, in Swiss data centres, aligned with NIS2, nDSG and ISG.
Linux + Kubernetes
Container orchestration as an open standard. Your workloads run anywhere, with us, with you, or with any other provider.
Fully open source
Every component is open source and auditable. No black box, no hidden telemetry channels, no licensing traps.
Swiss infrastructure
Data, logs and backups stay in Switzerland, under Swiss law. No CLOUD Act, no data leaving the country.
Compliance built in
NIS2, nDSG and ISG are part of the architecture from day one, not bolted on afterwards.
Apps
One login. Your complete digital office.
Over 40 applications behind one central single sign-on. You enable what you need; your own applications run alongside as standard containers.
Files & Office
6 appsreplaces OneDrive · Dropbox · MS Office · Miro
Nextcloud · files, calendar, contacts
Collabora · office suite in the browser
Excalidraw · whiteboard
Stirling-PDF · PDF toolbox
Syncthing + Obsidian LiveSync · file and note sync
Communication
7 appsreplaces Slack · Teams · Zoom · Exchange
Element / Matrix · chat, federated, with video (Element Call)
Jitsi · video conferencing
Stalwart · your own mail server (SMTP/IMAP/JMAP)
Mastodon · your own server in the Fediverse
Business
8 appsreplaces Jira · Calendly · Zendesk · Zapier
ERPNext · ERP: orders, inventory, accounting
Plane · project management
Cal.com · appointment scheduling
Zammad · helpdesk & ticketing
Snipe-IT · IT asset inventory
CISO Assistant · governance, risk & compliance
Windmill + Temporal · workflows & automation
Local AI, no data leaving
4 appsreplaces ChatGPT subscriptions · DeepL
Ollama + Open WebUI · LLM chat on your own hardware; prompts and documents never leave the building
LibreTranslate · translation
Whisper · transcription (speech-to-text)
Access & Network
5 appsreplaces Tailscale · TeamViewer · 1Password
NetBird · WireGuard VPN mesh
Guacamole · RDP/SSH/VNC in the browser
RustDesk · remote support
Vaultwarden · password manager for teams
ALTCHA · privacy-friendly captcha
Operations, Media & Building
9 appsreplaces Codespaces · Statuspage
Homer / Glance · portal & dashboard- Gatus · status page
Coder · cloud development environments
Headlamp · Kubernetes UI- changedetection · web monitoring
Jellyfin · media
Home Assistant · building automation
Frigate · cameras/NVR with object detection
One login for everything
Keycloak single sign-on (OIDC) with hardware MFA (FIDO2/WebAuthn) in front of every application. Not a single route is reachable without authentication. Group-based permissions apply centrally, from file folders to the admin console.
Infrastructure
The infrastructure in detail.
Every layer open source, declarative from Git and provider-independent: the platform runs on any VPS provider or bare metal, and switching providers is a documented standard procedure.
Show component table
18 layers, from the operating system to vulnerability scanning
| Layer | Component | Role |
|---|---|---|
| OS | Talos Linux | immutable, API-only, LUKS2 |
| GitOps | Flux CD | declarative desired state from Git |
| Network | Cilium | eBPF, kube-proxyless, WireGuard |
| Ingress | Traefik + Gateway API | TLS 1.3, HSTS, ForwardAuth |
| Identity | Keycloak + SPIRE | SSO (OIDC/FIDO2) + workload mTLS |
| Secrets | OpenBao + SOPS/age | secrets engine + Git encryption |
| Storage | Longhorn | replicated block storage (2 replicas) |
| Database | CloudNativePG | PostgreSQL operator, streaming backup |
| Backup | Velero + restic/Kopia | targets: SeaweedFS + Garage (S3, object lock) |
| Monitoring | VictoriaMetrics/Logs | metrics, logs, alerts (+ Vector) |
| Autoscaling | KEDA + KRR | load-driven, scale-to-zero, sizing |
| Registry / Git | Zot + Forgejo | air-gap source for images + code + CI |
| Policy | Kyverno | 30+ admission policies, PSS restricted |
| Runtime security | Tetragon · Suricata | eBPF enforcement · IDS (+ CrowdSec IPS) |
| SIEM / XDR | Wazuh | XDR, log correlation |
| DFIR | Velociraptor + DFIR-IRIS | forensics, IR cases |
| SOAR / TI | Shuffle + MISP | playbooks, threat intel |
| Vulnerabilities | Greenbone · Trivy | network, image and SBOM scans |
Architecture in three tiers
Foundation
GitOps engine, storage, database, workload identity; yields last.
Platform
Network, ingress, certificates, monitoring, SSO, secrets, backup, security stack.
Apps
40+ applications, individually enabled and paused; yield first under load.
Security
Defence in six layers.
We regularly attack our own clusters and document the limits.
Immutable operating system
Talos Linux · no SSH, no shell · managed only via signed API · LUKS2-encrypted
Network: default-deny
every connection explicitly allowed, per service (Cilium) · WireGuard internally · TLS 1.3 + HSTS at the edge
Identity instead of IP addresses
cryptographic identity per service (SPIFFE/SPIRE) · mTLS enforced
Admission control
30+ rules (Kyverno) · signed images only · no root · strictest pod standard
Runtime monitoring
kernel sensors (Tetragon) · IDS (Suricata) · IPS (CrowdSec) · honeypots with canary secrets
Detection & response
complete SOC built in · detection, cases, forensics, threat intel
The built-in SOC
Elsewhere a project of its own, often six figures. Here, part of the platform:
We also offer detection and response as a standalone service: Managed SIEM & Detection
Operations
Operations, measured.
GitOps
Every change is a commit · four-eyes via PR · CI gate before rollout · rollback via Git revert.
Self-healing
Stuck core components repair themselves in under 15 minutes, no intervention · dead-man heartbeats watch the watchers.
Backups
2 independent paths · S3 object lock · monthly restore drill (checksums) · etcd hourly.
Stress test
No outage of the core layers · recovery under 30 seconds · limits documented.
Monitoring
Metrics, logs, alerts (VictoriaMetrics) · status page (Gatus) · health check in 3 commands.
Updates
Weekly curated (Renovate) · CI-validated · version pinning instead of "latest" · CVE scans in the cluster.
Supply chain
SBOM (CycloneDX, Dependency-Track) · signed images only (Cosign) · air-gap mirror Forgejo + Zot.
Compliance
The Proof
Exit freedom isn't a promise. It's built in.
Every vendor claims openness. We prove it with the only metric that matters: how easily can you leave us? With us, any time, no proprietary formats, no data held hostage, no notice periods that lock you in.
Delivery Models
Three paths, at your pace.
Build
We build your sovereign platform and hand it over completely. You run it yourself, we train your team.
Build & handoverOperate (managed)
We run the platform for you on Swiss infrastructure, monitoring, updates, incident response. Cancel any time.
Managed serviceMigration
We bring your systems out of dependency step by step, planned, tested, with no downtime in production.
Cloud exit · Windows→Linux · Legacy→K8sLet's talk about your platform.
Free initial consultation. We look at your dependencies and map a concrete path back to sovereignty.
PDF · generated straight from this page, all sections expanded