We take on new engagements throughout the year. Outline your project
Klackwerk
DE EN
Talk to us
DE EN
Talk to us
Sovereignty Assessment & exit in stages

Own your data. Escape the hyperscaler.

  • Sovereign open-source platforms, built in Hamburg
  • Grows from a single rack to multi-site Kubernetes
  • GDPR, BSI C5 and NIS2 designed in, not bolted on
  • Every building block exchangeable, migration path included
Talk to us Explore solutions

Reproducible infrastructure 

# The whole platform, declared once
module "sovereign_platform" {
  source   = "klackwerk/platform/proxmox"
  location = "eu-central"
  identity = "keycloak"

  workloads = ["nextcloud", "gitlab", "grafana"]
}

Output

Plan: 34 to add, 0 to change, 0 to destroy.
Data residency: EU only · US dependencies: 0

Why Klackwerk?

Data sovereignty

GDPR, BSI C5 and ISO 27001 translated into concrete architectures in which your personal data demonstrably stays inside your jurisdiction, on your hardware or at a European provider you can switch at any time.

Learn more

Vendor Lock-out

Our counter-design to vendor lock-in: OIDC instead of proprietary SSO, the S3 API instead of cloud-storage quirks, Postgres instead of hyperscaler DBaaS. Every building block stays exchangeable. You decide when it is replaced.

Learn more

Hyperscaler exit

More than lift-and-shift. Cutovers run blue/green, critical interfaces operate in parallel, rollback stays available, with measurable risk and cost KPIs per phase.

See how an exit runs

Infrastructure as code

Terraform or OpenTofu, Ansible, GitLab CI and Argo CD. Every change runs as a pull request with automated plan, security scan and four-eyes review, so compliance does not have to be retrofitted.

Learn more

Klackwerk in production

Modular environments, assembled from the open-source building blocks that fit the use case, from bare metal to identity, delivery and observability. No proprietary layer, no hidden telemetry, no subscription risk.

  • Kubernetes
  • Proxmox VE
  • Docker
  • Terraform
  • OpenTofu
  • Ansible
  • GitLab
  • Argo CD
  • Helm
  • Keycloak
  • Authentik
  • Cilium
  • Traefik
  • Nginx
  • PostgreSQL
  • MinIO
  • Valkey
  • OpenSearch
  • Prometheus
  • Grafana
  • Loki
  • Nextcloud
See our cases

Ways to work with us

Migration · per user savings

Microsoft 365 & Google Workspace Replacement

Migration to GDPR-compliant open-source alternatives such as Nextcloud, Collabora Online, OnlyOffice and Mailcow. Full office productivity, file sharing, calendars, mail and video conferencing, without US data transfers and without per-user subscription cost.

  • Nextcloud, Collabora, OnlyOffice, Mailcow
  • ·
  • Data migration incl. training
  • ·
  • No US data transfers
# Office, files, mail: without US transfers
services:
  nextcloud:
    image: nextcloud:31-fpm
    environment:
      OIDC_ISSUER: https://id.customer.eu/realms/staff
  collabora:
    image: collabora/code:latest
  mailcow:
    dkim: true
Exit project · predictable pricing

Amazon AWS & Microsoft Azure Exit

Instead of opaque structures and pricing tiers: a rebuild onto a GDPR-compliant, EU-based host with predictable pricing. Delivered fully transparently as infrastructure as code.

  • EU-based host, GDPR-compliant
  • ·
  • Predictable pricing instead of pricing tiers
  • ·
  • Delivered fully as infrastructure as code
# The exit target as code, nothing clicked in a console
resource "proxmox_cluster" "core" {
  nodes       = 5
  storage     = "ceph"
  replication = 3
}

module "gitops" {
  source = "./modules/argocd"
  idp    = module.identity.oidc_issuer
}
Operations · you keep ownership

Managed Infrastructure

We set up a scalable, fully automated environment following best practices and current security standards, transparently visible in your own repository at any time. Resource ownership never sits in our hands. We take on monitoring, patch management and, on request, release pipelines, so your team keeps its focus on building the product while operations stay stable.

  • Automated to best practices & security standards
  • ·
  • Resource ownership stays with you
  • ·
  • Monitoring, patch management, release pipelines
# Your repository, your resources: we run them
ownership:
  repository: "customer/platform-infra"
  cloud_accounts: customer
klackwerk:
  monitoring: 24/7
  patch_window: "Tue 02:00 CET"
  release_pipelines: true
Step by step · or turn-key

Automate Everything

Step by step we support and deliver concepts and implementations to automate your entire infrastructure. Depending on your preference we bring the whole team along incrementally, or deliver turn-key at a price agreed up front.

  • Automation concept & implementation
  • ·
  • Team enablement instead of a knowledge island
  • ·
  • Or turn-key at a fixed price
# Every change ships through the same pipeline
stages:
  - name: plan
    run: terraform plan -out="tfplan"
  - name: review
    approvals: 2
  - name: apply
    run: terraform apply "tfplan"
manual_steps: 0
Retainer · co-sourcing

Managed Operations & 2nd-Level Support

Optional operations retainer for your open-source platform: 2nd-level support with agreed response times, on-call and quarterly reviews, as a bridge until your team is fully self-sufficient, or long-term as a co-sourcing model.

  • 2nd-level support & on-call
  • ·
  • Agreed response times per incident class
  • ·
  • Quarterly platform reviews
# SLOs live in Git, not in a slide deck
groups:
  - name: platform-slo
    rules:
      - alert: ErrorBudgetBurn
        expr: slo:burn_rate5m > 14.4
        for: 2m
        labels: { severity: page }
Incremental · first swap in weeks

Replace dependencies one at a time

The exit starts small: we look for the dependency that is quickest to replace and swap it out within weeks, while everything keeps running. Only then do you decide which building block goes next. That turns the big project into a series of small steps.

  • One building block per step, cleanly finished
  • ·
  • First swap within weeks
  • ·
  • You can stop after every step
# Each dependency becomes its own module
modules:
  - replace: "Microsoft Entra ID"
    with: keycloak | authentik
    effort: 2 weeks
  - replace: "AWS RDS (PostgreSQL)"
    with: postgresql on proxmox
    effort: 4 weeks
start: smallest module, shipped on its own

Our approach

Five phases, each with a fixed scope, a documented outcome and a rollback path. You can stop after any one of them.

01 · Assess

Map the dependencies before you move anything

We inventory US cloud and SaaS dependencies, critical data flows and processing contracts, then rate them against GDPR and BSI C5.

  • Dependency inventory across AWS, Azure, GCP and SaaS
  • Lock-in points: managed DBs, IAM, messaging, KMS
  • Rated against GDPR and BSI C5, dependency by dependency
02 · Design

A concept built on open standards, agreed together

We put together a tailored concept that relies on open standards and freely available solutions, and agree the roadmap together with you.

  • Target picture from open standards and open-source building blocks
  • No building block you could not keep running yourself
  • Roadmap prioritised and agreed together
03 · Build

A platform delivered exclusively as code

Terraform or OpenTofu for cloud and on-prem APIs, Ansible for configuration, GitLab CI and Argo CD for delivery, every change as a reviewed pull request.

  • Reusable modules and OPA/Sentinel policies
  • Automated plan, security scan, four-eyes review
  • Compliance built in, not retrofitted (ISO 27001, NIS2)
04 · Migrate

Cutovers that run blue/green, not big bang

Workloads move stepwise into a private Kubernetes platform. Critical interfaces operate in parallel, data is migrated consistently, rollback stays available.

  • Phase plan with rollback paths per workload
  • Parallel operation of critical interfaces
  • Measurable risk and cost KPIs per phase
05 · Operate

Operations stay stable, with or without us

With Managed Infrastructure we take on monitoring, patch management and release pipelines, traceable in your own repository. You can just as well run operations yourself: documentation, training and handover are part of it.

  • Managed Infrastructure: monitoring, patching, release pipelines
  • Everything versioned in your repository, visible at any time
  • Handover to your team with training and documentation

Built on open source

Kubernetes, Proxmox, PostgreSQL, Keycloak, Argo CD, Prometheus, Grafana and the wider CNCF ecosystem. We contribute back, document everything and hand over source code, pipelines and runbooks.

Hyperscaler setup vs. Klackwerk platform

Criterion Typical hyperscaler setup Klackwerk platform
Data location US-controlled provider, third-country transfer risk Your data centre or EU provider with C5 / ISO 27001
Identity Entra ID, Okta or Auth0 (proprietary SSO) Keycloak or Authentik, OIDC / SAML, passkeys
Storage & database Managed DBaaS and storage quirks you cannot leave PostgreSQL, the S3 API, MinIO or Ceph (exchangeable)
Provisioning Console clicks plus partial automation Infrastructure as code, GitOps, four-eyes review
Telemetry Vendor telemetry, limited insight into data flows Prometheus, Loki, Grafana (no external telemetry)
Exit path Migration cost grows with every proprietary service Every building block exchangeable, migration path included

Ready to map your dependencies?

A short call is enough to start. No brief required. If it fits, a sovereignty assessment follows, with a fixed scope: at the end you know which dependency goes first, what it costs and how long it takes.

Talk to us Explore solutions