Proof of Work
The Sovereign Stack
Every service we offer to clients, we run in production ourselves first. No vendor we can't replace. No jurisdiction we can't defend. This is the full inventory.
42
Services
37
Open source
0
US-controlled
File Storage & Sync
Replaces OneDrive / Google Drive
Nextcloud
File sync, sharing, collaborative editing. WebDAV, CalDAV, CardDAV.
Documents
Replaces Office 365 / Google Docs
OnlyOffice
Full Office compatibility. Real-time collaborative editing.
Replaces Exchange / Gmail
Stalwart Mail
JMAP + IMAP. Full-text search. Zero per-mailbox fees.
Team Chat
Replaces Teams / Slack
Mattermost
Channels, threads, integrations. Self-hosted. Full audit trail.
Video Calls
Replaces Zoom / Meet
Jitsi Meet
End-to-end encrypted. No account required for guests.
Calendar & Contacts
Replaces Outlook / Google Calendar
Nextcloud Calendar
CalDAV/CardDAV. Syncs with all clients.
Password Manager
Replaces LastPass / 1Password
Vaultwarden
Bitwarden-compatible. Self-hosted vault.
Bookmarks & Notes
Replaces Notion / Bookmark tools
Nextcloud + Deck
Kanban boards, notes, bookmarks. All in Nextcloud.
Identity & SSO
Replaces Azure AD / Okta
Zitadel
OIDC, SAML, MFA. No per-user fees. Multi-tenant.
Secrets Management
Replaces Azure Key Vault
OpenBao
HashiCorp Vault fork. Dynamic secrets, PKI, transit encryption.
Certificate Authority
Replaces DigiCert / Let's Encrypt
Let's Encrypt + Cert-Manager
Automated TLS. Cert-manager for Kubernetes. Zero cost.
VPN / Mesh Network
Replaces Tailscale / Cloudflare WARP
Headscale
Self-hosted Tailscale control server. WireGuard mesh.
Firewall / WAF
Replaces Cloudflare WAF
Cloudflare Access
Zero-trust access. Service tokens. No origin exposure.
SSH Certificate Authority
Replaces Static SSH keys
OpenBao SSH CA
Short-lived SSH certificates. No long-lived keys.
LLM Inference
Replaces OpenAI API / Copilot
Ollama + vLLM
Run Qwen, Llama, Mistral, DeepSeek locally. Zero data export.
AI Gateway
Replaces Direct API calls
LiteLLM
Unified API gateway. Model routing, fallback chains, cost tracking.
AI Orchestration
Replaces LangChain Cloud
Custom (Python)
Agent orchestration, tool calling, RAG pipelines.
Vector Database
Replaces Pinecone
pgvector
Vector search inside PostgreSQL. No separate service.
AI Chat Widget
Replaces Intercom / Drift
Custom (Next.js)
Privacy-first chat. Local model inference. No tracking.
Source Control
Replaces GitHub
GitLab CE
Git hosting, CI/CD, issue tracking, wiki. Self-hosted.
Container Registry
Replaces Docker Hub
GitLab Registry
Private container images. Integrated with CI/CD.
CI/CD
Replaces GitHub Actions
GitLab CI
Pipeline-as-code. Runners on own infrastructure.
Automation
Replaces Zapier / Make
n8n
Visual workflow automation. 400+ integrations. Self-hosted.
Relational Database
Replaces RDS / Cloud SQL
CNPG (PostgreSQL)
Cloud-native PostgreSQL operator. HA, backups, WAL archiving.
Object Storage
Replaces S3 / GCS
Ceph RGW
S3-compatible object storage. Self-hosted. Erasure coding.
Search
Replaces Elasticsearch Cloud
PostgreSQL FTS
Full-text search built into PostgreSQL. No separate cluster.
Backup
Replaces AWS Backup
Ceph + CNPG Barman
Block + WAL backup. Point-in-time recovery. EU-hosted.
Metrics & Monitoring
Replaces Datadog / New Relic
VictoriaMetrics
Prometheus-compatible. Long-term storage. Low resource usage.
Log Aggregation
Replaces Splunk / Datadog Logs
Loki
Grafana Loki. Label-based. Efficient storage.
Dashboards
Replaces Datadog Dashboards
Grafana
Metrics, logs, traces in one UI. Alerting built in.
Alerting
Replaces PagerDuty
Alertmanager
Route alerts to email, webhook, Mattermost. Silence and group.
Uptime Monitoring
Replaces Pingdom / UptimeRobot
Blackbox Exporter
HTTP, TCP, ICMP probes. Integrated with Prometheus.
Analytics
Replaces Google Analytics
Plausible
Privacy-first. No cookies. GDPR compliant. Self-hosted.
Container Orchestration
Replaces EKS / AKS / GKE
RKE2 (Kubernetes)
FIPS-compliant Kubernetes. CIS hardened. Bare metal.
Networking / CNI
Replaces AWS VPC
Cilium
eBPF networking. WireGuard encryption. Network policies.
Ingress / Load Balancer
Replaces AWS ALB / Cloudflare LB
Traefik
Automatic TLS. Middleware. Kubernetes-native.
DNS
Replaces Route 53
Cloudflare DNS
Anycast DNS. DDoS protection. API-managed.
Reverse Proxy / CDN
Replaces CloudFront
Cloudflare
Edge caching. WAF. Tunnel to origin (no open ports).
CRM & ERP
Replaces Salesforce / HubSpot
ERPNext
Full business suite. CRM, accounting, HR, projects.
Helpdesk
Replaces Zendesk / Freshdesk
Chatwoot
Live chat, email, social. Open-source.
Newsletter
Replaces Mailchimp
ListMonk
High-performance newsletter. No per-subscriber fees.
Website CMS
Replaces WordPress / Webflow
Payload CMS 3.x
Headless CMS. TypeScript. Next.js native.
Want this stack for your organisation?
Everything you see here is deployable for clients. Same tools, same architecture, same sovereignty guarantees. Per-seat pricing, no vendor lock-in.