Sovereignty needs ground to stand on.
The complete sovereign digital workplace — and the AI factory beneath it — deployed on your metal, in your data center, at any provider, in any country. Declared in Git. Deployed by ArgoCD. Mirrored anywhere on earth.
Data sovereignty — every byte stays on infrastructure you control
Horizontal scale-out — from pilot cluster to national platform
Vendor lock-in — open source, open standards, portable by design
Public IP failover when a node goes down
Your infrastructure. Your jurisdiction. Your rules.
VNClagoon is not tied to a cloud, a provider, or a country. The entire stack — workplace, data services, and AI — installs identically wherever you decide it should live.
Who builds sovereign platforms on it
MSPs & Hosting Providers
Sovereign workplace as a service
One Git repository per tenant stack — identical, isolated, fully auditable. Onboard your first customer and your hundredth on the same automation, and operate them all from a single GitOps control plane.
Telcos & Carriers
Turn data centers into sovereign cloud regions
Offer national-scale collaboration and AI to enterprise and public-sector customers — on facilities and network you already own, under the jurisdiction your customers require.
Corporates
The workplace inside your perimeter
Bring communication, collaboration, and the AI factory behind your own firewall. Compliance is met by architecture, not by contract clauses — no data processor outside your control.
Governments & Public Sector
From ministry cluster to national platform
Air-gap capable, GDPR- and BSI-aligned by design. Every byte, every model, every log under national jurisdiction — with an open-source stack your own teams can inspect.
The entire factory, declared in Git.
Every component of a VNClagoon stack — cluster add-ons, workloads, PostgreSQL clusters, model configurations, prompt templates, tool definitions — is YAML in a Git repository. ArgoCD reconciles the running platform against it, continuously.
Reproducible
Point the same repository at new hardware and get an identical stack — in hours, not months. That is how a stack is born, and how it is mirrored.
Auditable
Every change to the platform is a commit: who, what, when, why. Your auditors read history instead of interviewing admins.
Recoverable
The repository is the disaster-recovery plan. Rebuild the platform from Git and restore data from replicated backups — a rehearsed procedure, not a hope.
apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: vnclagoon-platform spec: source: repoURL: https://git.yourdomain.tld/platform path: stacks/production destination: server: https://kubernetes.default.svc syncPolicy: automated: selfHeal: true # drift auto-corrected prune: true # removed = removed --- # workplace · data services · AI engine · # observability — one repo, one source of truth.
workplace · data services · AI engine · observability — one repo, one source of truth.
Kubernetes your way. Bare metal where it counts.
The stack is plain Kubernetes — standard manifests and Helm charts. It runs on the distribution you operate or your provider mandates, and steps down to bare metal where physics demands it: real-time video media relay and GPU inference run directly on the hardware.
Distribution-agnostic
Switch distributions without switching platforms. The manifests port; your investment survives every vendor decision — including ours.
Bare-metal video
Video conferencing media relay is CPU- and network-bound. It runs directly on dedicated metal — full cores, direct UDP, no container overhead — while staying wired into the same encrypted fabric.
GPU-native AI
Inference nodes join the cluster with direct GPU access. Kubernetes autoscaling spins model servers up and down with demand.
One fabric. Any number of locations.
A VNClagoon stack is never an island. Stacks mirror to any location, join into one encrypted fabric, and let workloads move across every connected destination.
Mirror
Stand up an identical stack anywhere on earth from the same repository — new region, new provider, new country.
Combine
Join stacks into one fabric over an encrypted WireGuard mesh — private connectivity even across untrusted networks.
Move
Workloads relocate across connected destinations. Capacity follows demand; data follows policy.
Grow
Scale-out is horizontal and unbounded: add a node, a rack, a region. Storage and compute scale independently.
Inside a site: anatomy of a sovereign stack.
Every site is fully self-contained. Users enter through redundant virtual IPs, workloads run on interchangeable nodes, storage is replicated underneath — and AI and real-time media get the hardware they deserve. All of it declared in Git.
Entry
Redundant virtual IPs (MetalLB) with Traefik ingress and sub-second failover.
Compute
Interchangeable Kubernetes nodes; workloads reschedule automatically.
Storage
Ceph replicates every volume three times, self-healing underneath.
Accelerated
GPU inference nodes and bare-metal media relay wired into the same fabric.
Cloud services, without the cloud.
Everything a hyperscaler sells you as a managed service ships inside the stack — operated by Kubernetes operators, declared in Git, running on your hardware.
PostgreSQL, operated
CloudNativePG runs highly available Postgres clusters with automated failover and point-in-time recovery — the platform's transactional backbone.
pgvector
Vector embeddings live inside PostgreSQL. Conversation history, documents, and skill context become the AI factory's long-term memory — sovereign by construction.
Apache Solr
Battle-hardened full-text and faceted search for large-scale deployments with massive document repositories.
Distributed block storage
Ceph replicates every volume three times across nodes. A disk or node failure is a non-event — the cluster self-heals.
S3-compatible object storage
Backup targets, artifacts, and large objects on your own hardware — the same API as the public cloud, none of the exposure.
Sovereign registry & Git
Containers are built, signed, and served from your own registry. The software supply chain never leaves the perimeter.
Ingress & load balancing
Traefik ingress with MetalLB address management: public services stay reachable with sub-second failover between nodes.
Automated certificates
cert-manager issues and rotates TLS everywhere — public ACME or your internal CA.
Full observability
Prometheus and Grafana watch everything from disk health to GPU utilization and LLM token throughput.
Secure by architecture, not by policy.
Security guarantees that depend on a provider's promise are not guarantees. VNClagoon's are structural — they hold because of how the stack is built.
Encrypted fabric, end to end
A WireGuard full mesh encrypts all control-plane and pod-to-pod traffic — confidential even inside a provider's own network.
Encryption at rest
LUKS disk encryption and storage-level encryption protect data on every drive, in every location.
Air-gap capable
The full platform — including on-device AI — operates with zero external connectivity for classified and high-security environments.
Sovereign supply chain
No runtime dependency on external registries or repositories. Every image is built and served in-house.
End-to-end encrypted communication
All channels across the workplace suite remain fully encrypted, with zero third-party data sharing.
Compliance built in
GDPR- and BSI-aligned architecture. Every AI action is logged, traceable, and reversible — audit evidence is generated by the platform itself.
Engineered for the day something fails.
Resilience is layered by failure domain. Each layer has a defined mechanism and a rehearsed recovery path — because a backup that was never restored is a rumor, not a strategy.
| What fails | What catches it | Recovery |
|---|---|---|
| A disk | Triple-replicated distributed storage self-heals and rebalances automatically. | zero interruption |
| A node | Kubernetes reschedules workloads; MetalLB re-announces public IPs from surviving nodes. | seconds |
| A volume | Scheduled backups of every persistent volume to object storage; automated restore verifies and repopulates empty volumes on startup. | minutes |
| A site | Encrypted off-site backup sync plus a mirrored stack deployed from the same Git repository — warm standby or active-active, your RPO. | minutes–hours |
| A provider | The stack is provider-agnostic by design. Redeploy or fail over to any mirrored location — sovereignty includes the freedom to leave. | your choice |
Per-workload policy
Backup schedule, retention, and encryption defined per workload — in Git, like everything else.
Tested restore paths
Restores are automated and exercised through documented runbooks, not improvised during an incident.
Off-site by default
Encrypted backups sync to a second location as standard — independent of the primary site's fate.
Rolling everything
Upgrades roll one node at a time with health gates — the platform stays up while it evolves.
The leading sovereign workplace, running on top.
This infrastructure exists to run VNClagoon — the full-stack sovereign digital workplace trusted by government agencies, healthcare, and financial institutions. Every product deploys as cloud-native microservices on the same fabric.
Cloud-native mail
The mail backend is built on Stalwart — Rust-native, microservices-ready, deployed on Kubernetes with PostgreSQL storage. Mail finally scales like the rest of the platform.
Video where physics lives
Conferencing media relay runs on dedicated bare metal for uncompromised call quality — orchestrated with, and secured by, the same platform.
One directory, one fabric
Identity, access, and policy span every product and every site. Users see one workplace, wherever the pods happen to run.
An AI factory you own — technically, legally, operationally.
On this infrastructure, VNClagoon becomes a sovereign AI factory: the Agentic Suite assists every user interaction, and the Agent Factory orchestrates specialist agents that plan, develop, test, and deploy software end to end — with sovereign inference, RAG memory, an MCP tool registry, and a human gate at every stage. No cloud dependency. No data sharing.
Host wherever you like. The cost will excite you.
A complete sovereign stack for thousands of users runs on a handful of commodity servers — in your own data center, at any regional provider, in any private cloud. Strip away hyperscaler rent, managed-service markups, and egress fees, and the same workload lands at a factor of 5–10 below hyperscaler cost.
Sovereign stack
1×Commodity hardware · full stack embedded
baseline
Hyperscaler equivalent
5–10×Managed Kubernetes + billed-per-service add-ons
plus egress · plus lock-in
No managed markups
PostgreSQL, vector search, object storage, load balancing, registry, monitoring — embedded in the stack, not billed per service, per gigabyte, per request.
No egress fees
Your data moves freely between your own sites over your own encrypted fabric. Mirroring, backups, and failover cost bandwidth — not a toll.
Predictable by design
Capacity is hardware you chose, at prices you negotiated. Scale by adding a node — not by climbing a pricing tier.
Run the numbers on your own footprint. Our team sizes a reference build for your data center, your provider of choice, or your national cloud — and prices it against your current cloud bill. The comparison is the sales pitch.
One vendor. Total accountability.
VNClagoon is not a loose bundle of community projects. VNC AG is the single point of entry — and the final point of responsibility — for the entire stack: contractual certainty, zero fragmentation, and vendor-backed compliance assurance.
1st Level
Certified experts
Delivered by certified VNClagoon partners close to your operation.
2nd Level
VNC AG support team
Directly through VNC AG or certified partners — structured escalation for regulated environments.
3rd Level
Product engineering
The engineers who build the platform stand behind it — legally and operationally.
Build your sovereign AI factory.
Today. On your terms. On your infrastructure. Our team designs the reference architecture for your data center, your provider, or your national cloud.