Skip to the contact form

Linux support, private cloud and sovereign AI for public bodies

So your team can maintain it once we are done.

Municipalities, ministries, public agencies, hospitals and universities across Europe.

  • Linux systems support, with hours and response times in writing.
  • Migrations off VMware or Windows 10, and a private cloud with a way back.
  • AI and storage in your own data centre, documented so your team can run it.
Talk to us What to ask before you sign

Madrid · Barcelona · Paris · Bruxelles. English, español, français. No account managers in between: whoever answers the email is the person who will be on your servers. We reply within one working day, and the tender documents do not have to be written yet.

Partners IBM Business Partner Canonical Red Hat SUSE We also work with Rocky Linux, AlmaLinux, Debian, Proxmox and Ceph.

Keep what you have, change it, or work out what to do next

Three ways in. Pick the one that looks like where you are now.

I need it to keep running

Specialist support, health reviews, change planning and diagnosis of the things a runbook does not cover.

First we scope the estate, its risks and who answers for what. The support agreement comes after that. Let us look at your estate

I want to change it without stopping the service

Linux migrations, leaving VMware, sovereign cloud, private AI or a compute refresh. Feasibility and full cost before anything moves.

An options appraisal and a pilot with written acceptance criteria, with coexistence and rollback planned in. Weigh up the options

I have to define the project

A view on scope, risk, cost, operations and deliverables, without turning an open requirement into a purchase decided in advance.

Twelve questions to pin down the need and compare bids. Without leaving us your details. See the questions
Local and regional governmentMunicipal IT, provinces and shared service organisations. Phased refreshes, at a pace the team that has to run them can absorb.
Ministries and agenciesCentral government, regional administrations and public agencies. Mixed estates, automation, interoperability.
Health, research and universitiesHospitals, research groups and higher education. Private cloud, distributed storage, HPC and inference under the institution's own control.

One missing piece or the whole estate

We set out what each service covers and what it does not, so responsibility never ends up in the gap between suppliers. And whatever we deploy is documented, so you can change supplier without rebuilding it.

Linux support and administration Patch windows, performance analysis, high availability and diagnosis of what the runbook does not cover. With hours and response times in writing. Sovereign AI and private RAG On the documents you authorise, with per-role permissions and a human reading the answer before anyone acts on it. Sovereign cloud Proxmox when your own team will run it. OpenStack when there are several services and somebody dedicated to the platform. Plus the way out of VMware, with rollback. Ceph and storage Block, file and object. It starts at three nodes — the minimum for monitor quorum and size-3 replication — and six allow rack-level failure domains. The network follows the disks, not the budget: with spinning OSDs 10 GbE is enough; with NVMe it is not. Kubernetes and automation Deployments that replay identically, with observability in from day one. Without somebody running it daily, two well-built machines are less work than a cluster. HPC and research computing Compute, Slurm and parallel storage for research groups. Security and NIS2 Hardening against the CIS Benchmarks, asset inventory, vulnerability management, segmentation and logging. Wazuh for detection, and the evidence written up in the form the auditor will ask for. Technical training Linux, Ceph, Kubernetes and OpenStack, on your own infrastructure wherever possible.

Twelve questions before you sign for open infrastructure

The same twelve we use to put a bid together.

  1. Which version is in production, and until what date does it get security patches?
  2. If something breaks on a Sunday, who answers, within how long, and what happens if that is missed?
  3. If the supplier vanished tomorrow, what would it take to keep operating?
  4. Are the vendor subscription and the supplier service on separate invoices?
  5. What compliance tier applies to this system, and who signs off conformity?
  6. What happens to the smart card, its reader, and the services that only work in one browser?
  7. What does year three cost, counting licences, hardware and people?
  8. Is there a rollback? Rehearsed, or on paper?
  9. What knowledge stays with our team, and how do we verify that?
  10. If it includes Ceph, Kubernetes or OpenStack: how many nodes and how many people to run it?
  11. If it includes AI: where is the data processed, on whose hardware, and who reviews the output?
  12. Of all the above, what can we verify before signing?

How it is contracted: a block of hours, a monthly retainer, a call-off from a framework agreement, a fixed-scope project with acceptance criteria, or as a subcontractor to the incumbent. You can start with the smallest and widen it once the scope is clear.

How long the estate you have will hold

For each one: what support it has today, what it costs to keep, and the point where it stops being worth it.

UbuntuDebian

Ubuntu and Debian

SIXE UP, LTS, ESM

Ubuntu support runs through SIXE UP, which covers what the Canonical subscription leaves out: storage, network, backups and the rest of the infrastructure, with our own on-call rota. Debian and the other distributions come with the same team and the same contract.

Ubuntu Pro is bought from Canonical and takes security maintenance on an LTS from five years to ten. The free tier is for personal use, so a public body pays for it: we will tell you how many machines actually need it. What SIXE UP covers
Rocky LinuxAlmaLinux

Rocky Linux and AlmaLinux

RHEL compatible

CentOS 7 stopped receiving patches on 30 June 2024, and RHEL 6 years before that. For estates coming off either one and needing RHEL compatibility without the subscription. Updates, lifecycle, hardening and high availability.

Since RHEL 9 they are not interchangeable: AlmaLinux dropped one-to-one binary compatibility in favour of ABI compatibility, Rocky keeps it tighter. Which one suits you depends on your applications. Ask us about your case

Windows 10 with no patches

Desktop estate, electronic signature

Mainstream support ended on 14 October 2025. There are four routes and none of them is free: move to Windows 11 where the hardware allows it, pay for ESU — billed per device per year, dearer at every renewal, and gone after October 2028 — replace machines, or migrate to Linux profile by profile.

For a standard administrative profile, migrating usually adds up. For anyone tied to old desktop applications, almost never. The decision is taken profile by profile. Linux migrations

Where the data actually sits

NIS2, SecNumCloud, BSI C5, ENS

The schemes differ and they are not equivalent: SecNumCloud in France and BSI C5 in Germany set criteria for cloud providers, while ENS in Spain certifies an organisation's own systems. NIS2 sits above them, but it does not reach everybody — it covers essential and important entities by sector and size, and each member state decided for itself how far down the local level it goes. Worth settling before anyone quotes you for a compliance project.

We certify nothing and qualify nothing: that has to be independent of whoever did the work. Ours is the layer underneath — hardening, segmentation, asset inventory, logging, and backups with a restore that was actually rehearsed — with the evidence written up. Ask us about your case

The AI can be yours, and so can the decisions

An assistant over your own documents needs GPUs in your data centre or an external provider, and what that means for the records is different in each case. It is what sets the budget, so it gets decided at the start.

With ten test documents everything works. The trouble starts with the first real case file and the first user who asks something odd.

AI and infrastructure projects
Authoriseddocuments Sources Case files andregulations Indexing Chunking andtraceabilityEmbeddings:in or out,decided here Control Permissionsby role Evaluationagainst knownanswers Model In your DCor at a third party Human Reviewed beforeacting The answerwith its source

The model that produces the embeddings need not be the one that answers: you can index in-house and query outside, or the other way round. What you cannot do is leave it undecided, because if the indexing model is external your documents leave the organisation before anyone asks a single question. That means naming a processor and signing an Article 28 GDPR contract, and it is what should drive the choice of model rather than follow it.

  1. SourcesAuthorised documents, case files and regulations.
  2. IndexingChunking and traceability. This is where you decide where the embedding model runs.
  3. ControlPer-role permissions and evaluation against known answers.
  4. ModelIn your data centre or at a third party.
  5. HumanReviewed before anyone acts.
  6. OutputThe answer, with its source.

Every phase ends in something you can hand an auditor

Inventory

Before proposing anything

The estate, the constraints, who operates what, and what cannot be stopped.

Inventory, risks and sizing.
Pilot

A small pilot

With acceptance criteria written and agreed before it starts.

The pilot report, with the options compared.
Rollout

In phases

Each phase coexists with what was there and has its own rollback, rehearsed in test before production is touched.

A deployment plan, and how each phase reverses.
Handover

While the project runs

Your team runs the critical tasks in front of us before we close.

The operations documentation. The training is already done.

Our commitment to the public sector

Public money belongs to the public. Whatever is wasted on technology is money that is then missing from other services.

So sometimes we will tell you there is no need to buy: what you have will hold, the project is smaller than you were told, or a licence is surplus. Even when we are the ones selling that licence.

We are also committed to sustainability. We try to extend the life of hardware before replacing it, because every machine that is not manufactured is energy and material not spent. A PC that cannot run Windows 11 can stay in service with Linux, and equipment that lasts longer is budget you do not have to request again. More on our sustainable technology page.

Sovereignty also means being able to replace your supplier. Us included.

A badly spent budget is easy to spot: a licence nobody uses, an array sized for three times the load, a project that has to be redone in two years. The first thing we look at is whether you need to spend at all: we measure total cost and the life left in what you already have before proposing anything.

Sometimes keeping it wins; when replacing wins, we say which risk justifies it. We document what we deploy whether or not anyone asks, and the training happens during the project, with your people running the tasks in front of us.

Tell us what you have running
Hardware Your data centre, or the hosting you choose Machines tied to the vendor’s own support Operating system Open source: it can be patched without permission Support and backports, only while you keep paying Data and configuration Open formats, restores actually tested Backups only their own tool can open Line-of-business apps Exportable data, documented interfaces The case management system only its vendor integrates Knowledge Documented, and your team runs it Only the people who built it know how
  1. HardwareYour data centre, or the hosting you choose. Machines tied to the vendor’s own support
  2. Operating systemOpen source: it can be patched without permission. Support and backports, only while you keep paying
  3. Data and configurationOpen formats, restores actually tested. Backups only their own tool can open
  4. Line-of-business appsExportable data, documented interfaces. The case management system only its vendor integrates
  5. KnowledgeDocumented, and your team runs it. Only the people who built it know how

None of the five can be fixed on the day you decide to change supplier. They are decided when the system is built.

Madrid · Barcelona · Paris · Bruxelles. English, español, français. Buy the subscriptions wherever you like: we work the same with yours or without one.

Our services Training catalogue Sustainable technology Technical articles

What you ask us

Can you advise us before a tender?

We can, without writing your specification and without asking for any advantage in return. What we bring is a view on scope, verifiable requirements and acceptance criteria, so that afterwards you can compare bids against each other. The twelve questions above come out of that. And if environmental impact should carry weight, EU procurement rules let you score it in the award: consumption, service life and reuse can be required and rated.

What if we already have an incumbent or an in-house team?

We usually cover what gets escalated when the procedure does not resolve it, or support one specific migration while day-to-day work stays where it is. What each side carries is written down before we start.

Does this lock us in to SIXE?

Open source on its own locks nobody in; what locks you in is nobody else knowing how the thing was built. That is why we document what we deploy and train your team during the project. If you change supplier tomorrow, the infrastructure and the documentation stay with you.

Do you certify NIS2 compliance?

No, and nobody doing the implementation should. NIS2 is transposed differently in each member state, and the assessment has to be independent of whoever did the work. National sovereignty schemes — SecNumCloud in France, BSI C5 in Germany, ENS in Spain — qualify hosting providers rather than integrators. Our part is the technical work that goes in front of the assessor, with the evidence already written up.

Can public bodies actually migrate from Windows to Linux?

It depends on the line-of-business applications, the electronic signature stack and the peripherals. The operating system is almost never the deciding factor. That is why it is done by user profile and tested first with a small group against their real transactions; all at once and across the whole organisation, it almost never works.

Is open source always cheaper?

It removes the licence cost, which on a large estate is substantial, and adds the cost of running it and training people. The sums work or they do not on the full third year, never on the first. Anyone who promises you a saving percentage before looking at your inventory is making it up.

Do you offer 24/7 support?

Yes. A 24/7 rota with response times agreed in the contract. And for a one-off outage, with no prior contract, there is emergency systems support at a published rate.

Tell us about your estate

The kind of organisation, what you have deployed and what worries you is enough. We reply within one working day with an approximate scope and which contracting route fits you.

Email us

Please do not include third-party personal data or classified information in a first message.