Everything you cancommission.
The capabilities page organises the work. This is the menu: the individual things a client can ask for, each a real thing we operate on Linux. If what you need is not here, ask. Our list of things we do not do is short and clear.
mcp, static ip, 1 gbps
MCP server hosting
The Model Context Protocol servers your assistants and agents call, hosted on dedicated resources on our own hardware in Drenthe, with a static IP address and a 1 Gbps link.
Included
- Dedicated resources, no other customer's code beside yours
- Our own hardware in Drenthe, the Netherlands
- A static IP address and an HTTPS URL on your domain or ours
- A 1 Gbps network link
- Deployment, patching, restarts and logs of every tool call
Not included
We do not host MCP servers whose tools act with no person able to see or undo what they did. Tools that write get scoped access and a log, or we do not run them.
almalinux, nginx, tls
Managed Linux hosts
A server configured for what you run. We provision it, harden it, patch it weekly, and a named person answers for it when it misbehaves.
Included
- AlmaLinux, hardened and patched weekly
- nginx in front, certificates renewed automatically
- DNS under management, the zone file in your account
- Daily backups to local disks, with restores tested
Not included
Multi-region active-active failover, where your site runs in several data centres at once. It is usually a different shop's job: we point you to the right one, or scope it as separate work if you want it from us.
postfix, dkim, s/mime
Mail that lands
Mail fails without warning: it does not go down, it goes to spam. We run Postfix with DKIM, aligned SPF and DMARC, and S/MIME keys on your domain, so a reply is verifiably from you.
Included
- Postfix and OpenDKIM, configured and monitored
- SPF, DKIM and DMARC aligned, with reports a person actually reads
- S/MIME keys issued, installed on your devices, and rotated
- Bounce handling and reputation monitoring
Not included
We do not send bulk marketing mail or cold outreach. That needs an email service provider built for it.
next.js, typescript, apis
Web applications
The application on top of the infrastructure, built in weekly slices and shipped as working pieces. You get the source, the CI, and the runbook that operates it.
Included
- Design through build to launch, in weekly slices
- APIs, third-party integration, and data migration
- Performance and accessibility budgets set before the build
- Source, CI and runbooks handed over at the end
Not included
We do not take on rescue jobs where we are asked to fix an existing application but not allowed to change its code. Without that, nobody can fix it, and we would rather say so before you pay for it.
postgres, redis, backups
Databases and data
The data your app depends on, set up properly. PostgreSQL or MariaDB, caching in Redis, migrations that can be rolled back, and backups you can actually restore from.
Included
- PostgreSQL or MariaDB, tuned for your workload
- Redis for caching and queues where it earns its place
- Schema migrations with a rollback path
- Point-in-time backups and restores that are tested
Not included
We do not put your data in a database shared with other customers. Each database is yours alone.
nftables, tls, audit
Hardening and security
The basic work that keeps a server secure. A firewall with a small, known open surface, current TLS with HSTS, security headers, scheduled patching, and logs that go somewhere a person looks.
Included
- nftables or UFW, with the fewest open ports that still work
- TLS with HSTS and a strict security-header set
- fail2ban and account hardening
- Patching on a schedule, with a written audit trail
Not included
We do not issue security audits or certifications. We do the hardening and point you to an outside firm that certifies it.
prometheus, grafana, status
Monitoring and on-call
If it is running, it is being watched. Metrics, logs, and uptime go to dashboards and alerts. The state is published on a status page you can link to.
Included
- Prometheus and Grafana for metrics and dashboards
- Uptime checks with a public status page and feed
- Log aggregation you can read back later
- Alerts go to a named person
Not included
We do not offer 24/7 cover. We are in one time zone and keep long hours (Mon–Fri 08:30–23:00 · Sat–Sun 11:00–00:00 CET), and we tell you when we are asleep.
docker, podman, jobs
Containers and services
The services around your app: a search index, a worker, a scheduler. We package them as containers with health checks, run them on a single host, and keep the images rebuildable from source.
Included
- Docker or Podman, with stacks described in a file you can read
- Health checks and automatic restarts
- Scheduled jobs and queue workers that survive a reboot
- Image builds you can reproduce from source
- Separate virtual machines on the host where a service needs its own isolation
Not included
We do not run Kubernetes or clusters spread over several machines. Several containers or virtual machines on one host, each kept apart from the others, is the honest tool for what we run.
agents, pipelines, local models
Automation and AI
Language models wired into the places where they earn their cost: reading documents, drafting, sorting and routing. Every action is logged, and a person can undo it.
Included
- Document pipelines, triage and internal tools
- Agents with tool access, scoped and rate-limited
- Local models on our own hardware where the data requires it
- Cost modelling before the build, and spend monitoring after
- An audit trail of every write, and a rollback path
Not included
We do not build autonomous systems with no person in the loop, or chatbots bolted onto a marketing site. If a simple rules engine would do the job, we will tell you that instead.
meilisearch, rag, embeddings
Search and retrieval
Find things in your own data, on your own hardware where required. A search index over your content, or retrieval wired to a model, with results you can audit. Your data is never used to train our models or anyone else's.
Included
- Meilisearch or Typesense for fast, filterable search
- Retrieval over your own documents, hosted where it is allowed
- Embeddings and reranking, tuned to your corpus
- Local or on-premises models where residency requires it
- A small model trained for you on request, only on data you provide, on our own GPUs
Not included
We do not train foundation models, the large base models behind tools like ChatGPT, and we never train on client data for our own use. We only train on data a client gives us for their own model, or data whose licence lets us.
cutover, runbooks, keys
Migrations and handover
Leaving shared hosting or another provider without a surprise. We plan the cutover in writing, move the domain and data, and hand over everything so you are never locked to the person who built it.
Included
- A written migration plan with the cutover window
- Domain, DNS, data and certificates moved without loss
- Runbooks and credentials handed over, yours from day one
- A read-only review of your current stack before we touch it
Not included
We do not take open-ended retainers with nothing defined to deliver. A migration plan is a deliverable; paying for someone's time with no end point is a different contract.
stack review, spend audit, roadmap
Reviews and plans
Two or three sessions, read-only access to what exists, and a written document at the end. No slides. A plan you could hand to another supplier and they would understand it.
Included
- Stack review: what runs where, and what it costs
- Spend audit across hosting, SaaS, and model usage
- A roadmap in order, with the dependencies written out
- A migration plan, including the parts that will hurt
Not included
We do not take money for introducing you to vendors. If we point you to another supplier, nobody pays us for it. If the answer is to change nothing, you still get the document.
Not sure what you need?
Describe what you are running now. We will tell you which of these you need, and which ones you can skip.