This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. ~~NOTOC~~ ====== Infrastructure & Tech Stack ====== This page explains **what infrastructure Unicis uses to host the platform, where your data lives, and which third-party services we depend on**. {{tag>infrastructure hosting tech-stack transparency vendors}} ====== Platform Hosting ====== === Unicis Core Platform === **Primary Hosting:** [[https://www.scaleway.com|Scaleway]] VPS (Amsterdam, EU) * Location: Amsterdam, Netherlands (EU data residency) * Service: Virtual Private Server (VPS) * Availability: EU only (other regions available on request) * Compliance: GDPR-compliant, NIS2-aligned, CRA-compliant * Responsibility: Scaleway provides infrastructure; Unicis manages application security and backups **DNS & AI Endpoint:** [[https://www.ovh.com|OVH]] * Domain DNS management * AI endpoint infrastructure * European data center * Compliance: GDPR-compliant === Data Location === ✅ **All customer data remains in the EU** * Platform hosted in Amsterdam (Scaleway) * No data transfers to non-EU jurisdictions * Backups stored on EU infrastructure * Compliant with GDPR Article 44 (restrictions on transfers) * Compliant with NIS2 Directive Article 21 (security measures) * Compliant with CRA requirements on data residency ====== Third-Party Services (SaaS & Self-Hosted) ====== Unicis integrates with trusted third-party services. Each is contractually obligated to meet our security and compliance requirements. ^ Service ^ Purpose ^ Hosting ^ Data Residency ^ Compliance ^ | **Mautic** | Email marketing, newsletters, lead segments | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **Dolibarr** | CRM, vendor management, subscriptions | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **Nextcloud** | Document storage, calendar, video calls (Talk) | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **OpenProject** | Project management, budgeting, timesheets | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **Moodle** | Training and learning management | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **FreeScout** | Support ticketing and inbox management | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **Fider** | Feedback and feature roadmap | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **Element/Matrix** | Internal team communication | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **n8n** | Workflow automation and integrations | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **Matomo** | Analytics and usage metrics | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **Jitsi** | Video conferencing (15+ participants) | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **LimeSurvey** | Surveys, polls, feedback collection | Self-hosted on Unicis infrastructure | Amsterdam, EU | GDPR | | **GitLab EU** | Proprietary code repository & CI/CD | Self-hosted / EU-based GitLab | EU | GDPR | | **Wise** | Payment processing and transfers | Cloud | EU | GDPR, PSD2 | | **Discord** | Community and partner communication | Cloud | US/EU | GDPR (SCCs) | ====== Self-Hosted vs. Cloud ====== **Services Unicis Self-Hosts (On Scaleway VPS):** * ✅ Dolibarr — CRM/subscriptions * ✅ Nextcloud — Docs/calendar/video (Talk) * ✅ OpenProject — Project management * ✅ Moodle — Training * ✅ Element/Matrix — Internal chat * ✅ n8n — Integrations/workflows * ✅ Matomo — Analytics * ✅ FreeScout — Support ticketing * ✅ Mautic — Email/marketing **(deprecated soon)** * ✅ Fider — Feedback/roadmap * ✅ Jitsi — Video conferencing (15+ participants) * ✅ LimeSurvey — Surveys/polls/feedback **Code Repository:** * ✅ GitLab EU — Proprietary code repository and CI/CD pipeline (EU-based) **Rationale:** Self-hosting critical services reduces vendor lock-in, ensures data remains fully under Unicis control, and maintains compliance with EU data residency requirements. All self-hosted services are on the same Scaleway infrastructure in Amsterdam. Proprietary code is stored in EU-based GitLab. **Services on Third-Party Cloud (With Data Processing Agreements):** * ☁️ Wise — Payments (PSD2 regulated, no customer data stored) * ☁️ Discord — Community (convenience; no customer data stored) ====== Data Processing & Security ====== === Customer Data === Your compliance data (controls, mappings, assessments, evidence) is: * ✅ Stored on Scaleway infrastructure in Amsterdam * ✅ Encrypted at rest (AES-256) * ✅ Encrypted in transit (TLS 1.2+) * ✅ Backed up daily to EU infrastructure * ✅ Accessible only to your team (role-based access control) * ✅ Logged and audited (ISO 27001 requirement) * ✅ Not transferred to non-EU jurisdictions === Operational Data === Unicis team operational data (emails, calendars, documents, projects) is handled by: * **Nextcloud** — Self-hosted in Amsterdam (EU) * **Element/Matrix** — Self-hosted in Amsterdam (EU) * **OpenProject** — Self-hosted in Amsterdam (EU) * **GitLab EU** — Proprietary code (EU) Operational data does NOT include customer data and is separated by infrastructure and access control. === Third-Party Data Processing === When customer data is shared with third-party services: * Data Processing Agreements (DPAs) are in place * Standard Contractual Clauses (SCCs) for non-EU processors * Processors must meet ISO 27001 or equivalent * You retain data ownership and deletion rights * Examples: * Dolibarr: Vendor subscription records (no customer compliance data) * FreeScout: Support conversations (not compliance data) * GitLab: Application code (not customer data) ====== Vendor Assessment & Monitoring ====== All vendors undergo: **Before Onboarding:** * Security questionnaire (see [[pub:trust_center:vendor_questionnaires|Vendor Questionnaires]]) * ISO 27001 or SOC 2 certification verification * Data Processing Agreement review * Compliance with GDPR Article 28 (processor obligations) **Ongoing Monitoring:** * Quarterly security reviews * Compliance audit trail * Incident response testing * Annual re-assessment See [[pub:trust_center:subprocessors|Trusted Subprocessors]] for current vendor list and contract details. ====== High Availability & Disaster Recovery ====== **Unicis Platform Reliability:** * Primary: Scaleway VPS with automated backups * Backup: Daily backups to separate EU storage * RTO (Recovery Time Objective): ≤ 4 hours for critical systems * RPO (Recovery Point Objective): ≤ 24 hours for data * Failover: Automatic restart on infrastructure failure **Supporting Services Reliability:** * Nextcloud: Automatic daily backups, redundancy * OpenProject: Database backups + version control * Element/Matrix: Replicated storage in Amsterdam * FreeScout: Local backups + redundancy * Jitsi: Video sessions (no persistent data storage) * GitLab EU: Repository backups + CI/CD logs ====== Cost Transparency ====== **Infrastructure Costs:** * Scaleway VPS (compute): EU-hosted, economical pricing * OVH DNS/AI: Separate endpoint infrastructure * Backups: Included in Scaleway service * Bandwidth: Intra-EU traffic (lower cost + faster) **Why EU-Only Hosting:** * Cost-effective for EU customer base * Lowest latency for European users * Simplified GDPR compliance (no transfers) * Supports NIS2 and CRA requirements natively **Scaling to Other Regions:** * On-demand: Other EU regions (Paris, London, etc.) on request * Non-EU regions require customer consent and DPA amendments ====== Technical Specifications ====== **Application Stack:** * Language: Node.js + Python backend * Database: PostgreSQL (self-hosted, encrypted backups) * Frontend: React/Vue web UI * API: REST + GraphQL * Authentication: OAuth 2.0, SAML, SSO-ready **Infrastructure Stack:** * OS: Linux (Ubuntu LTS) * Containerization: Docker/Kubernetes * Reverse Proxy: Nginx * Load Balancing: Application-level * Monitoring: Grafana + Prometheus * Logging: ELK Stack (centralized, encrypted) * IDS/IPS: CrowdSec (self-hosted) **Code Repository & CI/CD:** * Repository: GitLab EU (proprietary code) * CI/CD: GitLab Runners (EU-based) * Branching: Git flow with protected main branch * Deployment: Automated via GitLab CI/CD pipeline **Security Tools:** * Vulnerability Scanning: Trivy, Snyk * SAST (Static Analysis): SonarQube * DAST (Dynamic Testing): OWASP ZAP * SSL/TLS: Let's Encrypt (auto-renewal) * Secrets Management: Sealed Secrets/Vault ====== Changes & Notifications ====== **If Unicis Changes Infrastructure:** * 60-day notice via email (compliance requirement) * Announcement in Discord #announcements * Updated documentation in this handbook * Option to request data migration to alternative region * No change to data protection level **Current Status (October 2026):** * Primary: Scaleway (Amsterdam) — ACTIVE * Secondary: OVH DNS/AI — ACTIVE * Code Repository: GitLab EU — ACTIVE * Mautic: Self-hosted, will deprecate soon * Fider: Self-hosted, active * Jitsi: Self-hosted, active * LimeSurvey: Self-hosted, active * No migration planned ====== Security & Compliance ====== Our infrastructure choices support: * ✅ [[pub:trust_center:iso_27001_overview|ISO 27001:2022]] — Data security * ✅ [[pub:trust_center:iso_20000_1_overview|ISO 20000-1:2018]] — Service reliability * ✅ [[pub:trust_center:nis2_scope_determination|NIS2 Directive]] — Cybersecurity measures * ✅ [[pub:trust_center:cra_scope_determination|CRA Regulation]] — Product resilience * ✅ [[pub:trust_center:policies:privacy_policy|GDPR]] — Data protection & residency ====== Vendor Contracts & SLAs ====== Unicis has signed contracts with all vendors specifying: * Data protection obligations * Uptime SLAs (typically 99.5%–99.9%) * Incident notification timelines * Security audit rights * Termination and data deletion procedures See [[pub:trust_center:subprocessors|Trusted Subprocessors]] for links to public summaries. ====== Questions? ====== Questions about our infrastructure or tech stack? → Email us: **security@unicis.tech** ---- ==== Navigation ==== ← [[pub:trust_center|Trust Center]] | [[pub:trust_center:subprocessors|Trusted Subprocessors →]] ---- //Last reviewed: October 2026 — next review: Q4 2026// {{tag>infrastructure hosting tech-stack scaleway ovh vendors transparency}}