This page explains what infrastructure Unicis uses to host the platform, where your data lives, and which third-party services we depend on.

Primary Hosting: Scaleway VPS (Amsterdam, EU)

• Location: Amsterdam, Netherlands (EU data residency)
• Service: Virtual Private Server (VPS)
• Availability: EU only (other regions available on request)
• Compliance: GDPR-compliant, NIS2-aligned, CRA-compliant
• Responsibility: Scaleway provides infrastructure; Unicis manages application security and backups

DNS & AI Endpoint: OVH

• Domain DNS management
• AI endpoint infrastructure
• European data center
• Compliance: GDPR-compliant

✅ All customer data remains in the EU

• Platform hosted in Amsterdam (Scaleway)
• No data transfers to non-EU jurisdictions
• Backups stored on EU infrastructure
• Compliant with GDPR Article 44 (restrictions on transfers)
• Compliant with NIS2 Directive Article 21 (security measures)
• Compliant with CRA requirements on data residency

Unicis integrates with trusted third-party services. Each is contractually obligated to meet our security and compliance requirements.

Services Unicis Self-Hosts (On Scaleway VPS):

• ✅ Dolibarr — CRM/subscriptions
• ✅ Nextcloud — Docs/calendar/video (Talk)
• ✅ OpenProject — Project management
• ✅ Moodle — Training
• ✅ Element/Matrix — Internal chat
• ✅ n8n — Integrations/workflows
• ✅ Matomo — Analytics
• ✅ FreeScout — Support (if self-hosted option chosen)

Rationale: Self-hosting critical services reduces vendor lock-in, ensures data remains fully under Unicis control, and maintains compliance with EU data residency requirements. All self-hosted services are on the same Scaleway infrastructure in Amsterdam.

Services on Third-Party Cloud (With Data Processing Agreements):

• ☁️ Mautic — Email/marketing (required for scalability)
• ☁️ Jitsi — Video (required for reliability at scale)
• ☁️ GitHub — Code (industry standard, SCCs in place)
• ☁️ Wise — Payments (PSD2 regulated)
• ☁️ Discord — Community (convenience; no customer data stored)
• ☁️ Fider — Feedback (optional; no customer data stored)

Your compliance data (controls, mappings, assessments, evidence) is:

• ✅ Stored on Scaleway infrastructure in Amsterdam
• ✅ Encrypted at rest (AES-256)
• ✅ Encrypted in transit (TLS 1.2+)
• ✅ Backed up daily to EU infrastructure
• ✅ Accessible only to your team (role-based access control)
• ✅ Logged and audited (ISO 27001 requirement)
• ✅ Not transferred to non-EU jurisdictions

Unicis team operational data (emails, calendars, documents, projects) is handled by:

• Nextcloud — Self-hosted in Amsterdam (EU)
• Element/Matrix — Self-hosted in Amsterdam (EU)
• OpenProject — Self-hosted in Amsterdam (EU)

Operational data does NOT include customer data and is separated by infrastructure and access control.

When customer data is shared with third-party services:

• Data Processing Agreements (DPAs) are in place
• Standard Contractual Clauses (SCCs) for non-EU processors
• Processors must meet ISO 27001 or equivalent
• You retain data ownership and deletion rights
• Examples:
  • Dolibarr: Vendor subscription records (no customer compliance data)
  • FreeScout: Support conversations (not compliance data)
  • GitHub: Application code (not customer data)

All vendors undergo:

Before Onboarding:

• Security questionnaire (see Vendor Questionnaires)
• ISO 27001 or SOC 2 certification verification
• Data Processing Agreement review
• Compliance with GDPR Article 28 (processor obligations)

Ongoing Monitoring:

• Quarterly security reviews
• Compliance audit trail
• Incident response testing
• Annual re-assessment

See Trusted Subprocessors for current vendor list and contract details.

Unicis Platform Reliability:

• Primary: Scaleway VPS with automated backups
• Backup: Daily backups to separate EU storage
• RTO (Recovery Time Objective): ≤ 4 hours for critical systems
• RPO (Recovery Point Objective): ≤ 24 hours for data
• Failover: Automatic restart on infrastructure failure

Supporting Services Reliability:

• Nextcloud: Automatic daily backups, redundancy
• OpenProject: Database backups + version control
• Element/Matrix: Replicated storage in Amsterdam
• FreeScout: Cloud provider maintains uptime SLAs

Infrastructure Costs:

• Scaleway VPS (compute): EU-hosted, economical pricing
• OVH DNS/AI: Separate endpoint infrastructure
• Backups: Included in Scaleway service
• Bandwidth: Intra-EU traffic (lower cost + faster)

Why EU-Only Hosting:

• Cost-effective for EU customer base
• Lowest latency for European users
• Simplified GDPR compliance (no transfers)
• Supports NIS2 and CRA requirements natively

Scaling to Other Regions:

• On-demand: Other EU regions (Paris, London, etc.) on request
• Non-EU regions require customer consent and DPA amendments

Application Stack:

• Language: Node.js + Python backend
• Database: PostgreSQL (self-hosted, encrypted backups)
• Frontend: React/Vue web UI
• API: REST + GraphQL
• Authentication: OAuth 2.0, SAML, SSO-ready

Infrastructure Stack:

• OS: Linux (Ubuntu LTS)
• Containerization: Docker/Kubernetes
• Reverse Proxy: Nginx
• Load Balancing: Application-level
• Monitoring: Grafana + Prometheus
• Logging: ELK Stack (centralized, encrypted)
• IDS/IPS: CrowdSec (self-hosted)

Security Tools:

• Vulnerability Scanning: Trivy, Snyk
• SAST (Static Analysis): SonarQube
• DAST (Dynamic Testing): OWASP ZAP
• SSL/TLS: Let's Encrypt (auto-renewal)
• Secrets Management: Sealed Secrets/Vault

If Unicis Changes Infrastructure:

• 60-day notice via email (compliance requirement)
• Announcement in Discord #announcements
• Updated documentation in this handbook
• Option to request data migration to alternative region
• No change to data protection level

Current Status (October 2026):

• Primary: Scaleway (Amsterdam) — ACTIVE
• Secondary: OVH DNS/AI — ACTIVE
• No migration planned

Our infrastructure choices support:

• ✅ ISO 27001:2022 — Data security
• ✅ ISO 20000-1:2018 — Service reliability
• ✅ NIS2 Directive — Cybersecurity measures
• ✅ CRA Regulation — Product resilience
• ✅ GDPR — Data protection & residency

Unicis has signed contracts with all vendors specifying:

• Data protection obligations
• Uptime SLAs (typically 99.5%–99.9%)
• Incident notification timelines
• Security audit rights
• Termination and data deletion procedures

See Trusted Subprocessors for links to public summaries.

Questions about our infrastructure or tech stack?

→ Email us: security@unicis.tech

← Trust Center | Trusted Subprocessors →

Last reviewed: October 2026 — next review: Q4 2026