hansenexus

Our stack

We don’t preach sovereignty. We run it.

Almost everything on this page runs on our own infrastructure in Germany, the same kind we build for our clients. Where we still use services outside the EU, it says so below, with the reason.

0102030405
servers of our own in Germany
9
US services replaced
13
services outside the EU, named openly
8

As of September 24, 2026. The list comes from our own systems; new tools only appear once approved.

Our own hardware

Servers in Germany, computers on our own premises.

  • Hetzner Cloud

    Nine servers and a load balancer in Falkenstein and Nuremberg.

    replaces AWS, Azure, Google Cloud

  • ZFS NAS on our own premises

    4 TB of ZFS storage, and a node in the cluster too.

  • Mac mini M4 Pro

    Local language models, transcription and builds.

  • NVIDIA Jetson Orin Nano

    Edge computer for small AI models, a dashboard and a CI runner.

  • Raspberry Pi 4

    Connects the 3D printers to the platform.

Our own cloud

The foundation every application runs on.

  • Kubernetes (k3s)

    Five nodes across the data centre and our own premises, running every application.

  • Traefik

    Routes every request to the right application.

  • Let’s Encrypt + cert-manager

    TLS certificates renew themselves.

  • Flux

    Keeps the cluster services declared in the repository.

  • Harbor

    Our own container registry with security scanning.

    replaces Docker Hub

  • OpenTofu

    The whole infrastructure as code, traceable and repeatable.

  • Headscale (WireGuard)

    An encrypted network between all machines, under our own control.

    replaces Tailscale cloud

  • PostgreSQL (CloudNativePG)

    Databases in the cluster, managed automatically.

  • Docker

    Every application as a container, built the same way, run the same way.

Self-hosted instead of SaaS

The services that would otherwise sit with Google, Microsoft or Slack.

  • Nextcloud with Talk

    Files, calendars, contacts and video calls.

    replaces Google Workspace, Microsoft Teams

  • Collabora Online

    Edit documents together in the browser.

    replaces Google Docs, Office 365

  • Mattermost

    Team chat.

    replaces Slack

  • Plausible

    Web analytics without cookies and without profiles.

    replaces Google Analytics

  • SigNoz + OpenTelemetry

    Monitoring, logs and traces for every application.

    replaces Datadog, Sentry

  • zeit

    Time tracking, built in-house.

    replaces Kimai, Harvest

  • Client portal

    Review and sign contracts digitally, built in-house.

    replaces DocuSign

  • restic + Storage Box

    Encrypted off-site backups, with restores rehearsed regularly.

    replaces backup SaaS

Applications and development

What we build and test software with.

  • TypeScript

    One language from the database to the interface.

  • Next.js

    The foundation of almost every web application.

  • React

    Interfaces built from reusable components.

  • Tailwind CSS

    Styling right in the code, one design system for every page.

  • shadcn/ui + Radix

    Accessible building blocks for forms and dialogs.

  • Convex, self-hosted

    Real-time backend, ten instances in our own cluster.

    replaces Firebase

  • SQLite + Drizzle

    A lean database for small applications.

  • Bun

    A fast runtime and package manager.

  • Turborepo

    One monorepo, builds with a cache.

  • Biome

    One tool for style and error checks.

    replaces ESLint, Prettier

  • Playwright

    Clicks through every important path automatically before anything goes live.

  • Vitest

    Fast tests for the logic behind it.

  • Three.js

    3D in the browser: print previews and virtual tours.

  • Tauri + Rust

    Lean desktop apps.

    replaces Electron

  • Vite

    Build tool for desktop and CAD projects.

  • Astro

    Documentation and project sites.

  • Python

    For audio, CAD and AI tools.

  • GitHub Actions + our own runners

    Tests and builds on every change, on our own machines.

  • Renovate

    Keeps dependencies up to date automatically.

    replaces Dependabot

  • Qonto API

    Business account connected through its API, a provider from the EU.

AI in-house

Models, agents and tools on our own hardware.

  • Hermes Agent

    Self-hosted AI assistant for operations and monitoring, open source.

  • Ollama

    Local language models on our own hardware.

    replaces the OpenAI API for sensitive data

  • LM Studio

    Local models on the Mac, for analysis too.

  • Whisper, local

    Transcription of conversations and dictation without the cloud.

  • Speaker recognition (pyannote)

    Recognises who is speaking in recordings, locally on Apple silicon.

  • Qdrant

    Our own vector database for the knowledge base.

    replaces Pinecone

  • Langfuse

    Makes every AI call traceable.

  • Model Context Protocol

    Ten connections for AI agents: knowledge base, cluster, Nextcloud, monitoring.

  • Orca

    Several AI agents in parallel, each in its own workspace.

Where we still use services outside the EU, and why.

Sovereignty is a path, not a state. We use these services deliberately today. Each one says why, and how we would get out again.

  • GitHub

    USA

    Why: Collaboration and automation in one place.

    Way out: Git is open, and the builds already run on our own runners. We ran our own forge for three months in 2026.

  • Cloudflare

    USA

    Why: Protection and access control we could not run as well on our own.

    Way out: Every DNS record is code and can move to an EU provider.

  • Claude (Anthropic)

    USA

    Why: The strongest model for code and agents, with no European alternative at this level today.

    Way out: Local models can process sensitive data. Our tools are not tied to one model.

  • OpenRouter

    USA

    Why: Emergency operation, so agents keep running during an outage.

    Way out: The next step is local models on our own hardware.

  • Stripe

    USA

    Why: Secure payments without storing card data ourselves.

    Way out: Invoice and bank transfer always work. An EU payment provider is an integration, not a rebuild.

  • Resend

    USA

    Why: Mail from our own server gets rejected by many recipients or lands in spam.

    Way out: Sending goes through plain SMTP. An EU mail service is a setting, not a rebuild.

  • Google Ads

    USA

    Why: People looking for IT help mostly search on Google. No European search engine has the same reach.

    Way out: The site itself does not need Google. Without ads, the service simply goes away.

  • 1Password

    Canada

    Why: End-to-end encrypted, the provider cannot see the contents.

    Way out: Export to open formats. Vaultwarden would be the self-hosted alternative.

The same stack is open to you.

We build it for your company, in Germany, with an exit guarantee. Or we run it for you.

Book intro call

Brand icons: Simple Icons (CC0). The marks belong to their owners and only show what we use.