Projects

A multi-hour Exchange Online outage in August 2026 showed the company what depends on a single platform: with mail down, Microsoft Teams stopped too, because calendars, meetings and presence are tied to it. The decision was to migrate rather than wait. The target platform for around 50 staff across three sites is a mail system built on Stalwart Mail Server, operated by us under a managed service contract running for an initial two years. Teams follows in a second step, having been the worst affected during the outage. The goal is not to leave Microsoft but to decouple the services whose joint failure brings operations to a halt.

Replacing four grown standalone hypervisors with a three-node Proxmox VE cluster on shared Ceph storage. Migrating 45 production virtual machines across staged maintenance windows with no unplanned downtime. A Proxmox Backup Server was added at a second site with immutable retention and monthly restore tests – the recovery time objective for business-critical systems dropped from twelve hours to under two. We have run the cluster ever since under a service management contract.

The on-premise Windows server was encrypted and operations had stopped. What made the difference between recovery and an existential question was a decision taken long before: a backup at a second location, out of the attacker's reach. Without it, none of what followed would have been possible. We did not restore the server in its old location but moved it straight into a cloud environment hosted in Germany – recovery and migration in one go, so the downtime was not paid for twice. At the same time we replaced the network architecture that had failed to stop the attack: pfSense at the site and in the cloud, an OpenVPN link between them, and the same solution for home office access. A case like this is also the most honest test of a backup strategy. It shows whether recovery was rehearsed or merely planned, and whether anyone knows in which order systems have to come back. What stands afterwards is more resilient than what stood before – but it is not a route anyone should have to take.

Taking over ongoing support for an existing LoginTC installation with which the company secures access to its Windows servers. We began by updating the RADIUS connector that handles authentication – an outdated version is particularly risky here, because it sits in every user's login path. We then reviewed the logs for brute-force attempts and adjusted the thresholds: failed RADIUS requests dropped by 30 per cent, and signing in became noticeably faster and more reliable for users. The engagement closed with a working session with the entire IT team on future operations and training for five people on the platform.

The engagement began with firewalls and networking only: replacing the Securepoint appliances across twelve sites with pfSense, plus centralised endpoint management. A second strand emerged along the way – Microsoft Teams was replaced with Stackfield, the more sensible option under healthcare data protection requirements. Together the changes cut infrastructure licence costs by 40 per cent without weakening collaboration across the sites.

Replacing Microsoft 365 with Nextcloud Hub for 40 staff – files, collaboration, calendars and contacts on one platform the company controls itself. The migration took six months, and the reason is not technical: moving data is the smaller part. The larger one is understanding grown folder structures, rebuilding permissions properly rather than carrying them over, and clarifying working practices that formed over years around the quirks of the old platform. We ran the switch in waves, department by department, with parallel operation during the transition. Each wave came with training, because a migration rarely fails at the server and often fails because people cannot find their way of working again. Going live was not the end of it: since then we hold monthly workshops tailored to what actually comes up in daily work. New features, questions from practice, refinements to the workflows. That is the difference between a solution that has been introduced and one that has been adopted – and the reason nobody has asked to go back to Microsoft 365.

Replacing an outdated Dynamics AX installation with ERPNext – over three years, because an ERP change does not hinge on the system but on the processes behind it. We mapped, questioned and rebuilt 78 workflows in the platform; much of it had grown over the years around the limits of the old system. In parallel we extended the server landscape with Proxmox VE and Proxmox Backup Server, moved three servers across and built the foundation for ERP operations – separate environments for test and production, verified backups, predictable recovery. Today more than 50 people work with the system, with no per-user licence costs and with further development the company controls itself. Handover did not end the engagement: we established a permanent support channel, which we run together with ERPNext partners – day-to-day questions go there, and difficult cases reach someone who knows the platform from the inside.

Migrated an established vSphere environment of eight hosts to XCP-ng, backed by a shared Fujitsu ETERNUS SAN: 60 production virtual machines moved across staged maintenance windows, with management and backup on Xen Orchestra. A further 20 machines joined the new cluster, several of them previously physical servers – 80 systems in all, on a platform with no per-socket licensing costs and no exposure to a single vendor's pricing decisions.

A security assessment of infrastructure, application layer and internal processes ahead of ISO 27001 certification. The certification process itself was led by a specialist agency; our role was the technical depth. Several of the company's IT processes had only just been introduced or were not long in use – we checked whether they genuinely satisfied the standard's controls and tightened them where they did not. The company achieved certification.

Until NoSpamProxy was introduced, the company's email ran without a security solution of its own – every message reached the mailbox unchecked. For a software vendor serving clients in the financial sector, that is an uncomfortable starting point: such companies are a rewarding target for phishing and for attacks posing as a message from a client or from management. We placed the solution in front of the mailboxes, set up the rule set and quarantine, and changed the delivery paths so that messages are inspected before they reach anyone. Since then hardly any spam arrives – and more importantly, staff no longer have to judge for themselves whether a message is genuine.

The company operated services for its clients – some fully, some in part – and supported others, without an up-to-date overview of what ran where and who was responsible for what. Knowledge like that lives in people's heads and in old emails, and it is missing precisely when it is needed: during an incident, when handing over to a colleague, when the scope of a contract comes up. Using Hudu we built documentation that links clients, systems, credentials and responsibilities – more than 100 clients are recorded in it. We chose a structure that stays maintainable in daily work; documentation nobody updates is worthless within three months. Three months of project time, after which the client ran it in-house.

Mapped and analysed 24 core business processes across front- and back-office operations. Identified automation potential in client onboarding, compliance checks and reporting – a 40 per cent reduction in manual effort and a measurable uplift in process maturity within six months.

A three-year IT strategy for a group of ten practices at the time, and delivery of its first phase. As the practices no longer use desktop computers, the focus was the notebook fleet: endpoint management through Microsoft Intune, device management through Lenovo Device Manager, a standardised hardware set and GDPR-compliant cloud backup – within a tight budget. The group has since grown to 29 practices, and the structure has carried that growth.

Replacing a grown firewall infrastructure with nine pfSense systems across seven sites, running as a cluster at the main location for failover. We rebuilt the filter rules from scratch rather than carrying them over – a migration is the one moment when a rule set that has accumulated over years can be cleaned up without resistance. The site-to-site VPN links were rebuilt alongside. We then introduced monitoring with Zabbix that covers not only the firewalls but, across the site VPNs, the servers and IoT devices at each location. The engagement closed with training two members of the authority's staff in administering pfSense and Zabbix.

Guiding a structured selection process in which five platforms – three of them open source – were assessed against more than 180 requirements. The choice fell on Odoo. An official Odoo partner led the implementation; when their resources ran short, we took on what was left and coordinated the interfaces to the existing software. After eight months the system went live, with 60 staff trained.

Most CMDB projects fail not because of the software but because nobody maintains it: after six months the database stands still and everyone is back to spreadsheets. So with iTop we did not just build a configuration database – we had it populated automatically wherever possible, recording what is reachable on the network anyway instead of typing it in by hand. With 8,000 configuration items across 25 client environments, that is not convenience but the precondition for the data being correct. For a systems house looking after other people's environments, it is the difference between being able to answer and having to guess: which systems sit at which client, what a service depends on, what is affected when a server fails. Four months from requirements to production.

Transforming a grown network infrastructure across eight sites in five German states into a segmented architecture with next-generation firewalls. Introducing infrastructure monitoring and moving to a co-managed security model with SIEM, endpoint detection and quarterly vulnerability assessments. The model has run unchanged since 2021 – the in-house IT team handles the day-to-day, we handle the analysis.

The company had grown mainly through acquisitions and ran ten online shops and fifteen physical stores – on six different CRM and ERP systems. We supported the selection, design and rollout of Microsoft Dynamics 365 Business Central: finance, supply chain and CRM on one platform, with the existing e-commerce estate connected to it. The real gain was not any single feature but the end of six parallel worlds.

Building a secure, scalable AWS landing zone for an engineering consultancy moving internal tools and client-facing applications to the cloud. Ten applications were migrated as part of the project. A DevOps programme on CI/CD, infrastructure as code and monitoring followed, attended by fifteen people – with the explicit aim that the team would carry out the remaining migrations itself. That is what happened.