SecTepe.Comm– Communication, collaboration & security from one source
SecTepe.Comm is one open-source platform for all the ways your company talks, inside and out. You host it yourself. It brings together Matrix chat, Jitsi video calls, Nextcloud, the Intermal ERP, Keycloak SSO and Wazuh SIEM. Asterisk telephony is in development. All of it comes in one suite with enterprise-grade security.
Request a demoYour alternative to
- Microsoft 365 / Teams
- Google Workspace
- Slack + Zoom
- Salesforce + HubSpot
- Cloud PBX providers
- Mimecast / Proofpoint
Integrated services
All services run in one orchestrated stack. You manage them from one place. They share one login, and data is encrypted end to end.
Messaging
Matrix/Synapse + Element client for E2E encrypted team chat – federated or isolated.
Learn moreMailcow as a full mail server including PGP/S/MIME, anti-spam, DKIM, SPF, DMARC and webmail.
Learn moreVideo conferencing
Jitsi Meet for WebRTC-based HD video conferencing – no participant limit, no cloud gateway.
Learn moreTelephony / PBX
Telephony on Asterisk with click-to-dial and screen pop. In development, not yet rolled out.
Learn moreFiles & documents
Nextcloud with E2E encryption, Paperless-ngx as DMS, Wiki.js / BookStack as knowledge base.
Learn moreERP & CRM
Intermal for sales, invoices, accounting, purchasing, stock and projects.
Learn moreSSO & identity
Keycloak as a central identity & SSO solution with OIDC, SAML and MFA – all services integrated.
Learn moreSecurity & SIEM
Wazuh SIEM, OpenBao secrets management, Coraza WAF, automatic mTLS via Linkerd service mesh.
Learn moreMonitoring & logging
Prometheus, Grafana, Loki (logs) and SigNoz (tracing) for full observability across the stack.
Learn moreNetwork & VPN
Traefik as reverse proxy, Headscale/WireGuard as mesh VPN, AdGuard as DNS filter.
Learn moreAutomation
n8n for workflow automation, bus-gateway and flow-router for event-driven integration.
Learn moreRemote access
RustDesk as a self-hosted remote desktop solution – independent of TeamViewer or AnyDesk.
Learn moreDeployment & operations
You can run SecTepe.Comm the way that suits you. Start small on a single server with Docker Compose. Or go big with a highly available Kubernetes setup and GitOps.
- • Docker Compose for a quick start at small firms
- • Kubernetes + Helm for large firms and HA setups
- • GitOps via Flux CD (optional)
- • Backup of all state, works with Velero
- • 100% open source, so no license cost and no lock-in
Your benefits
- ✓Privacy: All data stays on your own systems. Nothing leaks to the cloud.
- ✓Cost advantage: €50–150/month (SMB) vs. €300–1,000/month for proprietary tools.
- ✓Zero-trust architecture: mTLS, SSO, MFA, WAF and SIEM are built in from the start.
- ✓Scalable: It fits 10 users or 10,000. The platform and the way you manage it stay the same.
How the SecTepe.Comm building blocks work together
SecTepe.Comm combines proven open-source tools with its own SecTepe services. Four shared layers hold them together. Traefik handles all web traffic. Keycloak handles sign-in. NATS JetStream carries events between services. On Kubernetes, Linkerd adds mutual TLS between all pods.
One identity for every service
Keycloak is the single login for the whole suite. It speaks OIDC and supports MFA with TOTP or WebAuthn. Apps without their own OIDC support sit behind a forward-auth check at Traefik. So your staff sign in once and then reach chat, mail and files.
SecTepe adds its own Keycloak extensions. One syncs groups into Matrix. Another checks new passwords against known leaks. An AD connector brings in users from your on-prem Active Directory. A SCIM bridge does the same for cloud directories such as Azure AD or Okta.
Events instead of point-to-point links
Services report what happens as events on a shared bus. Every event uses the same format with source, type, severity and target. The web UI shows them live in its notification center. The flow-router and n8n turn them into actions, such as a Matrix alert or a workflow run.
Ways to run it
- Docker Compose on one server. You switch extra modules on with profiles. A lite setup runs only the base stack.
- Kubernetes with Flux CD, which applies the manifests from Git. Terraform covers IONOS, OpenStack and Hetzner.
- Air-gapped networks, with a registry mirror and pinned base images.
- Branch offices, with a small edge stack on Docker or K3s.
- Backups with Velero, including restore drills.
Data sovereignty and trust
You run every component yourself, on your own servers or with an EU provider such as IONOS. Secrets live in OpenBao. Services can encrypt stored data through OpenBao Transit. The SecTepe code is licensed under Apache 2.0. Upstream tools run unchanged at their core. Container images are signed with Cosign and ship with an SBOM.
Can each customer get its own environment? Yes. A dedicated tenant gets its own Keycloak realm and its own database. Even the smaller dedicated-lite model has its own realm.
Do I have to run every module? No. A minimal core with chat, mail, sign-in and Traefik runs on its own. You add other modules when you need them.
Independent communication starts here
We help you plan, move to and run your own SecTepe.Comm setup.
Request consultingHow we work with you
We see every project as a long-term partnership, not a one-off delivery. Our approach has four clear phases. So you always know what happens next, who is in charge of what and which results to expect.
1. Free initial conversation
We learn about your starting point, your goals and your constraints. In 30 to 45 minutes we check whether our offer fits your situation. We outline possible paths and answer your questions, with no obligation.
2. Structured assessment
We record the current state: technical, organizational and regulatory. You get a prioritized assessment that names strengths, gaps and areas for action. It is the basis for a reliable offer.
3. Delivery with a dedicated lead
An experienced lead guides you through the delivery. You get clear milestones, transparent planning of effort and cost, and a weekly status. All results are documented and belong to you.
4. Continuous operations & review
After the project, we stay with you in operations. This includes managed services, regular reviews and tracking of open actions. We also reach out when new threats, new rules or technology changes come up.
Frequently asked questions about our services
These are the questions we hear most often in first conversations. For anything else, reach our team at hello@sectepe.de or by phone.
- How do we start working with SecTepe?
- Every project starts with a free initial conversation. You then get an offer with a clear scope, timeline and outcome. If you like, we start with a small pilot. That way you get to know how we work before the full project begins.
- What company sizes and sectors do you support?
- We work with small and mid-sized businesses, with corporate divisions and with operators of critical infrastructure (KRITIS). Our core sectors are manufacturing, trades, healthcare, financial services, energy and the public sector. Our focus is the mid-market in the DACH region.
- Do you work on site, remotely or hybrid?
- Both. Assessments, consulting and most managed services run remotely from our German data centers. For workshops, training and incident response on site, we mainly cover North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- We secure confidentiality by contract and by technology. Before every project we sign a mutual non-disclosure agreement. We process data only in German data centers. Access runs through zero-trust rules with multi-factor authentication. All staff are bound to confidentiality by contract and under the GDPR.