Nextcloud & DMS– File Collaboration
Nextcloud lets your team work on files securely. Paperless-ngx is the DMS for a paperless office. Wiki.js and BookStack hold your knowledge base. You log in to all of them via SSO.
Request a demoAt a glance
- Nextcloud E2E
- Paperless-ngx DMS
- OCR for receipts
- Wiki.js & BookStack
- Office integration
- Mobile + desktop sync
Features at a glance
Documents, shared files and a knowledge base come together here. The result is one complete workspace you can search.
Nextcloud Files
Share and sync files, and work on them together. This works on desktop, mobile and the web.
Paperless-ngx OCR
Manage documents without paper. Full-text OCR, tags and correspondents keep them in order.
Wiki.js
A modern wiki with a Markdown editor. It keeps every version and lets you set fine-grained rights.
BookStack
A knowledge base sorted into books, chapters and pages. It is easy to read and edit.
Office Integration
Edit Word, Excel and PowerPoint files together in real time. This runs via OnlyOffice or Collabora.
Versioning & Audit
Each change is logged, and you can undo it. That helps with compliance and audits.
Technology & integration
Nextcloud, Paperless-ngx and the wikis all use the central identity. Files sit on S3-compatible object storage. They can be indexed from end to end.
- • Nextcloud Hub + clients
- • Paperless-ngx OCR (Tesseract)
- • Wiki.js GraphQL
- • BookStack LAMP stack
- • OnlyOffice/Collabora integration
- • S3-compatible object storage
Your benefits
- All documents under your control
- Searchable OCR archive
- Real-time collaboration
- GDPR-compliant retention
How files & documents work in practice
Files and documents are spread across a few services that share one login. Nextcloud holds your working files. Collabora Online lets you edit office files in the browser. Paperless-ngx archives scans and finished documents.
How the parts fit together
- Nextcloud is the file store. People sync it with the desktop and mobile apps or work in the browser.
- Collabora opens DOCX, XLSX and PPTX as well as ODF files right inside Nextcloud. Sign-in stays with Nextcloud, since Collabora has no user accounts of its own.
- Paperless-ngx reads text from documents with Tesseract OCR. By default it reads German and English. Gotenberg converts Office files, and Apache Tika extracts their text. Paperless can also pull attachments from an IMAP mailbox.
- Before Paperless imports a file, a hook scans it with YARA and ClamAV through the mail security gateway.
Typical use cases
- Share a project folder with your team and edit a draft together.
- Protect sensitive folders with end-to-end encryption. You turn it on per folder. It works in the desktop and mobile apps, not in the web interface.
- Drop invoices or letters into the Paperless inbox folder. They get imported, read by OCR and made searchable.
- Link Nextcloud files from the SecTepe Wiki, Moodle or TheHive with a file picker.
Operation and data control
On Kubernetes, Nextcloud stores file content in IONOS Object Storage in the eu-central-1 region. IONOS encrypts these objects on the server side. Program files and the database sit on block storage with AES-256-XTS. Database backups go to S3 and are encrypted with AES-256. Passwords and keys for the services live in OpenBao.
Paperless roles follow Keycloak groups and update at every login. In the dedicated-lite tenant model, each customer gets its own Nextcloud instance. Customers sign in as normal users. Only the platform operator holds the global admin account.
Common questions
Can the server read end-to-end encrypted files? No. The app encrypts these files on your device before upload. The server cannot decrypt them.
Who holds the storage keys? IONOS manages and rotates the keys for block and object storage. Customer-managed keys are not the default. They are an optional hardening step.
Can Paperless delete old documents on its own? Yes. You can set retention rules that delete documents automatically.
Ready for files & documents?
Let's build your document platform. We start with the Nextcloud rollout and finish with an OCR archive you can fully search.
How we work with you
We see every project as a long-term partnership, not a one-off delivery. Our approach has four clear phases. So you always know what happens next, who is in charge of what and which results to expect.
1. Free initial conversation
We learn about your starting point, your goals and your constraints. In 30 to 45 minutes we check whether our offer fits your situation. We outline possible paths and answer your questions, with no obligation.
2. Structured assessment
We record the current state: technical, organizational and regulatory. You get a prioritized assessment that names strengths, gaps and areas for action. It is the basis for a reliable offer.
3. Delivery with a dedicated lead
An experienced lead guides you through the delivery. You get clear milestones, transparent planning of effort and cost, and a weekly status. All results are documented and belong to you.
4. Continuous operations & review
After the project, we stay with you in operations. This includes managed services, regular reviews and tracking of open actions. We also reach out when new threats, new rules or technology changes come up.
Frequently asked questions about our services
These are the questions we hear most often in first conversations. For anything else, reach our team at hello@sectepe.de or by phone.
- How do we start working with SecTepe?
- Every project starts with a free initial conversation. You then get an offer with a clear scope, timeline and outcome. If you like, we start with a small pilot. That way you get to know how we work before the full project begins.
- What company sizes and sectors do you support?
- We work with small and mid-sized businesses, with corporate divisions and with operators of critical infrastructure (KRITIS). Our core sectors are manufacturing, trades, healthcare, financial services, energy and the public sector. Our focus is the mid-market in the DACH region.
- Do you work on site, remotely or hybrid?
- Both. Assessments, consulting and most managed services run remotely from our German data centers. For workshops, training and incident response on site, we mainly cover North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- We secure confidentiality by contract and by technology. Before every project we sign a mutual non-disclosure agreement. We process data only in German data centers. Access runs through zero-trust rules with multi-factor authentication. All staff are bound to confidentiality by contract and under the GDPR.