# Developer Platform Switzerland

> VSHN builds and operates your internal developer platform with GitLab, Crossplane, and OpenTofu. Strategy to 24/7 operations for regulated Swiss organizations.

VSHN builds and operates internal developer platforms for regulated Swiss organizations. GitLab, Crossplane, OpenTofu, ArgoCD, OpenBao, and Kubernetes, assembled into a working platform and kept running 24/7 by certified engineers. Your team ships features. We keep the platform up.


## Pages

- [Homepage](https://www.developer-platform.ch/): Internal Developer Platform – Build & Operate | VSHN
- [Developer Platform Partners | VSHN](https://www.developer-platform.ch/partners.md)
- [Developer Platform Data Sovereignty | VSHN](https://www.developer-platform.ch/sovereignty.md)

## Features

- **GitOps-Native CI/CD with GitLab**: GitLab is the source control, CI/CD, and container registry for your platform, configured and managed by VSHN as a GitLab Select Partner. Pipelines run on self-hosted runners so build artifacts and secrets never leave your Swiss infrastructure. VSHN has operated GitLab for Swiss organizations since 2015.

- **Self-Service Infrastructure with Crossplane**: Crossplane turns your Kubernetes cluster into a control plane for cloud resources. VSHN, listed as an official Crossplane commercial vendor, builds the composite resource definitions so your developers can provision databases, queues, and object storage through pull requests instead of opening tickets to an operations team.

- **Infrastructure as Code with OpenTofu**: All infrastructure is defined in OpenTofu, the fully open-source Terraform fork. VSHN manages state backends on Swiss infrastructure so nothing is stored on third-party SaaS. Every change goes through GitLab CI, with plan reviews before apply, keeping your platform auditable from day one.

- **GitOps Continuous Delivery with ArgoCD**: ArgoCD keeps your Kubernetes clusters in sync with the Git repository. Developers push changes and ArgoCD reconciles the target state automatically. Drift is detected and corrected without manual intervention, giving you a reliable delivery chain that regulated-industry auditors can follow.

- **Secrets and Certificate Management with OpenBao**: OpenBao, the open-source Vault fork without vendor licensing restrictions, handles secret storage, dynamic credentials, and PKI for your platform. VSHN configures OpenBao with the access policies your teams need and rotates credentials automatically, reducing the blast radius if any one credential is compromised.

- **24/7 Certified Platform Operations**: VSHN has operated Kubernetes in production since 2016 as Switzerland's first CNCF Kubernetes Certified Service Provider. Your platform gets 24/7 monitoring, incident response at the coverage level you choose, security patching, and quarterly operational reviews from CKA-certified engineers who have already handled the failure modes your team has not yet encountered.


## What every platform engagement covers

- **Platform Strategy and Architecture**: A VSHN architect maps your current state, defines the target platform architecture, and produces a phased rollout plan before any code is written.

- **GitLab Setup and Operations**: Installation, configuration, and ongoing operations of GitLab, including runner management, access control, and GitLab Select Partner support coverage.

- **Crossplane Control Plane**: Crossplane composite resource definitions for the cloud services your teams need, deployed on Cloudscale, Exoscale, or your Azure tenant and kept current as providers evolve.

- **OpenTofu State and Pipeline**: OpenTofu state backends on Swiss-hosted S3 or in your cloud tenant, GitLab CI integration for plan-and-apply workflows, and module library for repeatable infrastructure including Azure landing zones.

- **ArgoCD Delivery Pipeline**: ArgoCD installed and configured for your cluster topology, with application sets, sync waves, and access policies matching your team structure.

- **OpenBao Secret Management**: OpenBao deployment with authentication backends, secret engines, and PKI hierarchy configured for your platform, with automated credential rotation.

- **Kubernetes Cluster Operations**: 24/7 monitoring, upgrade management, node pool scaling, and security baseline enforcement across every cluster in your platform environment.

- **Monitoring and Alerting**: Prometheus, Alertmanager, and Grafana configured for platform and workload metrics, with alert routing and runbooks for common failure modes.

- **Backup and Restore**: Automated encrypted backups for stateful platform components, with periodic restore drills and documented recovery runbooks verified quarterly.

- **Quarterly Platform Reviews**: Structured review each quarter covering capacity trends, security advisories, upgrade roadmap, and recommendations for the next 90 days.

- **Developer Onboarding**: Documentation, workshops, and office-hours support to get your engineering teams productive on the platform within the first two weeks.


## Trusted by regulated Swiss organizations

- [HIN](https://www.vshn.ch/en/success-stories/hin-health-info-net/)
- [Finnova](https://www.vshn.ch/en/success-stories/finnova/)
- [acrevis](https://www.vshn.ch/en/success-stories/acrevis/)

## Testimonials

> It was an amazing experience to switch to DevOps and empower our developers with a whole new culture.

> — Mohammad Alavi, CTO, Health Info Net

## Developer Platform FAQ

### What is an internal developer platform and why does my organization need one?

An internal developer platform is a curated set of tools and APIs that lets your engineering teams provision infrastructure, run CI/CD pipelines, and deploy applications without depending on a central ops team for every change. Organizations move to a platform model when ticket queues become a bottleneck: change freezes, slow deployments, and developer frustration caused by waiting for manual approvals. As AI accelerates code generation, the decisive question shifts from how code gets written to who controls the runtime where it runs. A well-operated platform replaces ticket friction with self-service backed by guardrails and SLAs, while keeping your organization in control of its own deployment infrastructure.


### Which tools make up the VSHN developer platform blueprint?

The blueprint uses six open-source components: [GitLab](https://www.gitlab.ch) for source control and CI/CD, [Crossplane](https://www.crossplane.ch) for self-service cloud infrastructure provisioning, OpenTofu for infrastructure as code, ArgoCD for GitOps continuous delivery, [OpenBao](https://www.openbao.ch) for secrets and certificate management, and Kubernetes as the runtime layer. VSHN is a GitLab Select Partner, an official Crossplane commercial vendor, and Switzerland's first CNCF Kubernetes Certified Service Provider since 2016. All components run on Swiss infrastructure.


### Can we start with one component instead of the whole blueprint?

Yes, and most engagements do. The blueprint describes where a platform ends up, not what you have to buy on day one. A common first step is a managed GitLab instance with self-hosted runners and infrastructure as code for the resources around it, which delivers self-service CI/CD before any Kubernetes cluster exists. Crossplane, ArgoCD, and a container runtime get added as teams are ready for them. Kubernetes is not a prerequisite for starting. VSHN scopes each phase separately so you can evaluate the result before committing to the next one.


### What SLA does VSHN provide for platform operations?

VSHN provides a written SLA for platform operations covering incident response times and monitoring coverage. Managed platform components can reach a 99.99% availability SLA on Swiss infrastructure when deployed on Cloudscale or Exoscale in a high-availability configuration. Not every component is highly available by default, and some, container registries being the common example, need a specific architecture or a cloud provider service to get there. The assessment phase identifies which parts of your platform genuinely need high availability and what each one costs, so the SLA you sign matches the architecture you get. VSHN has operated production infrastructure for regulated Swiss organizations since 2014.


### Do we have to buy 24/7 support for the whole platform?

No. Support coverage is chosen per engagement and priced separately from platform operations, so you do not pay for a service level you do not need. Options range from business-hours support with best-effort out-of-hours handling to full 24/7 coverage with guaranteed response times and phone escalation. The two can be combined: several regulated customers run business-hours support year-round and add scheduled 24/7 coverage for defined release or migration weekends. It is also common to put production runtime on 24/7 while build tooling stays on business hours, because a stalled pipeline at 3am is not an incident.


### How much does building and operating a developer platform cost?

Platform engineering engagements at VSHN are quoted in CHF and priced by scope: the build phase covers architecture, component setup, and team onboarding; the operations phase is a recurring monthly fee covering monitoring, incident response, upgrades, and quarterly reviews at the support coverage you choose. Because the blueprint assembles established open-source components rather than building a platform from scratch, standing up a first component is typically measured in days of engineering, not a six-figure integration project. Running your own platform operations requires three to six full-time engineers at CHF 150,000 to 200,000 each per year. VSHN delivers equivalent coverage for significantly less because the operations cost is shared across multiple clients. Contact us for a scoped estimate.


### Where is the platform infrastructure hosted?

VSHN operates platforms on Cloudscale and Exoscale (Swiss cloud providers with data centers in Switzerland), on your own Azure or AWS tenant, or on-premises. For organizations that need a hyperscaler for strategic reasons (e.g., Azure because of a data platform like Databricks), VSHN builds and operates the developer platform inside your tenant so you keep full control. For organizations that want to avoid hyperscaler dependency entirely, Cloudscale and Exoscale provide Swiss data residency with no CLOUD Act exposure. The blueprint works on any infrastructure.


### Who is responsible for what when the platform runs in our own cloud tenant?

The split is written down before the build starts. In a typical Azure or AWS tenant engagement, your organization owns the tenant itself, the subscription structure, the identity provider, and the security and network policies your compliance team mandates. VSHN owns the infrastructure as code that creates the platform resources, the platform components on top, and their day-to-day operation. This boundary is where tenant-based projects usually lose time, so the assessment phase produces a written responsibility matrix instead of leaving it to be discovered during implementation.


### Can the platform run with restricted network access?

Yes. VSHN operates platforms behind IP allowlists, on private networking, with no public ingress on management interfaces. CI/CD runners can be confined to an egress allowlist or pointed at an internal package and container mirror, so builds never pull directly from public registries. For banks, insurers, and healthcare organizations this is frequently the requirement that rules out SaaS CI/CD entirely. The allowlist and mirror strategy is defined during the assessment phase, because retrofitting network restrictions onto working pipelines means rebuilding them.


### Are backups included for platform components?

Yes. VSHN configures automated encrypted backups for all stateful platform components, including GitLab repositories and configuration, OpenBao secrets backends, and cluster state. Backups are stored on Swiss-hosted object storage or in your cloud tenant. VSHN performs quarterly restore drills with documented runbooks so recovery procedures are tested and verified before you need them, not only after an incident forces the issue.


### Is VSHN a GitLab partner?

Yes. VSHN is a GitLab Select Partner, which means VSHN engineers have direct access to GitLab support escalation paths and partner training programs. Customers who run GitLab through VSHN benefit from this relationship when they need support on complex GitLab questions that go beyond standard documentation. VSHN has operated GitLab for Swiss organizations since 2015 and manages GitLab for regulated customers including Finnova and the Swiss Federal Archives. Service details, SLAs, and pricing are on [gitlab.ch](https://www.gitlab.ch).


### Do we buy GitLab licenses through VSHN or bring our own?

Either works. As a GitLab Select Partner, VSHN can resell GitLab subscriptions including the Premium and Ultimate tiers, or operate an instance on a license your organization already holds. Regulated organizations usually land on Ultimate, because security scanning, compliance frameworks, and audit reporting are Ultimate features rather than Premium ones. The license cost is separate from the VSHN operations fee and is quoted as its own line item, so you always see what goes to GitLab and what goes to VSHN.


### How does Crossplane fit into a developer platform?

Crossplane is installed on your Kubernetes cluster and connects to cloud provider APIs. VSHN, listed as an official Crossplane commercial vendor, builds composite resource definitions so your developers can provision a managed PostgreSQL database or an S3 bucket through a pull request without contacting the infrastructure team. Crossplane supports any cloud provider. VSHN's Crossplane production experience covers Cloudscale and Exoscale providers specifically, with Azure and other providers supported through OpenTofu for the landing zone layer. More on the Crossplane practice: [crossplane.ch](https://www.crossplane.ch).


### What compliance and certifications does VSHN bring to the platform?

VSHN is ISO 27001 certified and was Switzerland's first CNCF Kubernetes Certified Service Provider in 2016. VSHN operates production infrastructure for regulated organizations including HIN, which serves over 90% of Swiss healthcare stakeholders, Finnova and acrevis in Swiss banking, and the Swiss Federal Archives. When your compliance team or auditors ask for evidence of operational rigor, you can point to verifiable certifications and named Swiss references rather than compiling documentation from scratch.


### Can AI replace the need for a developer platform team?

AI coding assistants accelerate application code, but platform architecture remains a human skill. Industry analysis rates AI impact on code generation as medium and on architecture as low: AI can generate a Terraform file or a Kubernetes manifest, but it cannot design the abstraction layer, the access policies, the upgrade strategy, or the incident response runbooks that make a platform production-grade. The value of an internal developer platform lies in its design and operations, not in the code that implements it. VSHN brings the architectural judgment and 24/7 operational experience that AI tools do not provide.


### Does the platform infrastructure support CSRD sustainability reporting?

Yes. Enterprises with 1000 or more employees must report the environmental impact of their cloud services under CSRD. When VSHN deploys your platform on Exoscale, you get access to CloudAssess, an automated Life Cycle Assessment tool that provides monthly environmental impact data for your sustainability reports. Exoscale data centers in Switzerland and Germany run on 100% renewable energy. For platforms deployed on other infrastructure, VSHN can help you document the environmental footprint of your stack.


### How long does it take to build and launch a developer platform?

A typical platform rollout runs in three phases: architecture and design takes two to four weeks, component setup and automation runs four to eight weeks depending on scope and integration complexity, and team onboarding and handoff takes two weeks. The timeline varies with the number of clusters, existing tooling to migrate, and your team's availability for workshops. VSHN provides a phased plan with milestones before any work starts, so you know exactly what is delivered at each stage and can adjust scope before committing to the full engagement.


## Start with a Platform Assessment

Tell us about your current setup: how many teams, what deployment bottlenecks you are hitting, and what compliance requirements apply. A VSHN platform engineer will review your situation and propose a tailored platform architecture with a phased rollout plan. No commitment required at the assessment stage.


Booking: #contact

## Testimonials Heading

What our customers say

---

## Developer Platform Partners | VSHN

# Technology partners behind your developer platform

VSHN does not build proprietary platform tooling. We assemble your internal developer platform from best-of-breed open-source projects, backed by vendor partnerships that give us direct access to engineering teams, roadmaps, and support channels. When issues arise at 3 AM, we have a direct line to the teams who built the platform.

## Technology partnerships

**GitLab Select Partner.** VSHN is a GitLab Select Partner in Switzerland, with certified engineers and a direct relationship with GitLab's partner engineering team. We operate GitLab as the source control, CI/CD, and container registry backbone of developer platforms. Partnership documented on [vshn.ch](https://www.vshn.ch/en/partners/technology-partners/). Service details, SLAs, and pricing: [gitlab.ch](https://www.gitlab.ch).

**Official Crossplane vendor.** VSHN is listed as an official Crossplane vendor on [crossplane.io/commercial](https://www.crossplane.io/commercial). We maintain open-source Crossplane providers for Cloudscale and Exoscale, and contribute to the Crossplane project. Crossplane is the infrastructure API layer that lets your developer platform provision databases, object storage, and other services on demand. More on our Crossplane practice: [crossplane.ch](https://www.crossplane.ch).

**Red Hat Premier CCSP.** VSHN holds Red Hat Premier Certified Cloud and Service Provider status: the top tier in Red Hat's partner program. This covers OpenShift, RHEL, and the broader Red Hat ecosystem. Platform builds that require OpenShift as the container runtime are fully supported. Managed OpenShift details: [managed-openshift.ch](https://www.managed-openshift.ch).

**Linux Foundation (OpenBao, OpenTofu).** OpenBao (secrets management, forked from HashiCorp Vault) and OpenTofu (infrastructure as code, forked from Terraform) are Linux Foundation projects. VSHN operates both as components of regulated developer platforms. We work directly with the project maintainers on operational questions and contribute bug reports. Managed OpenBao details: [openbao.ch](https://www.openbao.ch).

## How we work with system integrators

System integrators often handle the consulting, architecture, and project delivery for a regulated customer, but the customer also needs someone to run the platform reliably after go-live. VSHN fills the operations layer.

**What the engagement looks like:**

- You handle architecture consulting, integration, and project management
- VSHN handles 24/7 platform operations, monitoring, incident response, and SLA
- Roles are agreed per engagement, not locked into a rigid structure
- Both parties can invoice the customer separately, or one party handles the full invoice

**Protected relationships.** Your customer stays your customer. VSHN does not approach your customers directly. Existing relationships are respected on both sides.

**What you can offer your clients with VSHN:**

- 24/7 platform operations without your client needing to hire a platform team
- Swiss data residency and Swiss operations for regulated environments
- ISO 27001, ISAE 3402, and compliance documentation for due diligence packages
- Verified partner status with GitLab, Red Hat, and Crossplane

## Become a partner

If you advise regulated organizations on their developer platform strategy and want a reliable operations partner for the run phase, let's talk.

[Book a partnership conversation](#contact)


---

## Developer Platform Data Sovereignty | VSHN

# Your developer platform, your data, your jurisdiction

When a regulated organization runs its developer platform on a US hyperscaler, every pipeline run, secret, audit log, and code artifact falls under the [CLOUD Act](https://en.wikipedia.org/wiki/CLOUD_Act). US authorities can compel access without Swiss judicial process, regardless of the region selected. For organizations in Swiss finance, healthcare, and government, this is not a theoretical risk: it is a compliance gap that due diligence reviews are catching.

VSHN operates your internal developer platform on Swiss infrastructure: Swiss company, Swiss staff, Swiss law. Your data stays in Switzerland.

## Why VSHN-operated platforms strengthen your sovereignty

- **Swiss company, Swiss law**: VSHN AG is incorporated in Switzerland. No foreign parent, no CLOUD Act exposure
- **Open-source stack, no vendor lock-in**: GitLab, Crossplane, OpenTofu, and OpenBao are community-governed open-source projects. No hyperscaler proprietary APIs in the critical path
- **ISO 27001 certified**: Since 2014, with ISAE 3402 Type II attestation covering the operational controls that protect your platform
- **GitOps audit trail**: Every change to your platform configuration goes through Git. Full audit history of who changed what and when, suitable for regulatory inspection
- **Cloud choice**: Run on Cloudscale, Exoscale, or your own Azure tenant in Switzerland. You decide where compute and storage run
- **Swiss operations team**: All on-call engineers are based in Switzerland. [Swiss-only support option](https://products.vshn.ch/support_plans.html#_option_switzerland_only_support) available for regulated requirements

## Sovereignty compared

| Dimension | DIY (self-operated) | Hyperscaler managed | VSHN-operated |
|-----------|---------------------|--------------------|-----------------------|
| **Governing law** | Your jurisdiction | US law | Swiss law |
| **CLOUD Act** | Not exposed | Exposed | Not exposed |
| **Data location** | Your choice | Configurable (US-controlled) | Switzerland or customer DC |
| **Operations team** | Your hires (4-6 FTE min) | Vendor staff | Swiss-based VSHN engineers |
| **Audit trail** | You build it | Vendor logs (limited access) | GitOps history, full export |
| **Vendor independence** | Full | Proprietary APIs | Open-source, portable |
| **Compliance evidence** | Build from scratch | Vendor shared-responsibility | ISO 27001, ISAE 3402, named references |

## Compliance and regulatory readiness

VSHN-operated developer platforms support your organization's compliance requirements:

- **FINMA Circular 2018/3**: Outsourcing requirements for Swiss financial institutions. VSHN provides audit documentation, Swiss-only operations, and contractual commitments for regulated customers
- **EU DORA** (Digital Operational Resilience Act): ICT third-party risk management provisions. Swiss-hosted operations with documented SLAs meet DORA's requirements for critical ICT service providers
- **NIS2 Directive**: Supply chain security requirements for essential and important entities. VSHN's ISO 27001 controls map to NIS2 Article 21 requirements
- **GDPR / Swiss DPA**: Swiss data residency by default. EU adequacy decision covers Swiss-EU data transfers

## VSHN sovereignty self-assessment

We applied the EU's [Cloud Sovereignty Framework](https://commission.europa.eu/document/09579818-64a6-4dd5-9577-446ab6219113_en) (v1.2.1, October 2025) to our own services. This framework was used to score providers in the EU's [EUR 180M sovereign cloud tender](https://ec.europa.eu/commission/presscorner/detail/en/ip_26_833) in April 2026. Three pure-European providers achieved SEAL-3, while a consortium involving Google Cloud scored only SEAL-2.

*This is a self-assessment, not a formal SEAL certification. We publish it for transparency so customers can evaluate our sovereignty profile using the same structured criteria the EU uses.*

| # | Dimension | Weight | Assessment | Evidence |
|---|-----------|--------|-----------|----------|
| SOV-1 | Strategic | 15% | **Strong** | Swiss AG, no foreign parent, all shareholders Swiss citizens ([Commercial Register](https://zh.chregister.ch/cr-portal/auszug/auszug.xhtml?uid=CHE-275.566.226)) |
| SOV-2 | Legal | 10% | **Strong** | Swiss law ([GTC](https://products.vshn.ch/legal/gtc_en.html)), no CLOUD Act, [EU adequacy decision](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) |
| SOV-3 | Data & AI | 10% | **Strong** | Swiss DCs by default. Sovereign key management via [Managed OpenBao](https://www.openbao.ch) + [Swiss HSM](https://cloud.securosys.com/cloudhsm) |
| SOV-4 | Operational | 15% | **Strong** | Swiss 24/7 ops, [Swiss-only support option](https://products.vshn.ch/support_plans.html#_option_switzerland_only_support). Platform runs on vanilla Kubernetes |
| SOV-5 | Supply Chain | 20% | **Strong** | Infrastructure-agnostic, [customer chooses provider](https://servala.com/providers/). Open-source tooling — GitLab, Crossplane, OpenTofu, OpenBao |
| SOV-6 | Technology | 15% | **Strong** | Open-source operations tooling. VSHN contributes to [K8up](https://github.com/k8up-io) (CNCF), [Crossplane providers](https://github.com/vshn), [Project Syn](https://github.com/projectsyn) |
| SOV-7 | Security | 10% | **Strong** | [ISO 27001](https://www.vshn.ch/wp-content/uploads/2025/12/ISO-27001-certificate-VSHN-2024.pdf), ISAE 3402 Type II, Swiss SOC. [FINMA-regulated customers](https://www.vshn.ch/en/solutions/solutions-for-banks-and-financial-service-providers/) |
| SOV-8 | Environmental | 5% | **Moderate** | DC operators: Green Datacenter AG (ISO 22301/27001/27701), [Exoscale sustainability](https://www.exoscale.com/sustainability/). [VSHN CSR policy](https://handbook.vshn.ch/corporate_social_responsibility_policy.html) |

**Overall: SEAL-3 equivalent**, the same level achieved by the winners of the EU's own sovereignty tender.

## Make sovereignty a platform property, not an afterthought

When your compliance team or regulator asks "where is your developer platform data and who can access it?", you want a clear answer: Swiss infrastructure, Swiss operations, Swiss law. VSHN gives you that answer without building a 24/7 platform operations team yourself.

[Book a platform assessment](#contact)