# How we build. The same standards for every system.

Source: https://vetosec.at/en/how-we-build/

Every solution follows the same rules for hardening, updates and backup. Here is what we do and what it means for you.

- **CIS** Benchmark as baseline
- **Containers** for updates
- **Immutable** backup copies

## Standards

- [**Every server hardened the same way**](https://vetosec.at/en/it-security/cis-benchmark/): We set up servers automatically to the CIS Benchmark, an internationally recognised security baseline. For you that means no forgotten settings, a provable security level for audits, and a broken server rebuilt in hours instead of days.
- [**Updates without long downtime**](https://vetosec.at/en/it-security/patch-management/): Our services run in containers. An update means starting the new version, checking it, switching over. If something fails we are back in minutes. Moving to new hardware or a data centre needs no reinstall.
- [**A breach stays contained**](https://vetosec.at/en/solutions/firewall/): Separate networks, personal accounts with MFA and SELinux, which allows each service only what it needs. If one service is compromised, the attacker cannot reach the rest.
- [**Backups that survive an attack**](https://vetosec.at/en/solutions/backup/): Local snapshots for fast recovery, an encrypted offsite copy and where needed an immutable copy with S3 Object Lock that even an attacker with admin rights cannot delete. We rehearse restores on a schedule.
- [**Linux where Windows Server is not needed**](https://vetosec.at/en/solutions/active-directory-linux/): Linux handles many Windows Server jobs with lower licence costs and less attack surface, even Windows sign-in via Active Directory. Where business software needs Windows Server, we run it.
- [**Monitored from day one**](https://vetosec.at/en/services/monitoring/): Every system reports to our own monitoring platform. An engineer checks every relevant alert; routine runs automatically.
- **Documented and yours**: You get the network plan, runbook and all credentials. The systems are yours, with no licence tie to us.

## Automated

Every server gets the same tested building blocks.

- Control plane · server roles: Backup, monitoring, firewall and hardening run the same on every server. We roll out changes automatically, after approval and traceably.
- Compliance scan: We scan servers automatically against recognised security baselines. This server meets 96.8 percent of the applicable rules; the open items are listed in the report and get worked off.

## Technology

For the technically curious: the software behind our solutions. Proven, openly audited and free of licence lock-in.

- [**Proxmox VE**](https://vetosec.at/en/solutions/proxmox-cluster/): Virtualisation & clusters
- [**ZFS**](https://vetosec.at/en/solutions/fileserver/): Checksummed storage
- [**OPNsense**](https://vetosec.at/en/solutions/firewall/): Firewall & segmentation
- [**WireGuard · NetBird**](https://vetosec.at/en/solutions/fernzugriff-vpn/): Remote access
- [**Authentik**](https://vetosec.at/en/solutions/single-sign-on/): Single sign-on & MFA
- [**Nextcloud**](https://vetosec.at/en/solutions/managed-nextcloud/): Secured file cloud
- [**Samba AD**](https://vetosec.at/en/solutions/active-directory-linux/): User directory
- [**Rocky Linux · Debian**](https://vetosec.at/en/how-we-build/): Server OS
- [**SELinux**](https://vetosec.at/en/how-we-build/): Service confinement
- [**Containers**](https://vetosec.at/en/how-we-build/): Updates & moves
- [**Ansible**](https://vetosec.at/en/how-we-build/): Automation & hardening
- [**S3 Object Lock**](https://vetosec.at/en/solutions/backup/): Immutable backup

## Open source consulting

We use open source where it makes sense. In consulting we check which of your systems can move, what you save and where a commercial product fits better.

- **Lower running costs**: Virtualisation, firewall, VPN, backup and single sign-on run without licence or subscription fees. You only pay for optional vendor support.
- **Your data stays with you**: Systems run in your server room or in a data centre of your choice in the EU.
- **Independent of vendors**: Open standards and formats. Switching vendor or provider stays possible at any time.
- **A clear recommendation**: You get a list: what is worth moving, what should stay and what each costs.

[Request open source consulting](https://vetosec.at/contact/?anlass=open-source)

## Frequently asked questions

### What is the CIS Benchmark?

A collection of security settings for operating systems and software, published by the Center for Internet Security. It is an international reference for hardened systems and often used in audits.

### Do we get your automation?

No. Our automation is our tooling. You get the documentation of your environment: network plan, runbook and all credentials.

### Do you support Windows and VMware?

We take over existing systems where they run well. For new builds we recommend what costs least and runs most securely.

## Related

- [Solutions](https://vetosec.at/en/solutions/): Nextcloud, SSO, backup, clusters
- [Build & migration](https://vetosec.at/en/services/it-solutions/): project price
- [Ongoing support](https://vetosec.at/en/services/it-support/): fixed monthly price

## Hardened, highly available open source infrastructure

vetosec builds infrastructure to fixed standards: CIS hardening, SELinux, containers, ZFS, immutable backups, Samba AD, Proxmox, OPNsense, WireGuard, NetBird, Authentik and Nextcloud.

Updated: October 19, 2026

Provider: vetosec, Dipl.-Ing. Samuel Ziegler, BSc, Berndorf, Lower Austria, Austria. Contact: https://vetosec.at/en/contact/