Managed STACKIT VMs: Linux administration and cloud operations
We take over the agreed operation of suitable Linux VMs and clearly scope SKE, databases, networking, and other platform services. Resources and the provider contract remain in your account.
Operate STACKIT infrastructure with clear ownership
STACKIT is the cloud platform of the Schwarz Group and documents EU headquarters and data centers in Germany and Austria. The audit determines whether location, provider structure, contracts, and scope match your requirements.
European Cloud Option
STACKIT is headquartered in the EU and documents data centers in Germany and Austria. We assess legal and technical suitability for each project.
Reviewable Provider Evidence
C5 attestation, certificates, and service descriptions are assessed against the customer, workload, and compliance scope. Provider attestations and certificates cover defined platform controls. Secure configuration, workloads, identities, data, and customer organizational controls remain separate.
Operations in the Customer Account
The provider contract, resources, and billing remain with the customer. WZ-IT receives separate technical access for the agreed scope. We take over documented guest operations for suitable Linux VMs. SKE, managed databases, backup, and platform services are agreed separately according to their provider and customer responsibilities.
Shared responsibility
Because shared responsibility applies in a sovereign cloud too: STACKIT operates the platform, but the guest operating system, patches, applications and the response to monitoring alerts remain with you as the customer. That is exactly the part we take over. And if you want to build your own virtualization layer on STACKIT, we also support you with Proxmox on STACKIT.
STACKIT service areas
Which STACKIT services we design, integrate, and operate
Ongoing operations do not stop at the Linux guest. Depending on the environment, we also cover networking, Kubernetes, data services, recovery, automation, and coordination with STACKIT, with a documented boundary between the provider, WZ-IT, and your team.
Compute & Linux operations
Operate STACKIT servers as production systems
Sizing and selection of STACKIT Server, images, and Block Storage
Linux hardening, SSH access, system roles, and documented administration paths
Operating-system and security updates through Server Update Management or agreed operating paths
Operations for Docker, reverse proxies, databases, and agreed application services
Automation through the STACKIT API, CLI, Terraform, Server Agent, and Run Command by scope
Scope boundary and notes
We take over existing or new Linux VMs from baseline configuration through ongoing operations. This includes more than updates: a known system state, controlled changes, and application-aware troubleshooting.
Responsibility boundary: STACKIT is responsible for the compute platform and underlying infrastructure. The operating system, installed services, access, and applications remain customer responsibilities until WZ-IT explicitly takes them over.
Outcome: A documented VM baseline that keeps applications, maintenance, and incident response manageable over time.
Networking & access
Design networks, security groups, and administrative access together
Network and subnet design separating frontend, application, database, and management tiers
Least-privilege security-group rules and documented communication paths
Integration of STACKIT Network Load Balancer, DNS, Public IPs, and private endpoints as required
Site-to-site, client VPN, and hybrid connectivity to sites or other clouds
Separate technical identities, roles, and traceable access paths for WZ-IT
Scope boundary and notes
Production cloud systems need more than a public IP. We structure virtual networks, subnets, security groups, load balancing, and management access around the application and its protection requirements.
Responsibility boundary: STACKIT provides networking and security features. Topology, rules, approved data flows, and external-network integration must be designed and maintained in the customer's context.
Outcome: A network architecture with explainable data flows instead of accumulated one-off rules.
SKE & platform services
Fit Kubernetes and managed services into the operating model
SKE cluster design, node pools, ingress, certificates, and network integration
GitOps, deployments, secrets, policies, observability, and capacity management
Integration of STACKIT PostgreSQL, MariaDB, MongoDB, Redis, or RabbitMQ after product assessment
Application integration with STACKIT Object Storage, Block Storage, Secrets Manager, and KMS
Upgrade, test, and rollback procedures for add-ons and production workloads
Scope boundary and notes
With SKE and managed databases, part of the platform is already managed. We take over the remaining integration and operations work for nodes, workloads, add-ons, data, access, and applications.
Responsibility boundary: STACKIT operates the SKE control plane. Kubernetes objects, workloads, add-ons, persistent data, and application functionality still require separate protection and operations.
Outcome: A platform scope that does not confuse provider services with the customer's remaining operating duties.
Backup & recovery
Take backups from product feature to tested recovery
Backup schedules and retention for servers and attached volumes
Application-consistent protection for databases and stateful services
Object Storage with versioning, lifecycle rules, and Object Lock where suitable
Protection of Kubernetes objects, configuration, and persistent application data
Documented restore tests and alignment of RPO, RTO, and restart sequence
Scope boundary and notes
Server Backup Management creates crash-consistent backups. For reliable recovery, we add retention, application awareness, failure-domain separation, and regular restore procedures.
Responsibility boundary: An enabled backup feature is not yet a complete recovery design. Recoverability, failure domain, and application-consistent state must be assessed for each workload.
Outcome: A recovery path that is not tested for the first time during an outage.
Governance, migration & operations
Control the cloud environment, changes, and incidents over time
Inventory of projects, resources, dependencies, identities, and costs
Landing-zone and role design plus infrastructure as code for repeatable changes
24/7 monitoring and integration of LogMe or existing observability by scope
Coordination of provider tickets and technical isolation of STACKIT incidents
Migration from AWS, Azure, other infrastructure, or standalone servers with testing and rollback
Scope boundary and notes
We connect technical operating tasks with roles, documentation, monitoring, cost control, and a controlled migration path. C5 attestations and other provider evidence are correctly mapped to the customer's own scope.
Responsibility boundary: A provider attestation covers only its documented provider scope. Configuration, applications, data, identities, and the customer's organizational controls remain separate evidence areas.
Outcome: A STACKIT environment with defined responsibilities, repeatable changes, and a reliable operating path.
One operating model
One operating model for STACKIT and additional systems
The provider is only one operating location. WZ-IT connects servers, clouds, and on-premises systems into a documented environment with consistent monitoring, controlled access, and one coordinated service level.
Contracts, accounts, and administrative control remain with you. We take over the agreed technical operations without moving the infrastructure into a closed hosting product.
Private connectivity
NetBird, WireGuard, or existing site connections integrate further clouds, Proxmox systems, and on-premises networks through controlled paths.
Operations and response
Monitoring, updates, backups, documentation, and incident response are designed across all participating systems and operated according to the selected service level.
Monitoring · SLA · Operations
STACKIT
Private connectivity
Cloud · Proxmox · On-premises
Fit
When STACKIT belongs on the shortlist
Public Sector
For projects whose procurement and security requirements match current STACKIT evidence.
Regulated Industries
For organizations that need to combine provider evidence and their own controls transparently.
Data Sovereignty
For companies placing greater weight on location, provider structure, and portability.
Takeover
How we take over existing STACKIT environments
The audit first establishes current state, responsibilities, and required action.
01
Audit
Assessment of your STACKIT environment (VMs, Kubernetes, databases, network)
02
Hardening
Security hardening, monitoring setup and documentation
03
Onboarding
Configure monitoring, alert paths, maintenance windows, and documentation
04
Operations
Perform documented operating duties according to the service level
Service scope
Monitoring or full operations
With Monitoring Only, our team reviews alerts and notifies your team during service hours; incident resolution stays with you. Standard Linux VM operations start at €149.90. Kubernetes, managed databases, multi-account setups, and further cloud services are scoped individually. This also applies to complex STACKIT VMs environments.
Server operationsfrom €149.90Monitoring Only from €49.90
Everything about STACKIT, BSI C5, migration and operations
For suitable Linux VMs, we take over the agreed guest scope including patching, hardening, monitoring, backup management, and documented services. SKE, managed databases, networking, and platform services are scoped separately.
No. STACKIT provides attestations and certificates for defined provider scopes and periods. Configuration, identities, guest operations, applications, data, contracts, and the customer's organizational controls remain separate assessments.
STACKIT positions itself as a European provider headquartered in the EU with data centers in Germany and Austria. Whether this meets a project's legal and regulatory requirements must be assessed individually; WZ-IT does not give a blanket legal guarantee.
We manage suitable Linux VMs and can include SKE, PostgreSQL Flex, MariaDB, MongoDB Flex, Redis, RabbitMQ, Object Storage, and other documented services in an individual scope. Availability, edition, and responsibility are assessed for each service.
STACKIT automates the control plane, upgrades, and parts of monitoring. Workloads, add-ons, access, policies, capacity, and persistent data still require planning. The SKE team backs up the control plane for disaster recovery; cluster data remains the customer's responsibility.
No. Control-plane and etcd backup for disaster recovery is handled by the SKE team. We additionally plan protection of Kubernetes objects, applications, and persistent data under the agreed recovery scope.
STACKIT Server Backup Management creates automated crash-consistent backups. We configure schedules, retention, and monitoring and add application-consistent backups and recovery tests where needed. Object Storage is not automatically a separate failure domain.
Yes. We map services and dependencies, assess portability, data transfer, identities, and operating model, and plan test migration, cutover, and rollback. Containerization does not make migration automatically simple.
Yes. The provider contract, resources, and cloud costs remain with the customer. WZ-IT receives separate, least-privilege technical access for the agreed scope.
Monitoring-only starts at €49.90 net per server and month. Operating a suitable Linux VM starts at €149.90 net per month. SKE, managed databases, and complex cloud environments are priced by scope.
The service can be cancelled monthly, with 30 days' notice to the end of the month.
Response time follows the selected service level. Production and Critical include 24/7 response to qualified P1 incidents; provider response and repair times remain separate.
Only after a separate assessment. STACKIT currently describes Confidential Kubernetes as a customer-specific, self-managed platform. Key management, recovery, attestation, and operating responsibilities must be clarified before takeover.
Customer feedback on monitoring, updates, maintenance, support and stable production systems.
Networking & Provisioning
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbHView project
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
