Data sovereignty starts in the infrastructure: this category gathers our articles on Supabase and PostgreSQL, Keycloak and identity management, self-hosting on Hetzner, Next.js architecture and performance. The common thread: European data sovereignty, transparent operating costs and open-source stacks you own instead of rent.
Mistral Large 4 has been in public preview since October 6, 2026; the weights are due at the end of October. Via the API, sovereign use is not possible yet: Mistral may train on your inputs, US corporations sit in its supply chain, and a C5 attestation is missing. Test now; process sensitive data only once the weights are out.
Matthias Radscheit
Most agencies in the DACH region quote €15,000 to €50,000 for an MVP (as of October 2026). Paid AI app builders start at €25 a month; complex platforms can reach six figures. Integrations, roles and tenants, payments, SSO and compliance evidence drive the price. Also budget for a test environment, restore tests, updates, a data processing agreement (DPA) and monthly running costs.
Matthias Radscheit
The 12-Factor App, written at Heroku in 2011, sets out twelve rules for web applications. We build with it because it makes switching teams or providers, outages and audits less risky. Your code sits in your repository, credentials stay out of it, every release is traceable. That is evidence for GDPR, ISO 27001 and NIS2 audits, not a certificate.
Matthias Radscheit
Supabase Auth covers more than its reputation suggests: email login, social logins, MFA, and even SAML SSO from the Pro plan at $0.015 per SSO user. You only need Keycloak for LDAP integration, issuing SAML yourself, separate realms, or an on-premises requirement. My advice from real projects: start with Supabase Auth; the migration path to Keycloak stays open.
Matthias Radscheit
Keycloak answers who your user is; Postgres with Row Level Security decides in the database which rows they get to see. The link between them is the JWT from Supabase Auth, enriched via the Custom Access Token Hook. This article shows you the architecture, the three integration paths, and four pitfalls from our client portal projects.
Matthias Radscheit
A proof of concept tests technical feasibility; a prototype tests whether users understand the solution. An MVP (minimum viable product) tests whether customers use the product and pay for it; a pilot tests whether it holds up in day-to-day operations. Your biggest risk, not your budget, decides which stage comes first. In B2B, the metric that counts is a signed pilot agreement.
Matthias Radscheit
Passkeys replace the password with a phishing-resistant login via fingerprint or PIN — and Keycloak has supported them officially since version 26.4. This article shows you as a decision-maker how passkeys work, which MFA options Keycloak ships with (OTP, WebAuthn, recovery codes), which tiered model makes sense per user group, and where rollouts stall in practice: fallback, device changes, acceptance.
Matthias Radscheit
Keycloak itself costs nothing: Apache 2.0 license, no per-user fee. What you actually budget is setup (€8,000–60,000 depending on scope) and operations (roughly €150–700 per month, managed from €225). Against Auth0, the math works from a few thousand B2B users; below that, the SaaS route stays cheaper. All ranges: happycoding project experience, all third-party prices as of September 2026.
Matthias Radscheit
Keycloak ships feature releases on a quarterly rhythm and does not patch older versions, so your support window is roughly three months. Deferred upgrades become a security risk as soon as CVE fixes appear only in the new release. With a staging test, realm exports, a rehearsed rollback path, and a fixed quarterly rhythm, the upgrade becomes a plannable routine: in our experience, 0.5 to 5 person-days instead of an emergency project.
Matthias Radscheit
You get Keycloak as software, not as a service: the hosting question is the real decision. Three paths: self-hosting (2–5 person-days of setup in our experience), managed providers from Elestio (from $11/month) via Phase Two (from $149) to Cloud-IAM (from €225, as of 09/2026) — or a SaaS IdP. Data location and the DPA chain argue for the first two.
Matthias Radscheit
Four systems, four pricing models: Keycloak costs operations instead of a license, Auth0 bills per active user, Supabase Auth is included in the platform price, and Entra External ID gives you 50,000 MAU for free before it gets expensive. This comparison shows you, with verified prices (as of September 2026), which solution fits your scenario: startup app, mid-market portal, or enterprise with Active Directory.
Matthias Radscheit
SAML and OIDC solve the same problem from two eras: delegating login to a central identity service. SAML 2.0 (2005, OASIS, XML) is the federation standard of corporate IT; OIDC (2014, OpenID Foundation, JSON/JWT on top of OAuth 2.0) is the standard for new web and mobile applications. The practical rule: enterprise customers dictate SAML, your own applications speak OIDC — a broker like Keycloak serves both at once.
Matthias Radscheit
Self-hosting a 70B model currently costs 1,197.30 € net per month plus 599 € setup at Hetzner. The same model class is available from German data centers via API from 0.65 € per million tokens: the break-even sits at around 1.84 billion tokens per month. I show you the calculation — and when your own server pays off anyway.
Matthias Radscheit
Your company knowledge belongs in a database, not in model weights: RAG looks knowledge up at runtime, stays current, cites its sources, and remains deletable for GDPR purposes. Fine-tuning trains behavior, not knowledge — and OpenAI is even winding down its fine-tuning by January 2027. We show you the pgvector stack, the real costs, and the three limits where RAG fails.
Matthias Radscheit
Workflow automation rarely fails because of the tool. It fails on three questions comparison articles leave out: Where do your data run, who is even allowed to operate n8n, and what does operating it really cost? I show you the license trap in agency hosting, an honest cost calculation with dated prices, and the line beyond which low-code is no longer enough.
Matthias Radscheit
Semantic search finds results by meaning instead of by character string. The embedding fees are cent amounts; the real costs sit in engineering and upkeep. For websites you build it hybrid with Meilisearch, for RAG you use pgvector. And often you don't need it at all: measure your zero-result rate first, then decide.
Matthias Radscheit
You rarely need Elasticsearch, but you almost always need a better search. We walk you through three tiers: Postgres full-text search (often enough), Meilisearch (typo tolerance, facets, Cloud from $20/month), and Elasticsearch/OpenSearch (only with an operations team). On top, you get our experience values on effort and the cheapest lever of all: your search log with its zero-result queries.
Matthias Radscheit
Since the 2021 fork, what separates Elasticsearch and OpenSearch is above all the license, not the technology: Elastic offers ELv2, SSPL, and since 2024 the AGPL; OpenSearch stays Apache 2.0 under the Linux Foundation. I walk you through the exact chronology, put both party-financed benchmarks in context, and give you three clear recommendations, including the option that you need neither.
Matthias Radscheit
You rarely need Elasticsearch: for website and shop search, Meilisearch, Typesense, or even Postgres full-text search are usually the better choice – cheaper to run and clear on licensing. Elasticsearch remains right for log analytics, aggregations, and very large data volumes. This comparison gives you the decision matrix with prices and license facts, all checked against primary sources on September 4, 2026.
Matthias Radscheit
Meilisearch is a lean open-source search engine for websites and shops: typo-tolerant, with facets and built-in AI search, run as a single binary. The core is MIT-licensed and free – since 2025 there are also enterprise modules under a contract license. Here you get the honest assessment: what it does, what it costs, and when you do not need it.
Matthias Radscheit
Published German price ranges for the same project class run from €15,000 to €150,000. Hourly rates explain only a factor of 2.6 of that; the rest is unspoken scope. To make quotes comparable, define integrations, roles, migration, acceptance and operations first — instead of negotiating the rate. Running costs are the easiest thing to underestimate.
Matthias Radscheit
Custom software is built for one specific client, not an anonymous market. It pays off when a process explains your margin, when three or more systems have to stay in sync, or when many people use it: license costs scale per head, development costs do not. For non-differentiating processes, off-the-shelf wins clearly.
Matthias Radscheit
The incremental path from JavaScript to TypeScript: a six-stage plan from allowJs to the CI gate, the right order for the strict flags, honest effort figures from the Airbnb, Stripe, and Pinterest migrations — and the cases where you are better off not migrating.
Matthias Radscheit
Roughly 38 percent of all PHP websites run without security patches. This guide shows IT leaders the path from legacy PHP to a TypeScript stack — without a big bang: decision criteria, five migration steps, and honest cost ranges.
Matthias Radscheit
The decision for NestJS has been made — but what does the path look like? Pattern mapping, a five-step migration sequence, team realities, and honest exclusion criteria: the practical guide for IT decision-makers, without a code tutorial.
Matthias Radscheit
Published customer portal prices range from €12,000 to over €300,000 — because they describe three different project classes. We publish our price anchors, break down the running costs, and show the threshold at which custom development becomes cheaper than SaaS.
Matthias Radscheit
Make or buy for a customer portal isn't a feature question — it's a question of cost trajectories: list prices as of July 2026, five decision criteria, an honest 5-year calculation, and when the hybrid path beats both.
Matthias Radscheit
Keycloak is an open-source identity and access management (IAM) system: single sign-on, user and permission management, OIDC/OAuth2/SAML and AD/LDAP integration — self-hosted instead of rented. It replaces per-user licensed identity services such as Auth0, Okta or Azure AD B2C. Current release: version 26.7.4 (September 2026), four minor releases per year, one major release every two to three years. Three things matter for decision-makers: costs do not scale with the user count, identity data stays on your own EU infrastructure (GDPR), and as a CNCF project with Red Hat origins the project's future is broadly secured. A managed IdP remains the right choice for small teams without operational capacity.
Matthias Radscheit
Commercial support for Spring Boot 2.7 ends on December 31, 2026 — and the entire 3.x line is already without open-source patches. The sober decision tree: Boot 4, extended support, or a service-by-service TypeScript rebuild.
Matthias Radscheit
"Our ERP can't do that" is the most common objection to a customer portal — and it's almost always wrong. How SSO with Keycloak and four integration patterns connect portals to legacy systems without touching the old system at all.
Matthias Radscheit
Real price ranges for TypeScript and Node.js projects in 2026 — plus the TCO math showing what the comparable Java stack adds in operating costs, and when it should stay anyway.
Matthias Radscheit
Medusa is PostgreSQL-native and fully self-hostable. On Hetzner with Coolify and Docker the commerce stack runs GDPR-compliant in Germany, and it beats SaaS plus transaction fees above a clear revenue point. What the switch really costs, and when it pays off.
Matthias Radscheit
Performance is not frontend cosmetics. It is a business metric. Treat Core Web Vitals as a technical detail and you leave both ranking and revenue on the table. Why Next.js gives you the best starting conditions, and why that alone guarantees nothing.
Matthias Radscheit
Vercel is convenient and sits under US law. Next.js is open source and runs self-hosted on Hetzner with Coolify and Docker, stably, from around 39 euros a month. Why data sovereignty isn't optional for serious organisations but a requirement, and what the switch honestly costs.
Matthias Radscheit
Almost everyone who migrates from Firebase to Supabase underestimates the same block: not auth, not storage, but reshaping denormalised Firestore collections into normalised Postgres tables with RLS. An honest account of where the time and money actually burn — and which apps should not migrate at all.
Matthias Radscheit
No vendor writes the TCO comparison between Supabase Cloud and self-hosted on Hetzner. Past a certain usage profile, self-hosting saves real money — but only if you price your internal operating hours at a real rate. Skip that, and the saving is an accounting illusion.
Matthias Radscheit
For most enterprise use cases, a separate vector database is a problem you buy back into your own stack. Why Supabase with pgvector and Edge Functions is a consolidation decision, not a hype one — and where the honest limit actually sits.
Matthias Radscheit
Comparing Supabase and Firebase on features means comparing the wrong dimension. For European companies under GDPR, this is a sovereignty and risk decision: a US corporation under the CLOUD Act versus open PostgreSQL with a real exit. A practitioner's take.
Matthias Radscheit
Nearly 30 percent of Java production applications still run on Java 8, according to New Relic — and every new product idea is queued behind the migration. Two-speed IT breaks the gridlock: greenfield products on a TypeScript stack, docked onto the core via API contracts.
Matthias Radscheit
NestJS brings the enterprise patterns familiar from Spring to the TypeScript backend. The comparison for IT decision-makers: architecture, support cycles, talent pool, and costs — plus when Spring remains the right choice.
Matthias Radscheit
Feature comparisons don't answer the stack question. This TCO comparison works through the four cost blocks that actually hit IT decision-makers — license and audit risk, talent, support cycles, and operations — and says honestly when the JVM wins.
Matthias Radscheit
Supabase, Keycloak and Next.js are the stack I recommend to clients most often: open licenses, EU operation possible, predictable costs. License costs are zero, Supabase Pro starts at $25 a month, and an entry-level Hetzner server costs €8.49 net (as of 22 September 2026). For a typical self-hosted setup, we budget €20 to €50 a month in server costs. The real cost block is the initial implementation, typically €5,000 to €20,000 in my experience — in return, costs fall over time instead of rising with your success.
Matthias Radscheit
Supabase Row Level Security moves access control out of application code and into the database. The forgotten filter stops being a bug you avoid through discipline and becomes structurally impossible. For multi-tenant SaaS, that is a question of risk and speed that belongs on a decision-maker's desk.
Matthias Radscheit
Supabase is an open-source backend platform built on PostgreSQL: database, authentication, realtime, storage and Edge Functions behind a single API. Startups save weeks of infrastructure work, mid-sized companies connect it to their existing systems, and large enterprises self-host it. I'll show you which features matter for your type of company and where the platform reaches its limits.
Matthias Radscheit
Sanity scales through a clear division of labor: your content lives in the hosted Content Lake, a global CDN delivers it with low latency, and your frontend scales independently of both. With caching, optimized GROQ queries, and serverless hosting you absorb load spikes. Brands like Nike and National Geographic serve millions of users this way.
Matthias Radscheit
Book a no-obligation call, send us an email, or use the form – we'd love to hear from you.