Sovereign cloud platform for the public sector — from procurement to production

Book a call Open the live demo →

Open-source Cozystack (CNCF project, created by Ænix) → Ænix Public Cloud, Private Cloud and AI Platform → Ænix builds, operates and migrates them.

A sovereign cloud platform for the public sector is infrastructure that government, public administration, and quasi-public bodies own and control end to end, so regulated and sensitive data stays within the jurisdiction mandated by procurement and law. Ænix builds these platforms for EU member states and Central Asia on Cozystack, the open-source Apache 2.0 CNCF Sandbox project Ænix created and co-maintains, which runs virtual machines and containers on one Kubernetes API. Engagements typically start with a Platform Readiness Assessment covering sovereignty, NIS2 and sectoral regulator gaps, procurement-process readiness, and capability transfer, then move to hardware-to-platform-to-operations implementation. Air-gapped deployments, opt-in volume encryption, and knowledge handover to in-house teams are first-class deliverables, and Ænix responds to RFI and RFP through standard government procurement channels.

Quick facts

What it is A customer-owned, audit-ready sovereign cloud platform for public-sector and quasi-public organizations, built on the open-source Cozystack foundation.
Licence Apache 2.0 (no per-CPU / per-core licensing)
Status Cozystack is a CNCF project (Sandbox since 2025-02-28; Incubating application in due diligence)
Who it is for Government IT agencies, public administration, and quasi-public infrastructure operators (transport, energy, water) across the EU and Central Asia, including NIS2 essential entities.
Standards and regulations NIS2 (essential-entity scope), data-localization and procurement-mandated sovereignty rules; Cozystack is a CNCF Certified Kubernetes distribution with the OpenSSF Best Practices badge; AENIX s.r.o. holds ISO/IEC 27001:2022 for its own ISMS.
Key capability Air-gapped deployments and opt-in volume encryption; KubeVirt VMs plus containers, Cilium (eBPF) networking, LINSTOR/DRBD storage, Tenant-CRD multi-tenancy.
Engagement model Fixed-price 14- or 28-day Platform Readiness Assessment first, then end-to-end hardware-to-platform-to-operations implementation with runbooks and capability transfer to in-house teams.

Public-sector and quasi-public organizations face a particular combination of constraints in 2026: procurement-mandated sovereignty (EU member states, Kazakhstan, several APAC jurisdictions), NIS2 compliance (essential entity scoping), data-localization rules, and increasing AI workload pressure on data classes that cannot leave the perimeter. The architectural answer is structurally sovereign, customer-controlled, and audit-ready — built on infrastructure the organization actually owns.

Ænix builds platforms for public-sector and quasi-public organizations across the EU and Central Asia. Open-source foundation (Cozystack), procurement-portal-ready, regulator-aligned. AENIX s.r.o. holds ISO/IEC 27001:2022 certification for its own ISMS; security leads can start with the CISO guide.

Pairs with: Ænix Private Cloud Platform for sovereign cloud with opt-in encryption and an air-gap option; Public Cloud Platform for large public-sector cloud product launches at hyperscaler-adjacent scale.

Book a call Data sovereignty solutions →

What public-sector organizations come to us for

Sovereign-cloud platform builds — procurement-mandated sovereignty under EU member-state, KZ, or APAC frameworks. See Data sovereignty.
NIS2 compliance for essential entities — public administration is in scope. See NIS2 compliance.
Sovereign AI infrastructure — for departments handling sensitive citizen data with AI use cases. See Sovereign AI.
Data-localization platform — where data class must remain in jurisdiction at every layer.

Most engagements involve formal procurement processes; Ænix accepts RFI / RFP through standard channels in EU member states and Kazakhstan.

Why public sector is different

Procurement processes are formal — RFI / RFP / tender cycles run through specific portals (goszakup.gov.kz, mitwork.kz, zakup.sk.kz in Kazakhstan; eTendering and member-state portals in EU; equivalent processes elsewhere).
Sovereignty is non-negotiable — not “preferred” or “with caveats.” Either data lives where the procurement clause says, or the contract fails.
Audit-readiness drives architecture — supervisor inspection is a near-certain part of the operating model.
Capability transfer to in-house teams — many public-sector deployments require knowledge handover so the customer team operates independently after build.
Open-source preferred — proprietary lock-in often disqualifies in evaluation.

Still comparing? See pricing & platforms →

How Ænix engages with public-sector organizations

Platform Readiness Assessment

SovereigntyRegulator-gap (NIS2 / sectoral)Procurement-process readiness

leads to

Phase 2 implementation

Hardware-to-platform-to-operations

hands over to

In-house team operations

Knowledge transferRunbooks

The standard engagement: Platform Readiness Assessment with workstreams emphasized for public sector — sovereignty + regulator-gap (NIS2 / sectoral) + procurement-process readiness + capability transfer to in-house teams.

Phase 2 implementation runs end-to-end: hardware-to-platform-to-operations, with documented exit path (knowledge transfer + runbooks) so the customer team operates independently.

References

Public-sector customers are not named. References are discussed on the discovery call where the customer allows it, and nine published case studies are written up in anonymized form, with architecture and figures.

Procurement readiness

We accept RFI / RFP through standard government procurement channels including:

Kazakhstan — goszakup.gov.kz, mitwork.kz, zakup.sk.kz, Unified Procurement Platform
EU member states — TED (Tenders Electronic Daily), national e-procurement portals
Other jurisdictions — discussed during discovery call

We respond with: company profile, prior public-sector references (where permissions allow), technical compliance with sovereignty / NIS2 / sectoral requirements, and pricing.

Ready to scope your build? Book a call →

Why Ænix specifically for public sector

Open-source platform — Cozystack is Apache 2.0, a CNCF Sandbox project. No proprietary lock-in; the full source is open for evaluation.
EU + Central Asia teams. Engineering teams in the EU and Central Asia; EU contracts through AENIX s.r.o. (Czech Republic); experience with KZ procurement processes.
Capability transfer first-class — knowledge handover is a primary deliverable, not optional.
Cozystack supports air-gapped deployments for the most-sensitive workloads.

How to start

Book a call

Or read more:

Data sovereignty — sovereignty-led engagement
NIS2 compliance — essential-entity regulatory
Sovereign AI — AI on sensitive data
Platform Readiness Assessment — engagement methodology
Cozystack — open-source foundation
CISO guide — what a security lead should check

Ænix created Cozystack (CNCF Sandbox project, CNCF Certified Kubernetes distribution, OpenSSF Best Practices) and co-maintains it with maintainers from other companies. On top of it we offer three platforms — Public Cloud, Private Cloud and AI.

Frequently asked questions

Does Ænix respond to public-sector RFI and RFP through official procurement portals?

Yes. Ænix accepts RFI and RFP through standard government channels, including goszakup.gov.kz, mitwork.kz, zakup.sk.kz and the Unified Procurement Platform in Kazakhstan, and TED plus national e-procurement portals in EU member states. Responses cover company profile, references where permissions allow, technical compliance, and pricing.

Can the platform run fully air-gapped for sensitive data?

Yes. Cozystack supports air-gapped installs, and volume encryption (LUKS on LINSTOR) is available opt-in per storage class, with key handling designed with you during the build. Data classes that cannot leave the perimeter stay on infrastructure you own.

How does this help with NIS2 compliance?

Public administration and quasi-public infrastructure operators in transport, energy, and water are commonly in scope as NIS2 essential entities. Ænix engagements include a regulator-gap workstream against NIS2 and sectoral requirements, and the platform is built to support NIS2 risk-management measures (Article 21) and incident reporting (Article 23). The obligations remain with the entity.

Is there proprietary lock-in?

No. The foundation is Cozystack, an Apache 2.0 CNCF project with no per-CPU or per-core licensing. The code is open source (Apache 2.0) and fully inspectable, which avoids the proprietary lock-in that often disqualifies vendors in public-sector tenders.

Can our in-house team operate the platform after the build?

Yes. Capability transfer is a primary deliverable. Phase 2 implementation runs hardware-to-platform-to-operations with a documented exit path, including knowledge handover and runbooks, so the customer team operates the platform independently.

What does Ænix sell on top of the open-source project?

Ænix sells platform subscriptions (support, commercial modules and services) based on Cozystack — not a licence — plus services such as the Platform Readiness Assessment and implementation. Ænix Private Cloud Platform is quoted per RFP after the assessment.