How two engineers run a UK sovereign hosting platform

Node is a managed hosting platform run by two engineers, on hardware we own, in a UK datacentre. The software is open source from the hypervisor to the password manager. Our own company is the platform's first tenant: the files, CRM, contract signing, email and support desk behind node.uk run on exactly the infrastructure we sell. There is no larger company behind the curtain, and this piece is not going to pretend there is.

What follows is the case for why that arrangement is a sensible thing to buy, made the only way we know how: by describing it accurately. Everything here is already published somewhere on this site. The point of putting it in one place is to be straight about the whole shape of the thing, including the parts that do not flatter us.

The premise

The two of us, Chris Evans and Matt Collier, designed and built the platform and operate it every day. It is not a reseller skin over a hyperscaler; we assembled it from the virtualisation up, and we deliberately think of it as off grid: independent of the commercial clouds and SaaS suites most providers quietly rent and mark up. That independence is not nostalgia for running our own iron. It is what lets us see every layer, fix any of them, and keep the keys, and it is what makes the sovereignty claim on the tin checkable rather than decorative.

The rule that keeps us honest is that we are tenant zero. Anything we would do for a customer tenant, we do for our own the same way: same provisioning, same identity model, same backups, same monitoring. If single sign-on breaks, we cannot log in to our own CRM. If backups fail, it is our contracts at risk. We feel the rough edges before any customer does, which is the cheapest quality assurance scheme ever devised.

What the stack actually is

Buyers are usually told "the cloud" at this point. Here is the actual answer, layer by layer. The long version, with the reasoning behind each choice, is at how the Node Platform is built; this is the honest summary.

Every machine runs Proxmox VE, so physical servers become a pool of virtual machines we can rebuild from a script; nothing important is a hand-built, one-of-a-kind server. Persistent data lives on TrueNAS, built on ZFS, which gives us checksummed integrity, cheap snapshots and efficient replication. The apps themselves run on Kubernetes, the lightweight k3s distribution, which restarts anything that dies and enforces tenant isolation structurally: every customer gets a dedicated namespace with its own network policy, resource quota and storage, so one tenant cannot see, reach or starve another.

Traffic arrives through Cloudflare for DNS and edge protection, then lands on our own nginx and HAProxy load balancers, with each app behind its own TLS certificate. Identity is Keycloak, one isolated realm per tenant, federating Microsoft Entra ID, Google Workspace or LDAP where a customer already has them. Secrets never enter a config file or a Git repository: they are generated, held as Kubernetes secrets, and escrowed into Passbolt.

The metering and money path is open source too. Apache APISIX fronts our API and AI gateway and authenticates every call against Keycloak. Usage events flow onto a Kafka-compatible stream (we run Redpanda) and are rated and invoiced by KillBill against a single published rate card, so an invoice is assembled from a durable record of what actually happened rather than a nightly guess. Underneath sit highly available PostgreSQL and MySQL clusters, Patroni and Percona XtraDB, replicated so a single failure never takes a database offline.

Then the unglamorous parts that matter most. Whole tenants are backed up on a schedule with Velero at the cluster level and Kopia or Restic at the app level, and an independent disaster-recovery foundation in a separate cloud region receives an exported copy, so losing a site is a rehearsed recovery rather than an improvised one. Prometheus, Grafana, Zabbix and Uptime Kuma watch the estate; logs ship to Wazuh, our SIEM, which keeps the audit trail of who did what and when. And we host our own large language models on our own GPUs, served through the same metered gateway we sell, pointed inward at our own documentation and log triage.

How anything changes

Two people cannot safely run an estate this size on memory and shell history, so we do not. The entire platform is described in one Git repository, and that repository is the source of truth. A change is a commit: reviewed, merged, and reconciled onto the cluster automatically by Argo CD, which continuously compares what is running against what Git declares and corrects drift. Nothing important is changed by hand on a live server. Rollback is a revert. When someone asks how any part of the estate is configured, the answer is a file, not a recollection.

This is the actual answer to "how can two engineers possibly run this?". Not heroics: discipline, and a system that holds the definitive picture so humans do not have to.

The economics, honestly

Our pricing looks odd next to SaaS because our costs are odd next to SaaS. A SaaS vendor's marginal cost tracks accounts, so they price per seat. Our cost is running an app: the compute, memory and storage it is guaranteed, and the engineering to keep it patched, backed up and monitored. So that is what we price. Every app has a resource profile and a rate from one published rate card, metered by the hour, on one invoice. Nothing counts your users, there is no platform fee, and there are no contracts: stop an app and the meter stops.

The consequence cuts both ways and we will say so. If you are five people running a heavyweight ERP, per-resource pricing is not automatically cheaper than a few SaaS seats. If you are thirty people on tools priced per seat, it usually is dramatically cheaper, because hiring your fifteenth person does not raise the software bill at all. We publish the rates and a calculator; the arithmetic is yours to check, which is rather the point.

What small buys you, and what it does not

What it buys: the people who built the platform answer the support queue. There is no first line to get past, no account management layer, no ticket roulette. The person replying has root on the system you are asking about and is usually the person who built the thing in question. We keep the estate small enough to know completely, and we automate the routine precisely because a small team cannot afford not to.

What it does not buy, stated plainly. We do not hold ISO 27001 certification: our controls are aligned to ISO 27001, and that phrasing is deliberate, because "aligned to" and "certified" are different claims and we will not blur them. We do not currently sponsor the open source projects we make money from, and our open source position says so rather than implying otherwise. We do not claim UK residency for things that do not have it: it applies to our own UK-hosted models and services, and partner-routed AI models are labelled as exactly that. There are no invented metrics, testimonials or customer counts anywhere on this site. A bigger company would have a certification page and a wall of logos. We have a description of what we actually run, and a standing policy that if we cannot evidence a claim, we do not make it.

You should weigh this genuinely. Some procurement processes need the certificate, not the controls, and we will not pretend to be bigger than we are to pass one.

Open source top to bottom is the exit path

The deepest reason the stack is open source is not cost and not ideology. It is that lock-in is a promise problem, and open source converts the promise into a mechanism. Everything in our catalogue, more than 50 applications, is the upstream project's own published release, unmodified, at pinned versions: what we run is what they shipped. Your data lives in open, standard formats. If you leave, you keep the software and the data, and you can run it yourself or hand it to another provider. The same holds for us: every layer we run, from the hypervisor to the billing engine, is software we could not be held hostage over either.

We are not the publisher of any of it, and we never blur that. Each product page names the upstream project, its licence and the exact source, and we audit every licence against our hosting model before we sell it, withdrawing products where the licence does not permit paid hosting. We win by being good at running this software, not by making it hard to go. A hosting company that can say that, and show the mechanism, is making a different kind of claim from one that just says "no lock-in" in a sales deck.

Where this leaves you

That is the whole shape of it: two engineers, owned hardware, one jurisdiction, an open source stack described in public, priced from one rate card, run by the people who answer the email. If the engineering is what you care about, the Under the hood series takes it one layer at a time, and how the Node Platform is built is the full tour. If jurisdiction is the question, start with UK data sovereignty, explained. And if you would rather just try it, signup comes with £25 of credit, no contract, and a meter that stops when you do.