Engineered in Europe · Sovereign by architecture

Own your data.
Encrypt it yourself. Keep the keys.

SEVOCOMM SCS is a European, sovereign secure cloud storage platform for organizations that refuse to hand their files to someone else's cloud. Client-side AES-256 encryption, customer-managed keys, full audit trails — and a deployment model you decide, not the vendor.

  • AES-256 client-side & at-rest encryption
  • 0 third-party access — ever
  • EU development & GDPR-grade alignment
Why SEVOCOMM SCS

Six reasons this is not another cloud drive.

Scannable in seconds. Defensible in an audit.

The problem with the status quo

Your files already live on someone else's infrastructure.

The default cloud-storage contract has quietly become: your data, on their servers, under their jurisdiction, decrypted by their keys, with access logged on a dashboard you don't own. "Private" is reduced to a marketing claim — not an architectural guarantee.

Shared infrastructure

Major providers run on multi-tenant infrastructure under foreign jurisdiction. Your data coexists with data you'd never agree to share a room with.

Provider-held keys

Server-side encryption with vendor-managed keys is not privacy — it is convenience. Whoever holds the keys holds the data.

Opaque access

Admin access by the provider is legal, common, and rarely disclosed. You are trusting a policy, not an architecture.

Sovereignty by clause

Data residency expressed as a contract term — not as a physical location you control. Regulators are increasingly unconvinced.

Lock-in by design

Proprietary sync, proprietary APIs, proprietary export formats. Exit is possible — in theory. In practice, expensive and slow.

SEVOCOMM SCS inverts the arrangement.

See how deployment works →
Deploy where you decide

Four environments. One engine. Zero vendor layers in between.

The single most important architectural guarantee of SEVOCOMM SCS: the deployment model is not imposed. It is chosen — by the customer, for the customer, with no vendor-managed layer in between.

On-Premise

Customer data centre. Zero network egress. Full perimeter control. Your hardware, your policies.

Private Cloud / VM

Dedicated, sovereign infrastructure — bare-metal or inside a VM on your own hypervisor (VMware, Proxmox, Hyper-V, KVM). No shared tenancy. Customer-managed boundary.

Air-Gapped

Fully isolated from external networks. Classified-ready for defence, legal, R&D and regulated sectors.

ISP / Telecom

Multi-tenant Hosting mode. White-label ready. Multi-domain. Operator-scale provisioning with per-tenant isolation.

Four deployment environments — On-Premise, Private Cloud / VM, Air-Gapped, and ISP / Telecom — converging on a single SEVOCOMM SCS Core exposing identical Web, API, Audit and Admin surfaces
Identical engine, identical behavior, across every environment.

“Deployment is fully decided by the customer.

— Core product principle · Non-negotiable
Product overview

Encrypted. Auditable. Portable.

A modern secure-storage platform structured around three design principles: cryptographic privacy, operational observability, and unconditional portability — no forced SaaS layer, no vendor-held keys.

Encryption core

AES-256-GCM at rest, TLS 1.2/1.3 in transit, client-side encryption for zero-knowledge storage. Customer-managed keys — SEVOCOMM never sees plaintext.

Access control

Role-based permissions, multi-factor authentication, IP allow-lists, and time-based access policies. Every permission is explicit, auditable, and reversible.

Audit & compliance

Complete file-access audit trail, retention policies, legal hold, and GDPR-grade data management — including export and erasure workflows. Evidence-ready by default.

Collaboration & SVC-OFFICE

Built-in document suite — SVC-Write, SVC-Calc, SVC-Dia — for real-time editing of .docx, .xlsx and .pptx files directly inside SCS. Secure sharing, expiring links, granular permissions, and version control — all inside your perimeter.

Backup & recovery

Automated encrypted backups, point-in-time recovery, and optional geographic redundancy. Disaster recovery is a built-in capability, not a paid add-on.

MTA large-file drop-off

Native hand-off with SEVOCOMM MTA — oversized attachments are transparently replaced with a secure, expiring SCS link. Recipients get a clean message; the payload stays encrypted inside your SCS perimeter, never in transit as mail.

Integrations

Open standards only: WebDAV, REST API, webhooks, external-storage back-ends, federation hooks, and SIEM-ready audit export. Fits any stack already in place.

SVC-OFFICE · built-in collaboration

A full office suite, inside your own storage.

SCS ships with SVC-OFFICE — a sovereign collaboration suite that opens, edits, and co-authors Microsoft Office documents without sending a single byte to Microsoft, Google, or anyone else. Files stay inside your SCS instance. Editing happens inside your perimeter.

SVC-Write

Full-featured word processor for .docx, .odt and .rtf. Tracked changes, comments, real-time co-authoring, and pixel-faithful rendering of Microsoft Word documents. A direct alternative to MS Word — without the SaaS dependency.

SVC-Calc

Spreadsheet engine for .xlsx and .ods with formulas, pivots, charts, conditional formatting, and multi-user editing. Microsoft Excel-compatible, evaluated locally — your financial models never leave your jurisdiction.

SVC-Dia

Presentation editor for .pptx and .odp with slide masters, transitions, animations, and co-authoring. A direct alternative to MS PowerPoint — running inside SCS, never uploaded to an external cloud.

“Microsoft Office collaboration — without Microsoft.

— SVC-OFFICE · runs locally inside SCS
Product proof

A mature platform, not a pitch deck.

A real product, running in real customer environments — including ours.

Built around the way people actually work with files.

Documents, pictures, and projects — organized the way your teams already think about them. Sharing, migration, and admin all live in the same surface, under the same audit trail, behind the same encryption boundary.

  • Unified library — Documents, Pictures, Projects. Fast filter, fast preview.
  • Quick Access — pinned team sites, project files, sales reports, migration tools.
  • Recent Activity — live stream of who did what, with full context and rollback.
  • Share panel — granular, time-boxed, revocable — never a public URL you forgot about.
  • Migration Assistant — pull existing file estates from Nextcloud, HiDrive, Seafile, FileCloud, OneDrive, SharePoint, Azure Files, Google Drive, WebDAV, SFTP, SMB3, and NFS (read-only) into sovereign storage.
SEVOCOMM SCS operations dashboard showing documents, sharing, migration assistant, quick access and recent activity panels
The SCS operator view — documents, sharing, migration and recent activity, one pane.
SCS admin dashboard with license validation, users, storage and live audit activity
Admin dashboard. Licence state, storage, audit trail — at a glance.
SCS user management — roles, MFA, storage per user, last-login audit
User & access control. Roles, MFA, storage per user, last-login audit.
External storage backends configurable from the SCS admin UI
External storages. WebDAV, object stores, federated back-ends.
Forensic export bundles with SHA-256 signed manifests
Forensic export. SHA-256 signed bundles — offline tamper-verification.
Security & zero-knowledge architecture

Files encrypted before they leave the device.

Most cloud storage platforms encrypt "at rest" with keys they hold themselves. SEVOCOMM SCS is structured differently: files are encrypted on the client, with keys the customer controls, and the server never sees plaintext — ever.

  • Full data encryption at rest — AES-256-GCM authenticated encryption applied to every file and every storage volume. Not a per-folder flag, not a premium add-on — the entire storage layer is ciphertext, always.
  • Application-level AES-256-GCM — every object written is encrypted with a per-file data-encryption key (DEK), wrapped by a tenant key, wrapped by the master key. Lose a disk, lose nothing.
  • Storage-volume encryption — LUKS / dm-crypt on the underlying block devices for defence-in-depth. Even a stolen drive yields nothing.
  • TLS 1.2 / 1.3 in transit — modern cipher suites only, strict policy enforcement.
  • Client-side encryption — zero-knowledge mode for classes of data that must never be operator-readable.
  • Customer-managed keys — generate, rotate and revoke on your own schedule. No vendor escrow.
  • Hardware-bound key material — HSM / KMS integration for the master encryption key.
  • ClamAV antivirus scanning — standard in every SCS edition. Every upload scanned before it's written; quarantine and daily signature updates are configured out of the box.
  • Password rotation & MFA — enforced by policy, logged by default, auditable on demand.

The difference between “encrypted in the cloud” and “encrypted before it reaches the cloud” is the difference between a promise and a proof.

Zero-knowledge architecture diagram — client encrypts data with AES-256, ciphertext traverses TLS 1.3, only ciphertext stored on SCS server
Client-side AES-256 · ciphertext in transit · ciphertext at rest.
SCS antivirus configuration panel — ClamAV integration, scan-on-upload, quarantine policy
ClamAV scan-on-upload & quarantine — shipped, not bolted on.

See the platform against your actual environment. A scoped, no-fluff walkthrough with our engineering team.

Migration Assistant

Bring your files home. From anywhere.

A built-in migration pipeline pulls existing file estates — from SaaS drives, foreign-jurisdiction clouds, legacy file servers, and competing self-hosted platforms — directly into your sovereign SCS instance. Preserves folder structure, metadata, timestamps and permissions where the source exposes them.

Migration runs inside your SCS perimeter. Files are decrypted at the source, re-encrypted under your customer-managed keys, and written into SCS — nothing transits a third-party migration cloud.

SEVOCOMM SCS admin dashboard with licence state, users, storage and live audit log showing per-file attribution, outcome and source IP
Every access, every change — attributable, exportable, defensible.
System metrics & analytics — CPU, memory, storage growth, bandwidth and request rate
System metrics & analytics — health, capacity, bandwidth — always on.
Audit, retention & legal hold

Evidence-ready, by default.

Regulated industries do not need more dashboards. They need data that holds up under an audit, a subpoena, or a GDPR subject request. SCS is built around that reality — the compliance surface is the product surface.

  • Per-file audit trail — who opened it, who modified it, who shared it, from where, when.
  • Retention & legal hold — policy-driven, tenant-scoped, non-bypassable.
  • GDPR workflows — subject-access export, right-to-erasure with cryptographic verification.
  • Tamper-evident logs — append-only, hash-chained, exportable to external SIEM.
  • System health graphs — storage, access, integrity, encryption posture, continuously visible.
Business value

Technical capability, translated into business outcome.

Three concrete, executive-level results — not features in disguise.

Cost Control

Predictable economics

  • No per-seat SaaS subscription curves
  • Storage cost scales with actual infrastructure, not licence tiers
  • Modular licensing matched to deployed capability
  • Reuse existing hardware, SAN and backup investments

Own the cost model. Forecast it. Defend it.

Risk Reduction

Data stays where it belongs

  • Encryption keys inside a perimeter you define and audit
  • Zero third-party access to plaintext data
  • No cross-jurisdiction data spill through shared infrastructure
  • No single-provider outage becoming your downtime

Less exposure. Less surprise. Less dependency.

Compliance & Sovereignty

Aligned with how Europe regulates

  • Developed in Europe, GDPR-grade alignment
  • Supports ISO 27001, NIS2 and sector frameworks
  • Data residency as an architectural choice, not a clause
  • Retention, legal hold, journaling — built in

Sovereignty by architecture, not by policy.

Audience fit

Built for the way your organization operates.

Same platform, three operational profiles. No feature gating that forces a “move up to the next tier” conversation.

SME / SMB

Independence, cost control, predictable deployment.

  • Full control over company files and IP
  • Predictable storage-cost structure
  • Independence from foreign-jurisdiction SaaS
  • European data-protection alignment
Fit for your team →

Enterprise

Compliance, auditability, data sovereignty, internal control.

  • Compliance & auditability across business units
  • Customer-managed keys & HSM integration
  • Role-based, auditable administration
  • White-label branding per business unit
  • SIEM-ready audit export and federation hooks
Request architecture review →

ISP / Telecom

Multi-tenant, multi-domain, white-label — operator-scale.

  • Hosting mode: strict tenant data isolation
  • Multi-domain, per-tenant branding & theming
  • Provider Admin with billing-ready hooks
  • Per-tenant SLA, storage, and audit APIs
Start a pilot →

Regulated & Classified

Legal, defence, R&D — anything that cannot leave your perimeter.

  • Fully air-gapped deployment supported
  • Client-side zero-knowledge encryption
  • Tamper-evident, append-only audit trail
  • Dedicated support & custom integration paths
Start a pilot →
Licensing

Three editions. One codebase. No artificial gates.

Pick the edition that matches your deployment profile — not the one that unlocks the features you should have had from day one.

Basic

Single-server

Self-contained deployment for focused teams and smaller estates.

  • Storage scales with your infrastructure — no cap
  • Up to 25 users
  • Full storage encryption (AES-256-GCM + LUKS)
  • ClamAV antivirus (standard)
  • Full audit trail & access control
  • On-premise or private cloud
Request licensing details →
Enterprise

Sovereign, air-gapped & operator-scale

Full platform for regulated, classified, mission-critical, and ISP / Telco operator environments.

  • Everything in Professional
  • Air-gapped deployment support
  • Multi-tenant Hosting mode (multi-domain)
  • White-label per tenant · Provider Admin
  • Custom integration & migration
  • Dedicated engineering support
  • Forensic / MLS branch hooks
Request licensing details →
Technical highlights

What you get under the hood.

A compact technical summary for the people who will actually run it.

Encryption at rest
AES-256-GCM per-file · LUKS / dm-crypt storage volumes · full-storage ciphertext
Key hierarchy
Per-file DEK · per-tenant KEK · master key (HSM / KMS)
Encryption in transit
TLS 1.2 / TLS 1.3 · modern cipher suites only
Client-side mode
Zero-knowledge encryption · customer keys
Key management
HSM / KMS integration · rotation & revocation
Access control
RBAC · MFA · IP allow-lists · time-based policies
Audit
Append-only · hash-chained · SIEM-exportable
Compliance
GDPR · retention · legal hold · subject access
Antivirus
ClamAV upload scanning (built-in)
Protocols
HTTPS · WebDAV · REST API · Webhooks
Collaboration
SVC-OFFICE · SVC-Write · SVC-Calc · SVC-Dia
Office formats
.docx · .xlsx · .pptx · .odt · .ods · .odp
Migration sources
Nextcloud · HiDrive · Seafile · FileCloud · OneDrive · SharePoint · Azure Files · Google Drive · WebDAV · SFTP · SMB3 · NFS (r/o)
Mail hand-off
SEVOCOMM MTA large-attachment drop-off → secure SCS link
Runtime
PHP 8.2+ · MySQL 8+ · Apache 2.4+ · Linux
Modes
Enterprise (single-tenant) · Hosting (multi-tenant · multi-domain)
Tenant isolation
Per-tenant data · storage · settings · branding
Deployment
On-prem · private cloud · VM (VMware · Proxmox · Hyper-V · KVM) · air-gapped · ISP / telecom
The next step

Take control of your file infrastructure.

Sovereignty, encryption-by-design, and operator-held keys are not add-on features — they are the reason SEVOCOMM SCS exists. If those outcomes match your posture, the next step is a direct conversation.

You do not need permission to own your data.
You only need the right platform to store it.