The future of digital

Building on what’s there

During his eight years at icapps, Kris has helped shape the company with a strong commercial outlook, close client relationships, and a people-first approach to leadership. “In a changing market, I wanted to give our teams the space and trust to help shape how we move forward,” says Kris.

The handover to Sander builds on that work and brings a stronger technical focus to icapps’ next phase. 

Technology at the heart of our next chapter

Technology has always been at the core of icapps. With Sander in the lead, that expertise will play an even bigger role in shaping our strategy, guiding our investments, and helping clients move forward.

During his time as Head of Technology, Sander already helped strengthen collaboration across our teams and translate technical expertise into practical business value.

“Our clients need software they can rely on today and build on tomorrow,” says Sander. “That starts with understanding their ambitions and making technology choices that support them over time.”

Together with the management team, he will continue to deepen our expertise and put that approach into practice.

Looking beyond the hype

For clients, this means a partner equipped to work through increasingly complex technology choices. Where can a new capability make a meaningful difference? What needs to change before a business can scale? And when is strengthening an existing application the smartest investment?

Application modernisation remains an important part of that focus. Making essential software more secure, adaptable, and easier to maintain creates room for growth and a stronger basis for future innovation.

It’s the same curiosity and willingness to play devil’s advocate that guide our work: understand the challenge, question assumptions, and build something that keeps delivering value.

Giving innovation room to grow

That same thinking comes to life in SumZero, our AI spin-off, also led by Sander. Building on icapps’ technical expertise, it gives AI innovation the dedicated space and focus it needs to grow.

“With SumZero, we’re giving AI innovation the dedicated attention it deserves,” says Sander. “We’re building the expertise to turn its possibilities into solutions for real business needs.”

We’re grateful to Kris for the leadership and commitment that brought us here. With Sander taking the lead, we’re building on that foundation and putting our technological strengths firmly at the heart of what comes next.

‍

Built for what's next

Technology never stands still. AI is already transforming how software is analyzed and maintained, but it's only one step in a much broader evolution.

"AI is the technology of today, but it won't necessarily be the technology of tomorrow," says Sander Hofman. "Our ambition isn't to build an AI company. It's to build a company that continuously applies the most valuable technologies to solve real business challenges. Whatever comes next, that's where we'll be."

This mindset is at the heart of SumZero: combining advanced technology with engineering expertise to help enterprises gain control over complex software ecosystems and prepare for what's next.

Turning complexity into clarity

The journey starts with visibility. SumZero's proprietary Recon Platform analyzes codebases, maps dependencies, and creates a clear overview of an organization's application landscape. This gives teams a single source of truth instead of relying on scattered documentation and isolated systems.

From there, organizations can assess their software against regulations such as NIS2, GDPR, and the EAA, identifying risks and where action is needed.

Remediation can then be accelerated with AI agents that handle straightforward improvements and generate pull requests, while more complex changes are routed to engineering teams for review and implementation.

The next chapter

SumZero is a natural extension of what we've been doing at icapps for years: solving complex software challenges with practical engineering expertise.

As enterprise technology landscapes continue to evolve, the need for visibility, compliance, and maintainability will only grow. SumZero helps organizations reduce complexity, make better decisions, and create room for innovation.

Want to learn more about SumZero or how it can help you gain control of your software landscape? Get in touch with our team.

Choosing the services

To build a truly sovereign European cloud stack, we needed a provider that could compete with the feature sets of US tech giants while keeping data strictly within European borders. We chose Scaleway as our foundation. 

To create a highly available, production-ready environment, we selected the following core services:

• Containers: Managed Kubernetes (Kapsule) to handle orchestration effortlessly, backed by their own Container Registry to store Docker images.
• Database: Managed PostgreSQL to ensure data persistence with automated backups.
• Storage: S3-compatible Object Storage for static assets and secure backups.
• Networking: VPCs and Private Networks to ensure isolated, secure communication between resources without exposing them to the public internet — with a ssh-bastion service out of the box!
• Domains & Web Hosting: DNS management for easy access to our publicly exposed services, with the option to acquire additional domains natively.

Challenges and our solutions

No cloud provider is perfect, and moving away from AWS or GCP comes with specific engineering challenges. US hyperscalers offer highly specific, fully managed niche services that Scaleway does not yet provide. We choose to default to open-source self-hosted tools on Kubernetes. For example, instead of relying on a proprietary AWS-managed service, we will use containerized alternatives directly on our Kubernetes cluster.

Here are the major tradeoffs we encountered and how we solved them.

1. AWS Loadbalancer Controller

The Challenge: AWS EKS comes with a dozen of add-ons and helm charts that integrate seamlessly out of the box. In our EKS stack, we heavily depend on the AWS Loadbalancer controller, so we needed to find a suitable sovereign alternative. 

Our Solution: Kubernetes Gateway API with Envoy Gateway

With the official Kubernetes Ingress NGINX retirement we decided to implement the modern Gateway API straight away. On top of that we also had to choose for an implementation. For our implementation, we chose Envoy Gateway because it is feature-complete and industry-recognized. It gives us a great open-source alternative to AWS vendor lock-in. A major bonus is that we can now attach application-specific SecurityPolicies. This yields two massive advantages: first, it lowers the need to spin up extra cloud load balancers, directly decreasing cost; second, it shifts security left to the application layer, granting us fine-grained control.

Key Takeaway: We reduced cost and vendor lock-in while gaining increased application control and security.

2. AWS Certificate Manager

The Challenge: AWS Certificate Manager supports DNS approval with autorenewal.

Our Solution: Certmanager with Letsencrypt certificates

In our current AWS EKS setup we have a strict separation between application development and certificate management. While the latter remains an ops responsibility it collides with our shift left principles. We could just ignore that and move on with the Let’s Encrypt integration Scaleway offers out of the box. Unfortunately it lacks DNS validation and here’s the tradeoff. ACME HTTP-01 validation takes time, which can cause issues during service migrations. On the other hand DNS-01 validation has an ops dependency/bottleneck. Therefore we choose to implement Cert Manager for Kubernetes.

Key Takeaway: We empowered developers with Cert-Manager while keeping DNS control gated for complex migrations.

Coding the infrastructure

To make this proof of concept repeatable, auditable, and cost-effective, we strictly adhered to Infrastructure as Code (IaC). Hand-clicking in a console is fine for a quick test, but production requires automation. 

Terraform (cdktf): We used the official Scaleway Terraform provider to declare our VPCs, Kubernetes clusters, and managed databases.

OpenTofu & Pulumi: Since HashiCorp officially deprecated CDKTF in late 2025, evaluating the future of our IaC framework is on the horizon. While we are sticking with our current CDKTF setup for this PoC, the deprecation offers a perfect opportunity to reconsider the broader ecosystem and evaluate options like Pulumi or OpenTofu—but that is a subject for a whole separate blog post.

Leaning on open source frameworks has huge benefits when it comes to migrations. For us, it meant we could smoothly re-use our Kubernetes External Secrets Operator setup, making it easy to plug into our existing 1password integration. Of course, 1Password is not a European entity, but since their main headquarters is located in Canada, they are not subject to the US CLOUD Act. If we want to strictly sovereignize this later, we can switch to Scaleway’s native Secret Manager without hassle using their off-the-shelf Scaleway Provider.

Plugging in CI/CD

Once infrastructure was deployed we could start deploying workload.

Since our applications share the same reusable kubectl templates and helm charts, it was merely a small configuration exercise. Only a few modifications to our pipelines to manage authentication and authorization with our new Scaleway project were needed. Then we simply had to add new deployments with the appropriate configuration values in our Bitbucket pipelines and we could spin up our applications.

Last (but not least) bit in this exercise was migrating the data. However with our knowledge and experience, it was just a matter of a couple of CLI commands to push data from one S3 bucket to another and export-import a couple of databases.

Wrapping up

This proof of concept illustrates that European cloud sovereignty is no longer just a theoretical ideal or a compliance checkbox. It is a highly practical, cost-effective reality. By accepting a few engineering tradeoffs and leaning heavily into open-source tooling, we successfully built a first-class hosting environment capable of standing toe-to-toe with US hyperscalers.

The European cloud ecosystem is moving fast. While we initially bypassed queuing, IoT, and serverless options during our scoping phase, Scaleway’s rapid portfolio expansion means these services are already mature enough for production consideration today. Migrating away from the US tech giants no longer means compromising on engineering standards. It means taking control of your stack, shifting security left, and ensuring absolute data sovereignty on European soil.

What does an ISO 27001 certificate entail?

An ISO certificate is more than a badge. It’s official proof that an organization operates according to internationally recognised standards. ISO 27001 specifically focuses on information security, ensuring that data is handled responsibly, securely, and consistently across every process.

‍

Unlike common perception, it isn’t just about firewalls, passwords, or encryption. It’s about people, processes, and accountability. It ensures that information security is integrated into every layer of our organization, from HR and finance to software design and client delivery. It’s about embedding security into the way we think and work.

‍

As cyberattacks become a daily headline, they remind us how fragile digital ecosystems can be: data leaks, ransomware, systems brought to a halt. Meanwhile, regulations like the NIS2 directive are tightening across industries, making robust information security a requirement.For icapps, this certification confirms that information security is built into our DNA and into every digital product from day one.

‍

‍

Security in every layer

At icapps we’ve mapped out every process that could affect information security. Throughout this journey, security stopped being “someone’s responsibility” and became everyone’s mindset.

‍

It starts internally with clear policies, structured processes, and shared responsibility. We are certified across our full operational scope, meaning that every process within our organization, from HR and finance to design, engineering, and project delivery, adheres to the ISO 27001 standards. Take our joiner-mover-leaver process: when someone joins the team, they receive access only to the systems and data relevant to their role. When responsibilities change, so do access rights. And when someone leaves, all permissions are revoked immediately. It’s a simple principle that prevents small oversights from becoming big vulnerabilities.

‍

That same thinking flows into our projects. From the very first design phase, we ask:


• What kind of data will this platform process?
• Where will that data live?
• What safeguards are needed to protect it?

Our CI/CD pipelines automatically perform security checks, dependency scans, and code analyses to catch vulnerabilities early. Every product we build adheres to OWASP ASVS standards, which define best practices for secure application development.

This way, every release meets the same high standards for performance and protection.