FortiBleed exploited no new flaw, just weak operations. 374 firewalls affected in Austria. Checklist: management access, rotation, MFA.

FortiBleed: FortiGate Hardening Checklist

RockLogic runs GLM-5.2 in its own data centre, on CPUs instead of GPUs. What an open model under the MIT licence means for SME data sovereignty.

GLM-5.2, self-hosted: an open model no one can switch off

Anthropic pulled Fable 5 three days after launch, globally. Why model dependency is a board-level risk and how to build AI systems you can swap.

What happens when your AI provider shuts down a model?

What the EU AI Act means for Austrian SMEs from August 2026: transparency obligations, postponed deadlines and concrete steps.

The AI Act for SMEs: What applies from 2 August 2026 and what was postponed

The 3-2-1-1-0 rule explained: why daily backups are not enough against ransomware and what a resilient backup strategy looks like.

3-2-1-1-0 Backups: Why Daily Backups Are Not Enough Against Ransomware

A year of Microsoft 365 Copilot in practice: where the AI tool delivers in everyday SME work, where it disappoints, and whether the license pays off.

Microsoft 365 Copilot: What We Think After a Year of Testing

Four routes to AI in-house: from an EU cloud service to your own LLM server. Data protection, cost and effort compared.

AI in Your Own Data Center: Four Routes from an EU Cloud Service to Your Own LLM Server

Why classic dashboards only answer known questions and how AI on your own data finds the questions you overlook.

Dashboards answer what you already knew. AI answers what you didn't know to ask.

Ubuntu is open source, but not free to run. What Ubuntu Pro, support and maintenance really cost in the enterprise.

“Ubuntu is free” is only half true. What Ubuntu costs in the enterprise.

Claude AI in everyday SME use: concrete applications, honest limits, and what to watch for in data protection and rollout.

Claude AI in SMEs and the Mid-Market: Where It Helps and Where It Falls Apart

Technical debt in IT infrastructure adds up quietly. What it really costs and how to pay it down in a controlled way.

Technical Debt in IT Infrastructure: What It Really Costs

Outlook Classic, Outlook New or eM Client: a hands-on comparison of mail clients for businesses, with a clear recommendation for each scenario.

Outlook Classic, Outlook New or eM Client: Which Mail Client Fits Your Company?

Forgotten firmware updates are an open door. Why patch management on firewalls, switches and devices is mandatory.

Forgot a Firmware Update? Attackers Didn't.

The NISG 2026 implements NIS2 in Austria. Who is affected, which deadlines apply, and how SMEs can prepare step by step.

NIS2 in Austria: What the NISG 2026 Means for SMEs and How to Prepare

Cloud or your own hardware? For SMEs the question is framed wrong. When each one pays off, and why hybrid is often the better answer.

IT Infrastructure for SMEs: Cloud or Your Own Hardware. There Is a Better Option

After the Broadcom takeover, VMware costs are exploding. Why Proxmox VE is the viable alternative and how the migration works.

VMware Is Yesterday. What Do You Do When the Bill Arrives?

From workshops to ad agencies and industrial suppliers: AI removes repetitive work from the daily routine. We help with quote and email drafting, search across your knowledge base, document capture and workflow automation. Our preferred model is Claude. It integrates cleanly with an MS365 environment as well.

Small and medium-sized enterprises

Confidentiality is not negotiable. For tax advisors, lawyers and notaries we prefer locally hosted or EU-region models, integrate with DATEV, BMD, RA-MICRO and similar tools, and use clear permissions to keep client data where it belongs.

Law and tax firms

At a certain size, AI becomes a platform question. Which provider, which models, which cost controls, which audit trail? We build a central AI landing platform with single sign-on, logging, model routing and an internal AI assistant that knows your business. Our default is Claude, because in practice it is the strongest model for both research and writing tasks. Including inside MS365 environments.

Mid-market companies

Three audiences, three priorities

Let’s figure that out in a no-strings call. We bring concrete examples from comparable companies and identify three to five use cases that would deliver measurable benefit today.

Where will AI pay off in your business?

Frequent questions

Claude is our preferred general-purpose model. Available in the EU with a data processing agreement and opt-out from model training, or integrated directly into your MS365 environment. Sensitivity labels, restricted SharePoint scopes and retention still apply.

Anthropic Claude as default

Where Claude does not fit or you need a second source, we also run OpenAI in an EU region, Mistral or other providers. With a central gateway, logging and per-team cost quotas.

OpenAI, Mistral and other providers

When data must not leave the building we run models on dedicated GPU hardware or in our data centre. From a 7B assistant on the receptionist’s PC to a 70B model for legal and tax work.

Local open-source models

With pgvector, Qdrant or Weaviate we build knowledge bases over your documents, emails and tickets. With proper permission filters and citations, so users can trace where an answer came from.

RAG and vector databases

We are not tied to a single vendor. We choose what fits your requirements, budget and risk appetite.

Models and platforms we operate

We look at your processes and identify the three to five areas where AI brings measurable value today. And the three you should leave alone for now.

Use-case workshop (1 to 2 days)

Which data may we use? Which models and providers fit GDPR and the EU AI Act? Where do we need a Data Processing Agreement, where a local model?

Data and compliance check

We ship a first use-case live: Claude inside your MS365 stack, a RAG chatbot on NextCloud or SharePoint content, or a local LLM on dedicated hardware. With clear success criteria.

Pilot in your environment

We roll the solution out company-wide, train users and power users, take over operations and deliver monthly reports on usage, cost and risk.

Roll-out, training and operation

How we introduce AI

AI works best where it has access to clean data, sane processes and proper identities. If we already run your servers, MS365 or NextCloud, half of the integration is already done.

We know your IT, because we run it

For every use-case we check which data may leave the building, sign Data Processing Agreements where required, document risks and set up fully local models in your data centre when confidentiality demands it.

GDPR, confidentiality and EU AI Act baked in

Llama, Mistral, Qwen or DeepSeek on your own GPU hardware or in EU cloud is no longer a research project. It is daily work. We pick the right model for your cost structure and privacy needs.

Open-source models when they fit

We train your team on real-world usage, prompt design and the limits of the models. So AI stays a tool and does not become a belief system.

Training is part of the deal

Why AI with RockLogic

Pragmatic, GDPR-compliant, without US cloud if you prefer

AI for SMEs, law and tax firms and the mid-market

Events

Blog

The pattern is not specific to us. Most mid-market companies sit on more data than their teams can read end to end. BI warehouses, CRM exports, application logs, telemetry, mail archives. The data exists, dashboards summarise it, and most of the signal still goes unused because no one has the time to cross-reference it across systems.
We had exactly that problem in our own house. Our observability platform [StereumLabs](https://stereumlabs.com) went live in September 2025 and runs 73 software-version stacks in parallel on our own bare-metal hardware, with new versions cycling in and out as vendors release them. Around 390 distinct node configurations have already run through the platform since launch. Different vendors, different implementations of the same protocol, all instrumented with Prometheus metrics, Grafana dashboards and Elasticsearch logs. We use the data to qualify new software versions before they reach our [production validator fleet](/cases/lidoOperator), and we give the broader Ethereum community a neutral view of how vendors actually behave next to each other.
Three engineers cannot work through hundreds of dashboards per week, cross-reference logs across 73 stacks and still ship the rest of their work. A lot of useful signal sat in metrics and never made it into a report.
We did what we have been recommending to clients: we put a self-hosted [AI workbench](/solutions/ai) in front of the data, around a managed language model. Not a chatbot for show. An analysis layer that does the reading on our behalf, and that we can build the same way for any other dataset.

The stack is small on purpose. The components are not specific to our domain.
[LibreChat](https://www.librechat.ai) is the frontend. Open source, self-hosted on our own infrastructure, with multi-user authentication, role-based access and the usual enterprise controls. Every conversation lives in our database. No third-party SaaS captures the chat history.
Anthropic Claude is the language model, reached over the Anthropic API. Claude is the model that produced the report quality we wanted. We tested alternatives. None landed at the same level of structured, source-cited output for technical analytics.
Grafana and Elasticsearch are connected through the [Model Context Protocol](https://modelcontextprotocol.io). Claude does not get the raw database. It gets a narrow, audited set of tools that ask Grafana and Elasticsearch for exactly what is needed for the current task, no more. The MCP surface is the security boundary, and the tool allowlist is where we spend the operational attention.
The same pattern works whether the underlying data is software telemetry, application logs, BI cubes or a sales pipeline. We chose Grafana and Elasticsearch here because that is what our platform runs on. With a different data layer, the MCP servers change, the rest stays.
We [build this layer ourselves](/expertise/softwareDevelopment), including the integrations, the report templates, the prompt structure and the operational policies. In Q2 2026 we open the same architecture as commercial features on [StereumLabs](https://stereumlabs.com) for paying customers: AI Alerting (threshold plus AI root-cause analysis) and Security Monitoring (SSH-login verification, service-restart analysis, config-drift detection).

![Architecture: user, MCP allowlist and data sources stay on your EU infrastructure; only a curated query slice crosses to the Anthropic Claude API, with the answer returning through the same boundary](/img/cases/ai-on-own-data/architecture.svg)

Installing MCP took an afternoon.
The actual work was the instruction set. Around 200 hours of editorial work went into it, separate from the engineering team. What does a useful report look like in our domain? What has to be checked, every single run? What counts as a finding versus a fluctuation? Which queries are allowed? When should Claude refuse to answer and ask for a narrower scope? These are not technical questions. They are editorial ones, and we wrote them down in full for the first time when we built this system. The instruction set is now version-controlled and reviewed like any other piece of production code.
Alongside the instructions came the report architecture: a stable structure for outputs, a clear separation between observation and interpretation, and the rule that every claim carries its source query and time range with it. Reproducibility is a hard requirement. A report we cannot rerun a week later is a report we cannot trust.
If a colleague were starting from scratch today, this is where we would tell them to spend their time. The MCP wiring is given. The instruction set is the product.

Two operational lessons came out of the first weeks in production.

- **Throughput.** Claude is the bottleneck, not the data layer. Grafana and Elasticsearch answer in seconds. The constraint sits on the model side, in tokens per second over the API. A weekly report is therefore not one request but a sequence of smaller, focused passes with intermediate state stored on our side. Pagination is the rule, not the exception.
- **Context discipline.** Claude can hold a lot of context. That does not mean it should. When we pushed bulk data into one prompt, the output drifted: claims appeared that no source query supported. The fix was not a larger or smaller model, it was discipline. Trim context to the minimum that answers the question, give clear guardrails (if a finding is not anchored to a query result, do not report it), make source citation mandatory.

Once the guardrails were tight, hallucination stopped being a recurring issue. We can leave an analysis pass to run unattended and the output reads like a careful engineer wrote it, with sources and admitted uncertainty.

A language model with mandatory citation and a tight context becomes a tool that an analyst can trust, instead of a generator that has to be checked sentence by sentence.

The interesting part of the project was never the architecture. It was what the system surfaced once it could read the data faster than the team could.

Three examples from our own data, published openly on our [engineering blog](https://docs.stereumlabs.com/blog) under human review, with the source-specific vocabulary stripped out so the shape stands clear.

1. Routine task, same input, same hardware. One vendor implementation finished in roughly ninety minutes. Another took over eight days. Two orders of magnitude on the same input, a spread nobody had quantified across the full vendor matrix before. The kind of finding that informs procurement and capacity planning for years.

2. New feature in the protocol, verification stage. Performance spread across implementations by a factor of fifty. The fastest vendor was 50x faster than the slowest on the same workload. The user community picked the report up within hours of publication.

3. Work-output stage. Two vendors implementing the same protocol diverged so far that one consistently delivered partial results while another filled to capacity, on identical input. A defect the vendor team acknowledged the same week we surfaced it.

Findings like these are why we built the system. Not faster dashboards. Different questions, like "which software version performs best right now?", that we did not know how to phrase as a structured query, but that an instructed language model can phrase on our behalf and then answer by going back to the data.

Vendor performance spread, hidden implementation defects, patterns across parallel stacks. Any business that runs more than one supplier or more than one version of the same software is sitting on the same kind of comparison data, and most of it currently goes unread.

Strip our technical data and replace it with a CRM, a BI warehouse, an application log stack, a sales pipeline, an inventory database. The pattern stays the same. A self-hosted conversational layer, a language model under explicit guardrails, MCP as the audited tool bridge, your own data as the source.

In Q2 2026 we open AI Alerting and Security Monitoring on [StereumLabs](https://stereumlabs.com) as commercial features for paying customers. Same instruction-set discipline, same MCP boundary, same Claude-based analysis layer, attached to the customer's view of the same kind of neutral data. Not a theoretical transfer, an operational one.

Three places where the pattern pays back for any KMU or mid-market business with data they currently look at but rarely interrogate.

**BI.** Dashboards answer the questions you already knew to ask. A guarded language model on top of the same warehouse lets people ask new ones in their own words, with every answer anchored to the underlying query. Typical finding: a regional revenue drift that no single dashboard surfaced because the breakdown crossed three filters that nobody normally combines.

**Sales.** Pipeline data, call notes and mail archives are searchable but not summarisable. A self-hosted workbench around a managed model changes that: the raw CRM and notes stay on your infrastructure, only the curated query result reaches the model. Typical asks we hear from clients:
- Build a unified product catalogue from CRM and ERP entries instead of maintaining it by hand.
- Summarise feedback from sales reps that is scattered across the CRM into actionable rollups.
- Find deals that stall at the same buying-process step every quarter, visible in the notes but not in CRM stage fields.

**R&D and operations.** Logs, telemetry, test reports, incident history. The same pattern that worked for our own platform works for any production system where the data already exists but no one has time to read it end to end. Typical finding: a configuration change that correlates with an uptick in errors three days later, on a service nobody was monitoring closely.

The data boundary is explicit. Raw logs and metrics stay on our EU infrastructure, on hardware we own. What reaches Claude is a curated, query-scoped slice, requested through MCP under a fixed tool allowlist.

For this deployment we use the Anthropic US endpoint directly, because the StereumLabs telemetry crossing the boundary carries no personal or commercially sensitive data. For client engagements with personal or sensitive content, we route through Anthropic on AWS Bedrock EU or a comparable EU-hosted model. Full conformance details, including ISO 27001 (certified Q1 2026, zero major findings), DSGVO posture and subprocessor handling, on [rocklogic.at/conformity](/conformity).

The numbers from the first seven weeks in production, 25 March to 12 May 2026:

- One analysis report per week, eight reports total. Every one co-authored by the AI system, reviewed by a human engineer before publication, anchored to verifiable source queries.
- Setup cost so far: roughly eight person-weeks across a small team and seven calendar weeks, with about half spent on the editorial layer that defines what a report has to do.
- External baseline: comparable cross-stack analyses by other research groups have taken two to four weeks, often with narrower coverage. End-to-end on our side now: one to two hours of one engineer's time per report, including the AI generating the draft and the engineer reviewing the result.
- The engineering team treats the alert layer as a peer that flags anomalies on its own.

The eight person-weeks are the setup. Ongoing cost is data-dependent: where the data lives, how complex the MCP integration is, how often the data layer changes underneath. Setup is the one-time piece, operation scales with usage and complexity.
For a client engagement, the typical pilot timeline is four to twelve weeks end to end, depending on the technical setup and the data-protection requirements involved.

We built this for ourselves, we live with it every day, and the operational lessons transfer one to one to clients. That is [the AI offering](/solutions/ai) we can stand behind.

Self-hosted AI workbench (LibreChat, MCP, Grafana, Elasticsearch) with Anthropic Claude as the managed model, live on StereumLabs since March 2026. One to two hours per cross-stack report instead of two to four weeks. Same architecture opens as commercial AI Alerting and Security Monitoring in Q2 2026. Transferable to BI, sales and any production data that lives in dashboards no one reads end to end.

AI on our own data since March 2026: 1-2 hours per cross-stack report, ISO 27001, commercial in Q2 2026

AI on our own data: self-hosted workbench with LibreChat, MCP, Grafana and Elasticsearch on EU infrastructure, Anthropic Claude as the managed language model. Built by RockLogic, live since March 2026, around eight person-weeks of setup, commercial rollout in Q2 2026. GDPR-aligned, ISO 27001. Transferable to BI, sales and R&D in any KMU.

The hard part was not connecting Claude to our data. That was an afternoon. The hard part was teaching the model what a useful report looks like, and stopping it from hallucinating when we threw too much raw data at it. Once the guardrails were tight, the real findings started coming in: a 50x performance gap on one task, sync times stretching from ninety minutes to over a week on another. Same data, different vendors. We are putting the same architecture into the hands of paying customers in Q2 2026.

We gave Claude our own data. This is what came out.

StereumLabs AI

Practice in regulated banking environments: OAuth2 and PSD2 stacks, IAM and WAF lifecycle, banking platform migrations, FMA and pentest accompaniment, .NET modernisation. A publishable case description is in preparation. Until then we share the substance in the first call under NDA.

Banking IT since 2019

Practice in regulated environments

Banking IT

We build the same pattern (self-hosted workbench, managed model, your own data) for BI, sales, R&D or operations in your business. Typical pilot: 4 to 12 weeks, depending on technical setup and data-protection requirements. First conversation under NDA, no sales pressure.

Same for your data?

In February 2020 the long-time IT lead of a Lower Austrian wholesaler retired. What we took on: an infrastructure grown over two decades, maintained by a single person. Incompletely documented, virtualisation platform near vendor end-of-life, firewall at its capacity limit (especially VPN slots), no central monitoring, no consistent backup concept. A textbook case of „the colleague knew everything, but it was written down nowhere”.
The handover ran for about a year via phone briefings, no hard cut-over, deliberately gliding. The wholesaler is conservative and mid-market, oriented toward the long term. Stability, documentation and predictable change matter more than the next trendy tool.

First productive task: mine the old, unversioned wiki and migrate the knowledge into a versioned documentation platform with a ticketing system. In parallel we set up central monitoring, brought our own certificate infrastructure and wrote the first Ansible playbooks so that server setups become reproducible. In the same phase the migration from on-premise Exchange to Microsoft 365 including SharePoint and Teams, plus MailStore for legally compliant archiving. We also introduced sprint-based collaboration with the client. IT as a planned sequence of work, not as constant patchwork.

An external penetration test by an accredited Austrian security auditor produced a remediation catalogue. We prioritised it together with the client and worked through it over the following months, taking pragmatic shortcuts wherever the effort for an ideal solution would exceed the business value. At the core: complete firewall migration onto FortiGate in high-availability, replacement of all VPN connections, and switching refresh at multiple sites. Planned maintenance windows outside business hours, hedged fallback scenarios. The normal discipline for this kind of migration, done once cleanly rather than several times half.

Around 3,900 hours logged, the most intensive year. Migration of the virtualisation platform onto Proxmox VE in a cluster, plus a Proxmox Backup Server. Active Directory reorganised including a new naming scheme, first proven in a test lab, then migrated to production. CRM server replatforming with no data loss, replacement of a reporting server onto a new platform, new VPN architecture at the branch sites, full printer overhaul with a central print-server VM and driver standardisation. Plus a planned shutdown for a UPS replacement. Rarely without tension, but executed under control.

Started the Windows 11 rollout with central image management, road-warrior setup for mobile staff, website re-launch in Q4. Internal audit covering network, VPN and VMs. The endpoint refresh ran quietly alongside daily business, with no breakage.

Mobile device management introduced with Miradore: policies, client deployment, staged rollout. Major site refresh at several branch locations: network hardware swap, desktop and notebook refresh, multi-day on-site work, dozens of device handovers with individual onboarding. Fibre uplink with VPN switch-over, MacBook integration into the central identity architecture.
In 2026 then browser standardisation on MS Edge (centrally managed via Miradore), Outlook New and eM Client rolled out as mail clients, MailStore archiving migrated to Exchange Online. In parallel a controlled Claude AI pilot with five users. The client wants to bring the next generation of tools in deliberately, not be caught off guard later.

Not a single big hero story, but quiet reliability over six years. Four clean platform migrations without production data loss:
• Full firewall migration onto FortiGate in high-availability (2022)
• Virtualisation platform onto Proxmox VE in a cluster, plus a Proxmox Backup Server (2023)
• Active Directory reorganisation including a new naming scheme (2023)
• CRM server replatforming with no data loss (2023)
On top of that a passed pentest in 2022, continuous modern-workplace migration from the mail server through to a controlled AI pilot, and over 1,350 active workdays at the client with no documented security incident.
Frankly, not everything is by the book. In some places we keep technical debt deliberately on the list, wherever the effort for an ideal solution would exceed the business value. We track it transparently and revisit those topics on a cycle. The setbacks belong to the honest picture too: a UPS failure in 2023 caused an unplanned shutdown. Since then we run planned shutdown drills annually plus irregular failover tests. A switch failure in 2025 coincided with planned electrical work. Combined fault patterns like that need agreed escalation paths, which we have documented since.
No ideological blinkers, no drama, no marketing slide: that's what six years of continuous operation actually amount to.

Take over an infrastructure grown over two decades after the long-time IT lead has retired. Four clean platform migrations without data loss and 99.99% uptime over six years. Without drama.

Six years of quiet IT modernisation in B2B wholesale

B2B wholesale Lower Austria: takeover of a 20-year infrastructure, four platform migrations without data loss, 99.99% uptime over six years.

Six years of quiet IT modernisation

B2B wholesale in Lower Austria

From practice

Lido expanded its Curated Set in 2022, the group of DAO-vetted server operators that runs the liquid staking protocol now responsible for around 22 to 25 percent of all staked ETH on Ethereum. Selection is not driven by price but by business continuity, key management, infrastructure, software-stack diversity, geographic distribution, and regulatory posture.
We were invited because we run two of our own open-source projects for the Ethereum community: [Stereum](https://stereum.com) and [StereumLabs](https://stereumlabs.com). Stereum lets other operators and solo stakers install, configure and maintain a full validator stack. StereumLabs is a neutral observability platform that runs all 37 execution-by-consensus client combinations in parallel on dedicated bare-metal hardware. Both are funded in part by Ethereum Foundation grants.
We were officially admitted into the Curated Set in March 2022, and the first Lido keys were deposited later that year. Within a few months we ran several thousand validators. We were not selected because we offer the cheapest validator hosting. We were selected because our public-goods work was treated as a strategic contribution to Ethereum's decentralisation.

Operating in the Curated Set is materially harder than generic staking-as-a-service.
Consequences per mistake. A single misconfiguration costs the staker community real ETH. Slashing penalties, missed attestations and missed block proposals come straight out of the rewards pool that backs stETH.
24/7, no maintenance windows. Any downtime is measurable, public, and reported in Lido's quarterly VaNOM reports.
Public accountability. Performance is benchmarked publicly via rated.network and VaNOM, incidents are post-mortemed in public.
Client diversity is mandatory. The DAO actively pushes operators away from supermajority clients (Geth on the execution layer, Lighthouse on the consensus layer). Operators are expected to run minority clients in production, which is operationally more expensive.
Protocol keeps evolving. Lido ships major changes regularly: Pectra readiness, Triggerable Withdrawals, 0x02 credentials, Curated Module v2, Simple DVT, the Community Staking Module. Operators have to keep up.

On 13 April 2023, eleven of our validators were slashed. The root cause was a combination of an operational failover decision and a Prysm client bug. We worked directly with Prysmatic Labs to fix the bug. Since then we have hardened the key migration end to end (mandatory full cluster wipes during failover, doppelganger protection where supported) and documented the full post-mortem publicly. The incident also seeded a wider DAO discussion on how operator incidents should be handled across the protocol. The DAO imposed a temporary key limit on us, which was later lifted by DAO vote.
For the full technical detail, see the [public post-mortem on research.lido.fi](https://research.lido.fi/t/slashing-incident-involving-rocklogic-gmbh-validators-april-13-2023/4399). We came out of the stress test with a stronger standing in the community than before, precisely because the response was technical, open, and aimed at the protocol rather than at defending the operator.

We run Lido validators across three independent server sites to eliminate single-datacenter risk: two professional colocation facilities in Vienna (different providers, different network operators) and one dedicated on-premises facility in Lower Austria, fully managed by us.
All physical hardware (servers, switching, routers) is owned by us. Colocation is the only external dependency at the infrastructure layer. Public IPv4 ranges and routing hardware are also owned and configured in-house. Zero cloud dependency for production validators. Per rack: dual UPS, dual emergency power, dual network uplinks, redundant switching, redundant hosts.
As of Q1 2026 we manage 7,332 Lido validator keys (around 235,000 ETH or roughly EUR 400m at current prices) across 27 full nodes. In production we run five different execution-layer clients (Geth, Nethermind, Besu, Reth, Ethrex) and six different consensus-layer clients (Nimbus, Prysm, Teku, Lighthouse, Lodestar, Grandine). MEV-Boost is active across all relevant nodes with a vetted relay set. Pre-signed voluntary exit messages are generated and stored for every validator. This is one of the most diverse client setups in the entire Curated Module.

In Q1 2026 we deployed a 1,000-key cluster using Obol's Distributed Validator Technology. Four DVT nodes distributed one per site (the Lower Austria facility participates as well), keys shared across the four via threshold signing. No single node holds a complete key. The four validator client implementations across the cluster are Lodestar, Teku, Nimbus and Prysm, keeping client diversity inside the DVT cluster itself.
The choice of Obol over SSV was deliberate. SSV is the dominant DVT protocol in the Lido ecosystem. A homogeneous DVT layer is a systemic risk for Ethereum. Supporting Obol is a counter-concentration move.

We use our own open-source software: [Stereum](https://stereum.com) for setup and lifecycle management of the nodes (Lido KAPI, Ejector and CSM are integrated directly), [StereumLabs](https://stereumlabs.com) for client comparison, sync-speed analysis and pre-production qualification of new client versions on the Hoodi testnet before they reach Lido production. Internal monitoring on Prometheus and Grafana with alerting and failover archive nodes that retain metrics and logs even when a primary site goes offline. AI-assisted analysis layer (StereumLabs AI Chatbot and AI Alerting) in production since 2026.
In Q1 2026 we completed ISO 27001 certification with zero major findings, one minor finding and a small list of opportunities for improvement. Documentation, access control, change management and incident response that had been operating informally for years are now formally documented. Quarterly infrastructure reports to Lido, active participation in the Lido Node Operator Community Calls, 24/7 readiness across the engineering team.
Alongside the operator role we have received grants from the Lido Ecosystem Grants Organization (LEGO) for our open-source work on Stereum over several years, totalling around USD 20,000 plus EUR 149,740. All were reviewed publicly on research.lido.fi by the LEGO committee and approved by the DAO. The grants cover the initial development. Ongoing maintenance of the integrations, meaning compatibility with future Lido releases, user support and bug fixes, we carry on our own. That distinction matters when looking at the long-term economics of the relationship.

Around 4,900 engineering hours since the official admission in March 2022, 717 internal tickets, three sites, 27 full nodes, 7,332 validator keys, ISO 27001 certification in Q1 2026. Highest client diversity in the Curated Module by our Q1 2026 measurement. Active contribution to DVT diversification through the Obol cluster.
And a public slashing incident we grew from. We did not bury it. We worked it through technically and turned it into a protocol-wide improvement. The Lido community recognised that.
That is what Curated Operator work over multiple years actually amounts to: own open-source contributions, redundant infrastructure under our own ownership, client diversity even when it is operationally more expensive, an honest response when incidents happen, ISO-certified processes, and a direct line to client teams and to Lido Node Operator Management.

Curated Node Operator for the largest liquid staking protocol on Ethereum. 7,332 validator keys, around 235,000 ETH under management (about 2.5% of Lido's total stake), three independent sites with zero cloud dependency, ISO 27001 certified. Plus the honest story of a slashing incident in 2023 and how we handled it.

Lido Curated Operator since 2022: 7,332 validator keys, ISO 27001, open-source contribution

Curated Node Operator for Lido: 7,332 validator keys, ~235,000 ETH under management, three sites, ISO 27001, plus open 2023 slashing report.

From the public post-mortem on research.lido.fi, 28 July 2023.

Even more, we are one of the most involved operators intensively driving minority client usage (consensus and execution). [...] We are not happy that notwithstanding our best efforts, this slashing incident has occurred to us, but we like to see it as a major investment into a better future, creating a precedence on which we all jointly had to react upon by now setting up a common process of how to deal with incidents like these and the parties concerned.

Validator operations for the largest liquid staking protocol on Ethereum

Lido Curated Operator

Case studies from real client engagements: IT takeovers, platform migrations, validator operations. Anonymised where required, named where public.

References: IT case studies from real engagements

From practice: what we do for clients

References

Founded in

Years in business

Team members

Inventor of Stereum

Two business areas

ISO 27001:2022 certified

Long-standing partnerships

100% self-funded

Independent

Own data centre in Austria

Active in the Ethereum community

With Stereum Services as our own sister company, we have given RockLogic the room to focus on the two areas where we are strongest: fully managed IT infrastructure for SMEs, law firms and mid-market companies, and specialised validator hosting for institutional Ethereum operators. On top of that, GDPR-compliant AI is becoming a third area that gains substance quickly. We grow carefully, self-funded, and in a way that lets us hold the quality of our work.

Where we are heading

After several years in large IT organisations, in 2012 Stefan Kobrc wanted to take responsibility himself. Together with like-minded people he founded RockLogic GmbH. The mix of server maintenance, web projects and IT consulting carried the company reliably through the early years and is, with shifted emphasis, still core business today.

Founded in 2012

Out of the wish to have an own product, Stereum was born: open-source software that makes setting up an Ethereum node radically easier. From 2020 onwards, Stereum became one of the better-known tools in the Ethereum community and brought us partnerships with Lido, Obol and a number of other projects.

Stereum as door opener

With the launch of Ethereum from 2015, blockchain became interesting for us, because for the first time real application logic on-chain became possible. Stefan Kobrc started with a simple Docker Compose setup, the predecessor of Stereum, to make running Ethereum easier.

Entry into blockchain

Between 2020 and 2024 we grew from a small operation to a mid-sized IT provider. In 2024 we founded Stereum Services FlexCo as a sister company for Stereum, and launched StereumPlus, a hosting product around Ethereum nodes.

Growth 2020 to 2024

In March 2026 we had our Information Security Management System (ISMS) certified to ISO/IEC 27001:2022, audited by Tempo Audits under UKAS accreditation. The structured handling of risks, processes and responsibilities is part of our daily operations since then, not a one-off project.

ISO 27001:2022 (2026)

Company facts

Company history

This page describes how RockLogic came about, what we measure ourselves against and where we want to go from here.

About us

What working with us looks like and why it’s worth it.

Join us

We don’t grow through marketing budgets, we grow through referrals. That only works if the team can do good work and clients always know where they stand with us.

What works for us

Flexible in time and location. We rely on mutual respect, clear responsibilities and trust that doesn’t come from the org chart but from work that has actually been done.

How we work

“I don’t believe in hierarchies. Only satisfied people drive long-term success. That means everyone knows what has to be done, everyone in the team looks for the tasks that suit them best. Combined with transparency, open communication and a relaxed, collaborative coordination.”

Stefan Kobrc on hierarchy

We share what we know. Internally and externally: through our blog, talks at universities and conferences, and through the joint “Become a Node Runner!” workshops we run together with Stereum Services.

Sharing knowledge

Web, backend, mobile, Web3, smart contracts. Out of this experience grew our open-source software Stereum, used today by thousands of validator operators worldwide.

Software development

Operational and business-data analysis, AI-assisted research, work in the Ethereum space. Example: StereumLabs compares all relevant Ethereum clients in parallel on dedicated hardware, with findings published openly.

Data analysis and research

DevOps, system administration, network, data centre, endpoint management. This is where servers, clusters and backups for our clients run, alongside our own infrastructure. ISO 27001:2022 certified.

IT infrastructure

Corporate culture

We are organised into three focus areas. Each one has a concrete example from our own work that shows what we can do.

Areas

Get to know the people behind RockLogic and the departments we work in.

Our team

RockLogic is a self-funded, multinational team of IT experts based in Stockerau, Lower Austria. Since 2012 we run IT infrastructure for SMEs, law firms and mid-market companies, develop our own open-source software, and operate one of the most experienced Ethereum node-operation practices in Austria.
In March 2026 we had our ISMS certified to ISO/IEC 27001:2022. We hold our client work to the same standards we hold our own operations to.

Our company

Tell us what is on your mind: a concrete project, an open question on infrastructure, AI or node operation, or simply a first conversation. We get back to you within one working day.

Contact

We use technically necessary cookies to operate the site. Optionally we collect anonymous usage data via analytics to improve it. Your choice.

Cookies

Colour

HEX-Code

RockLogic was founded in 2012 by Stefan Kobrc in Stockerau, Lower Austria, and runs two business areas today: fully managed IT infrastructure for SMEs, law firms and mid-market companies, and specialised validator hosting for Ethereum.
In the infrastructure area we plan, build and run server and cloud setups (Proxmox, VMware, MS365, NextCloud), backup strategies, MDM, networking and firewalls. Since 2025 we extend that with GDPR-compliant AI for law firms and mid-market companies.
In the validator area we run validator servers for Lido, Obol and other platforms, based on our open-source software Stereum, which we spun off into our own sister company Stereum Services FlexCo in 2024.
In March 2026 our ISMS was certified to ISO/IEC 27001:2022.

RockLogic is an Austrian IT services provider based in Stockerau. Since 2012 we run IT infrastructure, MS365 and NextCloud setups, backup, networking and AI for SMEs, law firms and the mid-market. Alongside that, with Stereum, we are one of Austria’s most experienced Ethereum node operators. ISO/IEC 27001:2022 certified since 2026.

Boilerplate (long)

Boilerplate (short)

Boilerplates

RockLogic has been running IT infrastructure and node operations from Stockerau, Lower Austria, since 2012. We work for SMEs, law firms and the mid-market on servers, cloud, MS365, NextCloud, backup, MDM, networking and AI, and we are among the most experienced Ethereum node operators in Austria.

RockLogic in two sentences

RockLogic was founded in 2012 by Stefan Kobrc. On the IT side we run infrastructure for clients in industry, trade, finance, as well as law and tax firms. Out of our own development work we built Stereum, an open-source tool for running Ethereum nodes, which we moved into our sister company Stereum Services FlexCo in 2024.
Since 2023 we also work on smart contracts on Ethereum and EVM-compatible networks. Since 2025 we additionally offer GDPR-compliant AI as a dedicated consulting and operations service tailored to our existing IT-infrastructure clients.

Our business areas

Stereum’s success led us to founding Stereum Services FlexCo in 2024, taking responsibility for the Stereum product and distribution. Since then RockLogic concentrates on two pillars: fully managed IT infrastructure and specialised validator hosting for institutional Ethereum operators. AI for SMEs and law firms is a fast-growing third area since 2025.

We grow self-funded, in a way that lets us hold the quality of our work. The company is led by Stefan Kobrc, with a flexible working model in time and location and collaboration based on respect, transparency and clear responsibilities.
Stefan Kobrc on hierarchy: “I don’t believe in hierarchies. Only satisfied people drive long-term success. That means everyone knows what has to be done, everyone in the team looks for the tasks that suit them best.”

Company description

Downloads

“A blockchain is a continuously growing list of records, called blocks, that are linked together using cryptography. Each block contains a cryptographic hash of the previous block, a timestamp and transaction data. Once recorded, data in any given block cannot be altered retroactively without alteration of all subsequent blocks. Blockchains are an example of distributed ledger technology (DLT) and resemble, in the way they work, an accounting journal.”
(Source: Wikipedia)

Definition

Ethereum is the largest smart-contract blockchain in the world: a decentralised, permissionless network. On top of transactions in its native currency Ether (ETH), Ethereum allows the execution of smart contracts and an entire ecosystem of decentralised applications, from DeFi through NFTs to identity.
For the entry there are still two hurdles: solid Linux skills if you want to run your own node, and a certain amount of starting capital. This is exactly where our work with Stereum begins.

The Ethereum blockchain

With Stereum we make Ethereum accessible to everyone who wants to participate in the network without deep Linux or DevOps experience.
For everyone who wants to participate without running their own server, we take over the hosting as a service.

Our mission

With Lido as our biggest partner in the Ethereum world we develop specific functions for Stereum and run validator nodes in the Lido pool. From this collaboration we learn what institutional operators really need.

Together with Lido

Blockchain, alongside AI, is one of the technologies that has shaped the last decade most. At its core it is a decentralised database that cryptographically chains transactions together and makes them traceable without a central authority. From there grow applications like cryptocurrencies, smart contracts, NFT use-cases and tokenised assets.

Blockchain

These pages describe what we technically do, with which tools and on which platforms. Many topics connect: experience from our own data centres flows into client projects, the work in the Ethereum space shapes our view on automation and high availability.
If you are looking for offerings rather than methodology, see Solutions.