Every advantage has a cost. A positive feedback loop also needs a negative one to become sustainable. Name the tradeoff; find the equilibrium.
H2 Labs is a European technology and social lab serving clients worldwide. We help organisations prepare, protect and recover critical systems, and build software they can own and operate. Self-hosted, with a human in the loop where it matters.
What we do
We build sovereign software: free and open for individuals, with subscriptions for the enterprises and institutions that want support, updates, and someone accountable on the other end. That is what keeps the lights on, and it all answers to one rule: build things people can actually own and trust.
Security that defends, not exploits. Threat models in the design review, not the post-mortem. Tools you can audit, run yourself, and keep running after the vendor is gone.
We publish the middle of the work: the detour, the dead end that taught us something, the moment a hunch became a decision. Measure, then decide. Failure is data.
How we build
These are constraints, not slogans; they decide what we will and will not ship. Two come before the rest: your data stays yours (privacy), and your stack stays yours (sovereignty).
Table 1The non-negotiables: constraints, not slogans.
Your data and your tools stay yours. No dependency dressed up as convenience.
Your own servers or whichever cloud you already use, and you can move it to another whenever you like. Under your jurisdiction, on your terms.
On anything that matters, a person stays in the loop and has the final word. The machine proposes; people decide.
We don't phone home. What runs on your machine is not a sensor for ours.
The software keeps running if the subscription ends. Enterprises pay for support, updates, and accountability, never for permission to use what they already have.
European engineers, European legal frameworks, clients anywhere. Where we stand is our decision; where you run is yours.
What we run
These run today, built on the principles above. Beyond them we do custom implementations, and we start by understanding your needs before building or recommending anything.
purpose-built Linux
Immutable Linux, prepared for the job. Built on Fedora with SELinux enforcing, then tailored with our own hardening, YubiKey authentication, disk encryption, workload and network isolation, and eBPF monitoring. Designed for dependable service with less day-to-day tending.
UHT Workstation · UHT Host
Windows to Linux. Explore the practical options, European sovereignty initiatives and signals behind renewed interest in Linux. Read the migration analysis →
identity & access
Lightweight, self-hosted SSO designed for performance, built and operated in Europe. Passkeys, application sign-in, Linux login and fine-grained sudo permissions in one integrated system.
Your infrastructure. Your identities. Your control.
Integrated runtime protection and controlled access to secrets.
observe · verify · act · recover
Know what runs. Control what changes. Identity, system evidence and authorized response, connected.
Execution Integrity, Compute Integrity Monitoring, Drift Control and Runtime Truth describe how the pieces fit together, from signed probes to verified actions.
credentials & secrets
We are developing a vault for the credentials people and services need every day. The goal: authorize access to the secret needed for a task, limit its exposure and record access without exposing its value.
An internal implementation exists; production hardening and validation are underway before customer use. We are evaluating established tools and Identity Core integration.
These tools can run within UHT or independently, in the environment that fits the job.
access
Single-packet authorization: dial out, expose no inbound port, silent to scans until a signed knock. A blind relay brokers bytes it can't read; SSH rides end-to-end on top.1
Working code, pre-release. EUPL-1.2 at publication.
confinement
Landlock, egress allowlists, sandboxes that fail closed: the layers under the agent.
platform
The self-hosted app platform this site runs on: every app a folder, no build step.
agent
A sovereign personal agent: one Zig binary, memory that never resets, channels we own.
on call · ready to onboard
An Opsgenie alternative, for when Atlassian switches Opsgenie off on 5 April 2027. Alerts from ServiceNow, monitoring or any other tool ring the phone of the person on call, and every change goes back out to the tools. Industry-standard parts, fitted to each client's needs, with automation and agentic AI workflows on their own approved models, at no extra cost.2
Onboarding takes ten weeks, side by side with Opsgenie until the numbers agree.
incident response
Our incident response tooling runs in compromised environments to support investigation and intervention. Deployed for a specific task, within an agreed scope, with experienced responders directing the work.
We build for years, not quarters: tools meant to stay in service for a long time, easy to maintain, and still returning value long after the initial work.
Work with us
We help enterprises, institutions and service providers prepare, recover and regain control across Linux, applications, infrastructure and security. Compromised infrastructure, interrupted operations, difficult recovery or a critical migration: we work alongside your teams, with clear technical responsibility and an agreed outcome.
Planned engineering
Prepare for a critical migration, strengthen an exposed environment or resolve recurring operational failures. We take the agreed work through design, implementation and validation with your teams.
Start with a fixed-scope assessment. Implementation is scoped and quoted against the agreed outcomes.
Discuss an engagement →Per-incident engagement
Restore control during suspected compromise, production failure and difficult recovery. We investigate across system boundaries, establish intervention priorities and work with your incident lead through recovery.
Mobilisation within hours can be arranged, subject to availability and authorised access. Scope, spending authority and the next decision point are agreed at activation. Response work is quoted for the incident.
Active incidents can proceed directly to response; no prior assessment is required.
Request incident assistance →Ongoing agreement
Make response a prepared operation. We maintain knowledge of your estate, test emergency access, rehearse recovery and keep response procedures current with your infrastructure and security teams.
An ongoing relationship scoped to your critical services, estate and response obligations. Onboarding, coverage, activation and incident rates are agreed in advance; response work is billed separately.
Discuss readiness →Identify the affected services, business impact and constraints. Define the outcome, scope and acceptance criteria with the people responsible for the systems.
Name the technical lead, decision makers and escalation contacts. Agree access, change approval, evidence handling and spending authority before intervention.
Work alongside your security, infrastructure and application teams, including your MSP or MSSP. Maintain a record of actions, findings and decisions, with updates at an agreed cadence.
Check the result against the agreed criteria. Document remaining risks, recovery procedures and next actions, with clear ownership after the engagement.
Inspect the engineering behind the work: the systems and tools we operate, and published technical investigations. We discuss the approach and its fit with your technical team before agreeing the engagement.
Every engagement has a defined outcome and clear ownership. The systems we build fit your environment, with the documentation and operational knowledge your team needs to take them forward.
For managed implementations, we take responsibility for the agreed upkeep, patching and escalation coverage. Your team retains visibility and control.
And we build so you can take it over whenever you choose: when you're ready to go on without us, or when we need to move on.
It obeys the principles above. It runs on your hardware, and it keeps running without us.
Detection engineering and playbook automation for teams that want to own their stack instead of renting it per seat. We build on open tooling, document everything, and hand it over. If we disappear tomorrow, your playbooks still run.
AI agents on your infrastructure, under your jurisdiction, not as a sensor for someone else's cloud. Deployment, memory, and the confinement underneath: sandboxes that fail closed, egress allowlists, a human in the loop where it matters.
Access, audit, and patching for machines that cannot dial out: manufacturing sites, egress-locked enclaves, boxes behind four jump hosts. Built on askd and years of operating exactly these environments.
Custom work and experiments of every kind start here. Work that extends Triage for a team (Connect, Learn and a knowledge base fitted to how it works, and teaching the team to extend it themselves) runs as Triage:Build, at triage.io/build.
| Assessment | Delivery | Fee |
|---|---|---|
| Standard | 1–2 weeks | €9,500 |
| Accelerated | 24–48 hours | €14,25050% priority premium |
Priority delivery for time-critical decisions.A fixed-scope assessment provides findings, priorities and an implementation plan you keep. Standard delivery is one to two weeks at €9,500 + VAT. Selected assessments can be delivered within 24–48 hours at a 50% premium. Implementation and ongoing support are scoped separately.
We agree whether the assessment fits the accelerated window before accepting it. Delivery runs from the agreed kickoff, with the required information and access in place.
Same-day intervention and critical deadlines are quoted against scope and reserved capacity. Emergency mobilisation is the start of response work; recovery milestones depend on the incident. Discuss a critical deadline →
From the labs
We write about the flow, the experience, the learnings, not the clean final answer. Read the iteration logs, the security notes, and the essays.
flagship · living post
An assistant built for the people in your life, not your task list. Its real trick is a memory that never resets. Updated as the system evolves, including what a memory wipe actually feels like.
methodology
AI agents produce clean, test-passing code where the tests came from the same place as the bugs. What replaces coverage and review as quality signals: mutation testing, properties, fuzzing, and a second model.
defensive security
Everyone filters inbound; almost no one filters outbound. A compromised dependency, a manipulated agent, or an SSRF payload all exploit the same gap. Default-deny outbound closes the other half of the firewall.
Technology & social labs
Not just systems, but the economics around them: who pays for software, what it takes to truly own it, and the human side of the machines we build.