Technology infrastructure and systems engineering.
ReteLogic Sàrl is an independent Swiss technology company. It holds the intellectual property, funds the development and sets the technical governance of the group’s platforms. Commercial services and client delivery run through its operating brand, swiss.software.
Technical governance and systems architecture
ReteLogic defines and audits the engineering guidelines, security baselines and release procedures used in every environment the group operates: the swiss.software studio, the PlainCompile, Trialloom and NRG platforms, and the infrastructure beneath them.
Infrastructure and orchestration
Each site runs under its own system account, behind root-owned directory boundaries. A control plane records the intended state of every site, a privileged daemon applies it as typed jobs, and every change is written to an audit trail.
- Container isolation
- Services that need stronger separation run in LXC system containers or OCI containers, with staging and production kept apart.
- Container orchestration
- For larger deployments we design and operate Kubernetes clusters, with separate namespaces for staging, production and each tenant, and worker pools that scale horizontally on CPU, memory and queue-depth metrics.
- Infrastructure as code
- Servers, firewall rules and DNS can be declared in version-controlled code (Terraform or OpenTofu), so an environment can be rebuilt from its repository.
- Edge routing
- Public traffic passes through Cloudflare’s anycast network, which terminates TLS at the edge, filters abusive requests and caches static assets before forwarding to the origin over HTTPS.
Data sovereignty and compliance
Each platform documents where its data is processed. Current production runs on dedicated servers in the European Union.
- Swiss data residency
- For clients who require it, databases, storage and backups are deployed in certified Swiss datacenters (Tier III and above) operated by Swiss providers.
- Regulation
- Systems are designed for the revised Swiss Federal Act on Data Protection (revFADP / nDSG) and, where it applies, Regulation (EU) 2016/679 (GDPR).
- Encryption
- Data in transit is protected by TLS with automatically renewed certificates. Site backups are encrypted at rest with age and sealed to two keys, one of which never resides on the server; restores verify checksums before and after decryption. Where a client requires it, volumes and databases are encrypted with AES-256 or XChaCha20-Poly1305, with keys rotated through a key management system (KMS).
- Retention
- Web server logs are deleted after 14 days. Retention schedules for logs, sessions and processing metadata are set per system.
Release engineering and quality assurance
Production runs only reviewed commits from the main branch. Every pull request passes the automated test suite and an automated code and security review, and each finding is fixed or answered before merge.
- Pinned deployments
- A deployment names an exact commit hash. The deploy tool takes a lock, snapshots the application and its database, verifies the snapshot, activates the release and checks every dependent service.
- Pipeline security
- We build client pipelines with static analysis (SAST) and dependency scanning against CVE databases (SCA). Hosted files are scanned for malware.
- Release strategies
- Services that cannot accept downtime are released blue/green, with the previous release kept ready for an immediate switch back.
Engineering capabilities
Technologies are chosen per workload, for runtime efficiency and long-term maintenance.
| Domain | Technologies | Purpose |
|---|---|---|
| Backend | PHP, Rust, Go, TypeScript/Node.js, Python | Web platforms, compilers, concurrent services, data and AI workloads |
| Data | PostgreSQL, MariaDB, SQLite, Redis | Transactional storage, embedded databases, caching and queues |
| Interfaces | REST and OpenAPI 3, GraphQL, gRPC, Model Context Protocol (MCP) | Integration with client systems and with AI agents |
| Frontend | TypeScript, React, server-rendered HTML | Accessible (WCAG), fast pages on every device |
| Operations | Linux, systemd, nginx, LXC, Docker, Kubernetes, Terraform, OpenTelemetry | Supervision, isolation, tracing and metrics |
Security operations and recovery
No account, service or network location is trusted by default.
- Access
- Server administration uses SSH keys only, and repeated failures are blocked automatically. The control panel supports passkeys (FIDO2/WebAuthn). Sessions expire after two hours of inactivity or twelve hours in total, and can be revoked immediately.
- Least privilege
- File operations for a site run as that site’s own account. The root daemon refuses to create setuid or setgid files, monitoring runs unprivileged, and administrative actions are logged.
- Monitoring
- Every live site is probed from the origin each minute and operators are alerted on failure. Disks are under SMART and RAID monitoring, and the kernel receives live security patches.
- Backup and recovery
- Files and databases are snapshotted per site, encrypted, and restored in scheduled rehearsals. For critical systems we add a replica server in a separate location, write-once (WORM) backup storage, and recovery targets (RTO, RPO) agreed per contract.
Corporate structure
ReteLogic keeps the governance of its platforms separate from market-facing client work.
- swiss.softwareClient delivery
The group’s production arm and market interface: custom business software, dashboards, automation, migrations and integrations, websites and online shops. Work delivered under swiss.software follows the governance and release rules set by ReteLogic. For enquiries, scoping, proposals and technical consultation, contact swiss.software.
- PlainCompileLanguage to software
Turns a natural-language objective into an explicit software contract, working code and verification evidence.
- TrialloomIndependent testing
Independent testing of the software a business depends on. Proposed repairs are verified in a dedicated environment before they reach production.
- NRGCustodial hosting
Custodial hosting with isolated runtimes, versioned backups and audited operations.
ReteLogic Labs
Internal research and development on systems engineering:
- Memory-safe languages and concurrency tooling, with Rust already in production for performance-critical services.
- Private language models on our own hardware, such as the Swiss open model Apertus, and their deployment in air-gapped environments.
- Infrastructure operated by AI agents within the same authorization and audit limits as human operators.
- Edge computing nodes and distributed cryptographic database engines.
ReteLogic does not sell to consumers. Commercial contracts and client deliverables are handled through swiss.software.