Self-hosted Security & Compliance Platform — NIS2, ISO 27001, BSI-Grundschutz, DORA, TISAX, EU AI Act. Deploy in 5 minutes.

Status: Private Beta License: ELv2 Go Docker

Private Beta — Vakt is under active development. Expect rough edges and breaking changes between releases. Support is best-effort (no 24/7 SLA), and as a self-hosted product backups/restore are your responsibility (scripts + runbook included). See the Beta Disclaimer for support, backup, and business-continuity expectations. Feedback welcome: hello@norvikops.de

Live Demo — ephemeral credentials, auto-generated, expires after 4 hours.

Vakt is a self-hosted, source-available security and compliance platform built for SMEs in the DACH region. It helps IT teams implement and document NIS2, ISO 27001, BSI IT-Grundschutz, GDPR Art. 32 (TOM), CIS Controls v8, KRITIS, BSI C5, EU AI Act, EU CRA, DORA, TISAX, ISO 42001, and ISO 27017/27018 requirements — without sending any data outside your own infrastructure.

It is a free-to-self-host alternative to commercial tools like Vanta or Drata (~10,000ドル/year), licensed under the Elastic License 2.0. Deploy it with a single docker compose up command — the platform is ready in under 5 minutes. The bundled local AI advisor takes a bit longer on first start because it downloads the ~4.5 GB qwen2.5:7b model — depending on your bandwidth, expect an extra 3–30 minutes until AI features are available. The platform itself works without waiting for the model.

Shared features across all modules:

• Webhook alerting — Slack, Teams, generic webhooks with HMAC signing
• In-app notifications and weekly email digest
• Prometheus metrics endpoint
• Global search across all modules
• Data retention policies
• 2FA / TOTP
• Session management
• BSI CERT-Bund advisory feed
• Cross-module evidence automation (e.g. resolved findings and completed trainings flow into Vakt Comply)
• Admin CLI
• Public Trust Pages

git clone https://github.com/norvik-ops/vatk
cd vatk
cp .env.example .env
# Generate a secure secret key (required):
sed -i 's/VAKT_SECRET_KEY=.*/VAKT_SECRET_KEY='"$(openssl rand -hex 32)"'/' .env
docker compose up -d

Open http://localhost in your browser.

When VAKT_DEMO=true is set, the login screen automatically shows a set of fresh, ephemeral credentials. These credentials are randomly generated per session and expire after 4 hours — there are no static demo passwords.

Migrations run automatically on every docker compose up -d — a dedicated migrate container applies all pending migrations before the API and worker start.

The AI advisor runs locally via Ollama on CPU — no GPU, no cloud API key required, and Community since v0.6.x (no Pro license needed). Ollama starts automatically with docker compose up; an ollama-init container pulls the default model (qwen2.5:7b, Apache 2.0, ~4.5 GB RAM, needs 8 GB) on first launch — no manual ollama pull step. On smaller VMs switch to qwen2.5:3b (~1.9 GB, set VAKT_AI_MODEL=qwen2.5:3b), or use phi3.5:mini (Microsoft, MIT) or the Mistral EU API. To disable on small VMs: set VAKT_AI_PROVIDER=disabled and remove the ollama/ollama-init services via compose-override.

Basis — these modules are usable in Community with their core functionality. Pro unlocks the advanced features per module:

• Vakt Scan — SBOM scanning, EOL tracking, report generation & export, Wazuh import
• Vakt Vault — Git repo secret scanning, automatic rotation, access reviews
• Vakt Aware — phishing campaigns, template library, target groups
• Vakt Privacy — DPIA workflows, deletion-reminder automation, PDF exports

Get a license key: buy.polar.sh — purchase and receive your key by email. Activate in Settings → License.

Enterprise: Contact hello@norvikops.de for SCIM, TISAX, DORA, white-label, or custom SLA requirements.

The most important environment variables:

See docs/wiki/configuration.md for the full reference.

Vakt includes a built-in AI advisor that analyses your organisation's real compliance gaps and answers "What should I do this week?" — specific to your data, running entirely on your server.

Enabled by default via a local Ollama container (CPU-only, no GPU, no API key, no Pro license). The Community edition includes 25 AI requests per month; Pro and Enterprise are unlimited. Default model is qwen2.5:7b (Apache 2.0, ~4.5 GB RAM, needs 8 GB, best German compliance quality). The model is pulled automatically by the ollama-init container on first docker compose up — no manual step. On VMs with less than 8 GB RAM, switch to qwen2.5:3b (~1.9 GB).

To switch to a different model:

docker compose exec ollama ollama pull phi3.5:mini
echo 'VAKT_AI_MODEL=phi3.5:mini' >> .env
docker compose restart api worker

Model alternatives (all CPU-only, choose based on your RAM budget):

To use a cloud provider instead (e.g. Mistral AI EU, OpenAI):

VAKT_AI_BASE_URL=https://api.mistral.ai/v1
VAKT_AI_API_KEY=sk-...
VAKT_AI_MODEL=mistral-small-latest

To disable entirely: VAKT_AI_PROVIDER=disabled

graph TD
 Browser["User Browser"] -->|HTTPS| Nginx["Nginx\n(TLS · Static files)"]
 Nginx -->|/api/*| API["API Service\n(Go / Echo v4)"]
 Nginx -->|/*| SPA["Frontend SPA\n(React / Vite)"]
 API --> DB["PostgreSQL 16"]
 API --> Redis["Redis 7\n(Queue · Sessions)"]
 Redis --> Worker["Worker\n(Go / Asynq)"]
 Worker --> Ollama["Ollama\n(Local LLM — optional)"]
 Worker --> DB

All services run in Docker containers. No telemetry, no usage tracking. The optional VAKT_LICENSE_TOKEN feature contacts api.norvikops.de once daily for license renewal — no business data transmitted.

# Backend — API server
cd backend && go run ./cmd/api
# Backend — background worker
cd backend && go run ./cmd/worker
# Frontend
cd frontend && npm install && npm run dev
# Admin CLI
cd backend && go run ./cmd/admin --help
# Tests and linting
make test
make lint

See docs/wiki/installation.md for:

• HTTPS with Let's Encrypt (included Nginx configuration)
• PostgreSQL backup strategies
• Kubernetes deployment via Helm chart (/helm/vakt)
• Upgrade procedure between versions

For MSPs deploying Vakt per customer, see docs/wiki/msp-onboarding.md.

Issues and pull requests are welcome.

• Run make lint before opening a PR
• Write tests for service-layer functions with domain invariants — especially auth, crypto, compliance, and migration logic (see ADR-0012)
• Do not commit secrets — use .env.example as a template
• Follow the module isolation rules described in CLAUDE.md

Elastic License 2.0 (ELv2) — the source code is publicly available for reading and auditing. Self-hosting for your own organization is free and unrestricted. You may not offer Vakt as a hosted or managed service to third parties. No telemetry, no usage tracking. The optional VAKT_LICENSE_TOKEN feature contacts api.norvikops.de daily for license renewal (license token only, no business data).