Digital government. Secure by design.

OTOKO® develops OZG online services and modernizes case management systems, integrates qualified signatures and seals with HSMs, builds sovereign platforms in German data centers and operates assistants with on-premises language models. It also delivers encryption for classified information under VS-NfD with approved products and a post-quantum roadmap for long-lived records. Each field of action can be commissioned on its own or as a package.

OTOKO® develops online services under the OZG and modernizes case management systems. We integrate qualified signatures and seals with HSMs. We build sovereign platforms in German data centers. We operate assistants with language models on your own servers. We also encrypt classified information under VS-NfD with approved products. And we plan the move to quantum-safe encryption for long-lived records. You can book each field on its own or as a package.

Yes, if protection requirements, storage location and key control fit. For unclassified data with normal protection requirements, cloud services with a C5 attestation are an option, provided processing agreement and location are settled. Classified information and registers with high protection requirements usually stay in your own or a German data center. We document the decision in the security concept under IT-Grundschutz and keep the keys in your HSM.

Yes, if protection needs, storage location and key control fit. Unclassified data with normal protection needs can go to the cloud. The cloud service needs a C5 attestation. C5 is the BSI audit catalog for cloud services. Processing agreement and location must be settled for this. Classified information and sensitive registers usually stay in your own data center. Or in a German data center. We record the decision in the security concept under IT-Grundschutz. The keys stay in your HSM.

Through an interface that receives applications from FIT-Connect as XÖV messages and writes them into the case management system, instead of redeveloping the system. The business logic is preserved, individual modules are replaced step by step later, and each stage runs with tests and acceptance by the department. One team accompanies you from consulting to operations, also when legislative changes require new data fields.

Through an interface, not through a rebuild. It receives applications from FIT-Connect as XÖV messages. Then it writes the data into the case management system. The business logic stays as it is. We replace individual modules later, step by step. Every stage runs with tests and acceptance by the department. One team accompanies you from consulting to operations. This also applies when new laws require new data fields.

The BSI grants VS-NfD approvals for IT security products, not for service providers. We use products approved for this purpose, such as Utimaco LAN Crypt, Utimaco DiskEncrypt and Utimaco CryptoServer with the VS-NfD package, and comply with their conditions of use and operation in configuration and operations. Your classified information security officers receive the documentation in one audit file.

The BSI grants VS-NfD approvals for security products. Service providers like OTOKO® receive no product approval. We use products that are approved for this purpose. For example Utimaco LAN Crypt, Utimaco DiskEncrypt and Utimaco CryptoServer. The CryptoServer comes with the VS-NfD package. We follow their conditions of use and operation in configuration and operations. Your classified information security officers receive all documents in one audit file.

Yes, if model, data and logs stay in your own or a German data center and the decision remains with the caseworker. We operate open-weight models without training them on file contents, take over permissions from the e-file system and log every request. Classification under the EU AI Act, the data protection impact assessment and documents for the staff council are completed before the pilot.

Yes, under two conditions. Model, data and logs stay in your own data center. Or in a German one. And the caseworker makes the decision. We operate open-weight models. We do not train them on file contents. We take over permissions from the e-file system. Every request is logged. Before the pilot we classify the system under the EU AI Act. We complete the data protection impact assessment and the staff council documents.

Because records and registers must stay confidential longer than classical encryption is expected to hold, and intercepted data can be decrypted later. Procurement cycles for HSMs, PKI and case management systems also take years. An inventory rated by retention periods shows which connections, certificates and archives migrate first, and new tenders demand crypto agility from the start.

Records and registers must stay confidential for a very long time. Probably longer than today's encryption will hold. Intercepted data may be decrypted later. Procurement adds to this. For HSMs, PKI and case management systems it takes years. An inventory rates everything by retention periods. It shows which connections, certificates and archives come first. New tenders demand crypto agility from the start. This means algorithms can be swapped without a rebuild.

Yes. We can scope a specific task first. We consider its interfaces with the rest of your infrastructure and agree which work is included before implementation.

Yes. We can scope a specific task first. We consider its interfaces with the rest of your infrastructure and agree which work is included before implementation.

A brief description of the challenge, the systems involved and your desired outcome is enough to start. Known deadlines and the relevant contacts are helpful. Please do not include credentials or confidential system documentation in an initial enquiry.

A brief description of the challenge, the systems involved and your desired outcome is enough to start. Known deadlines and the relevant contacts are helpful. Please do not include credentials or confidential system documentation in an initial enquiry.

Security architect: IT-Grundschutz, protection requirements, VS-NfD architecture. Cryptography specialist: HSMs, signatures and seals, PQC roadmap. Software developer: Online services, FIT-Connect, case management system modernization. Cloud architect: Platform, tenant separation, recovery. AI engineer: Language models, document classification, model operations. Project lead: Milestones, committees, acceptance, reports.

Security architect: IT-Grundschutz, protection requirements, VS-NfD architecture. Cryptography specialist: HSMs, signatures and seals, PQC roadmap. Software developer: Online services, FIT-Connect, case management system modernization. Cloud architect: Platform, tenant separation, recovery. AI engineer: Language models, document classification, model operations. Project lead: Milestones, committees, acceptance, reports.

We consider the systems, interfaces, available documentation and operational constraints. An agreed scope and milestones provide the basis for estimating effort. A fixed duration without these details would not be reliable.

We consider the systems, interfaces, available documentation and operational constraints. An agreed scope and milestones provide the basis for estimating effort. A fixed duration without these details would not be reliable.

Administrative services, case management systems, protection requirements and obligations under OZG, eIDAS and IT-Grundschutz Procedure inventory, crypto inventory, gap analysis, initiatives prioritized by benefit and risk

Administrative services, case management systems, protection requirements and obligations under OZG, eIDAS and IT-Grundschutz Procedure inventory, crypto inventory, gap analysis, initiatives prioritized by benefit and risk

Project: Clearly scoped initiative such as an OZG online service, a seal service in the HSM or a security concept under IT-Grundschutz, with a statement of work, milestones and acceptance. Team reinforcement: Software developers, cryptography specialists or AI engineers work in your teams and tools, following your approval processes and classified information rules. Managed service: OTOKO® operates platform, seal service, language models or encryption with agreed service levels, regular reports and operation under IT-Grundschutz in German data centers.

Project: Clearly scoped initiative such as an OZG online service, a seal service in the HSM or a security concept under IT-Grundschutz, with a statement of work, milestones and acceptance. Team reinforcement: Software developers, cryptography specialists or AI engineers work in your teams and tools, following your approval processes and classified information rules. Managed service: OTOKO® operates platform, seal service, language models or encryption with agreed service levels, regular reports and operation under IT-Grundschutz in German data centers.

Monitoring, certificates, audits, knowledge transfer Daily operations under IT-Grundschutz, certificate renewal, audit support, stepwise handover

Monitoring, certificates, audits, knowledge transfer Daily operations under IT-Grundschutz, certificate renewal, audit support, stepwise handover

We can account for future expansion in the initial concept. Documented interfaces and reusable rules provide a foundation. Each additional site or system still needs to be assessed for its particular requirements.

We can account for future expansion in the initial concept. Documented interfaces and reusable rules provide a foundation. Each additional site or system still needs to be assessed for its particular requirements.

Agree responsibilities, recurring tasks and change procedures alongside the technical implementation. Documentation and knowledge transfer help your team operate the solution. The specific activities and any ongoing support are part of the agreed scope.

Agree responsibilities, recurring tasks and change procedures alongside the technical implementation. Documentation and knowledge transfer help your team operate the solution. The specific activities and any ongoing support are part of the agreed scope.