Skip to main content

Can your application run on the platform?

This section describes what the platform expects from every application it operates, so you can see early where your application already fits and where adaptation work is waiting.

Orientation, not contract

These pages are general guidance. The binding requirements are set exclusively in the contract documents of your specific procedure, which may contain further or more specific requirements for your application. Where these pages and your contract documents differ, the contract documents win.

How responsibility is split​

The platform is a managed home for your application, but you remain its operator. This split runs through every requirement on these pages:

The platform provides​

  • Multi-cloud infrastructure and the runtime environments
  • Base services: Identity & Access Management, Vault, logging, monitoring, networking
  • The domain and SSL certificates your application is reached under
  • The GovTech Store and the central ticket system

You provide​

  • Cloud-capable application artefacts that deploy without manual steps
  • Updates and patches, for the life of the contract
  • Application operations and support in line with the agreed service levels
  • Documentation that lets the platform run and recover your application

One consequence follows directly: you get no administrative access at infrastructure or cloud level. Your application must be installable, upgradable and operable without it. Exceptions require a written request to GovTech.

The requirements at a glance​

Eight areas, each with its own chapter:

Runtime & deploymentDoes it run in one of the four runtime types, deploy fully automated, and hold no secrets in the image?Identity & accessCan it delegate login to the platform's IAM via OIDC/OAuth2, including claims mapping and logout?Data & backupDoes it use a managed database or manage its own, with working backup, restore and automated schema migration?Resilience & scalingDoes it survive pod restarts, rolling updates and node failures without losing data?ObservabilityDoes it log structured to the platform's logging service, expose health checks, and keep secrets out of logs?Security & data protectionCan it pass image scans, SAST, DAST and penetration tests, and can you patch within fixed deadlines?Service levels & supportCan your organisation carry an SLA: availability, severity-based response times, monthly reporting?Exit & portabilityCan customers leave with their data: open export formats, documented data model, no lock-in?

Start with the self-assessment​

The fastest way through: work through the checklist. It walks the same eight areas as a set of yes/no questions and shows you where adaptation work is likely.

Self-assessment checklistAssess your application yourself and see where adaptation is needed

For a sense of what the typical adaptations cost in practice, see the integration walkthrough.

Questions?​

vendor-support@govtechplatforms.de