See how our services work

An employee opens a malicious attachment. Attackers target your online shop. A laptop begins locking files. Follow the example below to see what Device Shield, Web App Shield and Sovereign Storage do, and what your team needs to do next.

Example: from a malicious email to the morning report

Four steps showing what happens, how we respond and what it means for your business. The events and times are illustrative.

  1. 17:40

    A malicious invoice is opened

    What happens
    An employee opens a fake invoice that installs malicious software on a laptop.
    Our response
    Device Shield monitors the laptop for suspicious activity.
    For your business
    Monitoring continues after the employee leaves work.
    Device Shield →
  2. 02:00

    Your online shop is targeted

    What happens
    An automated attack tries stolen passwords against customer accounts.
    Our response
    Web App Shield filters malicious requests before they reach your website.
    For your business
    In this example, legitimate customers can continue shopping.
    Web App Shield →
  3. 03:12

    The infected laptop tries to lock files

    What happens
    The malicious software starts encrypting files and tries to spread across the network.
    Our response
    Device Shield disconnects the laptop from the network. Sovereign Storage holds protected backup copies in Belgium.
    For your business
    The laptop needs investigation. Backups provide a recovery option for affected files.
    Device Shield →Sovereign Storage →
  4. 09:00

    You receive an incident report

    What happens
    Your team needs to know what was affected and what still needs attention.
    Our response
    ALT-F1 explains the alerts, the actions taken and the checks or repairs needed.
    For your business
    You know whether to rebuild the laptop, restore files or take further action.

Film: the seven ALT-F1 services

See how our services protect devices, websites, applications, AI, files and code.

Speed
The Sovereign Stack overview: seven ALT-F1 services in eleven minutes. Silent film with on-screen text and a full transcript. Use pause and playback speed to suit your reading pace. The full transcript is available below.Web App Shield is called “Web Shield” in this recording.
Transcript
0:00
Keep your data, your code and your team in Europe. ALT-F1, Brussels: seven products, one promise. One aim: a smaller footprint on non-European technology.
0:13
Four families, seven products. One turn of the wheel, one product at a time: Device Shield, Web Shield, Custom Software, Private AI, Sovereign Storage, Sovereign Code, Workshops.
0:31
Device Shield — sleep through the night. 17:40: someone opens the wrong invoice. The invoice is a trap: it installs malware that waits for the office to empty. 03:12: the malware wakes up and starts encrypting the files. Device Shield cuts the laptop off the network in 41 seconds. The other devices never hear from it. Nothing spreads, nothing is lost.
1:28
Web Shield — open for business, even under attack. Meanwhile, on the web shop: attacks come from everywhere, all night. Injection, cross-site scripting, stolen passwords, bots, DDoS: the OWASP Top 10. Web Shield stops them at the edge, before they reach you. The shop keeps selling. 3,100 requests blocked tonight: SQL injection 412, cross-site scripting 288, credential stuffing 1,030, DDoS floods 620, bad bots 510, API abuse 240.
2:30
Custom Software — applications that last longer than the project. What we have built: PolyDocs (speech becomes intent, your people control an application by voice); Video-To-Chapter (a recorded meeting or course becomes a summarised, searchable document); a facility-management platform (agents and managers predict, validate and control the work on site); digital offers and policies for banks and insurers (a flow that is digital end to end: offer, signature, card and SEPA payment); The Accelerator (an IT infrastructure, built on Google Cloud, that collects and analyses massive amounts of public data on the World Wide Web and makes them available to business analysts and data scientists); real-time broadcast systems for TV channels and a firewall for voice, video and messaging; Connectivo (engage, sell and support customers on WhatsApp, Telegram, Messenger and WeChat, with automated replies); StratEx (strategy execution: programmes, projects, contracts and board reports in one place); cloud migration (private or public, Google App Engine or hybrid: which strategy, what it costs, how to avoid lock-in); IT service management by the book (ITIL, a service desk, incidents, changes, a CMDB and runbooks that stay true). We have worked for public administration (Smals, Europol, Eurojust, European Commission DGs, Federal Police), broadcasting (BBC, WDR, YLE, VT4), telecom and retail (KPN, Orange, Galeria INNO), industry and transport (BMW, Toyota, DAF Trucks, SNCB/NMBS, Sonaca, Asco), banks and insurance (Argenta, BNP Paribas Fortis, AXA, NN, Patronale) and health (Tale Me Health, NovInject): delivered, and supported for years.
6:28
Private AI — stays in the room. From the map of Europe to your office — anywhere in the EU — to the second floor, to the server room. Open-source, open-weight language models on a server in your building. Your documents never leave the room. Open weight: the model is yours to download and run; open source: the code too. No API outside Europe: nothing leaves the building.
7:29
Sovereign Storage — anchored in Belgium. The map zooms on Belgium: your offices anywhere in the EU, the data centre in Belgium. Backups encrypted and immutable, out of reach of ransomware, and of foreign law.
8:12
Sovereign Code — your code, your keys. Your code probably lives outside the EU. Brought home to your own GitLab in Belgium: history intact, interns on company accounts, secrets scanned before every commit.
8:55
Workshops — nobody left behind. Six workshops, one per block, for your whole team. For companies anywhere in the EU, in French, Dutch or English, in your offices or online.
9:38
What your auditor will ask, and what you will answer: every device watched; websites behind a firewall; applications built as code; AI that stays in the building; backups in a Belgian data centre; code under EU jurisdiction; staff trained. GDPR, NIS2, Cyber Resilience Act, ISO 27001, ISO 27002. Seven lines; the monthly reports are the evidence.
10:26
09:00. Nothing happened. The wheel again, small: seven products, seven ticks. The laptop was isolated, the shop stayed open, the backups were never touched. Your systems were protected. That is the product. A smaller footprint on non-European technology, one block at a time. ALT-F1, alt-f1.be.

Download the MP4 (1920×1080, eleven minutes)

This film in other languages: Français · Nederlands

Film: seven days of website attacks

See the attacks recorded on a public website and how Web App Shield blocked them.

Speed
Seven days of a public website behind Web App Shield, 23–30 October 2026: 2,643 malicious requests, 301 sources, 29 countries, none reached the server. Silent film; transcript below.Web App Shield is called “Web Shield” in this recording.
Transcript
0:00
Seven days under attack. A public website, without advertising, used by a company for its own needs. 23 → 30 October 2026 Every request below was stopped by Web Shield. 2,643 malicious requests · 301 sources · 29 countries · none reached the server.
0:27
When they came. Busiest day: Tue 27 — 632 requests. Busiest hour: 18:00 — 559 requests. Office hours, somewhere. Nights are quieter. Not quiet.
0:57
Where they came from. 29 countries. The map is the internet, not a list of enemies. Five rented machines on Google Cloud — Tel Aviv, Madrid, Turin, Santiago, Dallas — made 1,155 of the requests. One script, five addresses. Belgium is on the map too: a rented server in Brussels looks like a neighbour.
2:01
Who rents them the servers. Nine in ten requests came from rented servers in data centres — not from somebody’s bedroom. Google Cloud alone: more than half. The attacker pays by the hour and moves on. The block is already in place. Abuse reports can follow.
2:51
What the firewall called them. Bad bots: scripts pretending to be people. Illegal resource access: asking for files that must never be served. Cross-site scripting: thirty-five attempts to inject code into a page. Blocked or suspended, the server never saw a single one.
3:45
What they were looking for. Secrets first: .env files hold database passwords and API keys. 1,329 requests for a file that does not exist here. Then the usual suspects: PHP, WordPress, Git folders, cloud credentials, Spring Boot, backups left on the web. They were not looking for us. They were looking for anyone.
5:00
The tools they used. Fake browsers: a script that says it is Chrome. The bot engine checks; it is not. Search-engine impersonators claim to be Google or Baidu. Real crawlers verify; these do not. Scanners, Go and Python libraries, cURL, and the new visitors: AI crawlers.
5:59
What the same addresses do elsewhere. Remote code execution, path traversal, SQL injection, backdoors: the same addresses hit thousands of other sites. Reputation is shared across the network. So is the block: an address caught elsewhere can be stopped here before its first request.
7:02
Eight addresses, two thirds of the traffic. A handful of rented machines, each running one script for days. Block the eight and the week is quiet — until the next eight. That is why the firewall decides, not a list.
7:44
Seven days. 2,643 attempts. Zero incidents. The server saw nothing. The team worked. The pages loaded. Your website looks the same from the outside. Ask us for the same seven-day report on your own site.

Download the MP4 (1920×1080, eight minutes)

Film: how we build and run your software

Follow an application from its source code to deployment, security checks and backups.

Speed
The six-stage pipeline that runs our own platform, in under two minutes. Silent film; transcript below.
Transcript
0:00
Custom Software. How we build and run your application. The same pipeline runs our own platform.
0:10
One repository: everything is code — the app, its settings, its secrets, encrypted (git, sops + age). Pinned versions: every component is pinned to an exact version; updates arrive as proposals every Monday, no surprises (tag @ digest, Renovate). Review and merge: a human reviews, then merges; the main branch is always ready to run. One script deploys on the server: pull, decrypt, start, check, and roll back if anything is wrong (deploy.sh, Caddy, health check). Scan and inventory: every package is listed and scanned for known vulnerabilities; one file says what runs where (Trivy, SBOM, CMDB). Nightly backup: encrypted, off-site, restores rehearsed (restic, 03:30, 14 daily / 8 weekly / 12 monthly).
1:28
Still running in ten years. ALT-F1, alt-f1.be.

Download the MP4 (1920×1080, under two minutes)

The products in the film

Open a product page to see what is included and how it works.

Sovereign Stack →

Get a quote

Acronyms used here: AI, API, WAF, DDoS, SBOM, CMDB
AI — Artificial Intelligence
Software that performs tasks such as recognising patterns, generating text or helping classify information.
API — Application Programming Interface
An agreed way for one application to request data or actions from another application.
WAF — Web Application Firewall
A filter that checks requests to your website and blocks suspicious ones before they reach the application.
DDoS — Distributed Denial of Service
An attack that uses many sources to overwhelm a website or service with traffic.
SBOM — Software Bill of Materials
An inventory of the components in a piece of software, useful when checking which systems contain a vulnerable component.
CMDB — Configuration Management Database
An inventory that records systems, their owners and how they depend on one another.

All acronyms and explanations →