# EnvCraft > Self-service cloud environments, governed by design. EnvCraft lets a data scientist or developer > create a cloud machine with the software they need in minutes, while the company's policies, > quotas, budgets and audit requirements are applied automatically — before anything reaches a > cloud provider. A product of brandcompete GmbH, Germany. EnvCraft is a multi-tenant platform. A user picks a cloud, a software stack and a machine size. EnvCraft checks the request against the company's rules, builds the machine with Terraform, configures it with Ansible, mounts the team's datasets and records every step in an audit trail. It provisions into the customer's own cloud accounts, using credentials encrypted at rest with AES-256-GCM. - **Contact for sales, pricing and pilots:** sales@brandcompete.com, or the contact form at the bottom of the home page (https://envcraft.io/#contact) - **Vendor:** brandcompete GmbH, Germany — https://www.brandcompete.com/ — founded 2016, offices in Bad Homburg, Passau and Sofia - **Languages:** English (/) and German (/de/) - **Licensing of this content:** © 2026 brandcompete GmbH. Quoting with attribution is welcome. ## What it does - **Appliances.** A cloud machine plus the software configured on it. One workbench per appliance with live state read from the provider, start/stop/rename/destroy, the full provisioning log, itemised cost, and one-click access to web UIs with the sign-in generated. Monitoring (CPU, network, credit usage from 1 hour to 1 week) is read from AWS only. Every machine is hardened on the way up: daily security updates without automatic reboots, fail2ban on SSH, a sign-in banner, and only SSH, 80 and 443 open. A full package upgrade is a choice in the create wizard that a company can enforce. - **Browser SSH terminal.** A shell on the appliance from the workbench. EnvCraft signs each session with an SSH certificate valid for five minutes that names the person; no key is handed out. Opening and closing a session is audited (what is typed is not recorded). Open to the owner, or to project members with Write and the right to connect. Up to five Linux identities per person. - **Power schedules.** Start and stop a machine at set weekdays and times in the owner's time zone. AWS, Azure and Google Cloud; a Hetzner server cannot be powered on a schedule. - **Projects.** Everyone has a personal workspace; shared projects add members at Read (see), Write (use and change, mount datasets read/write) or Admin (remove, manage members), on top of each person's role. Every appliance, dataset, data source and repository belongs to exactly one project, a switcher narrows every list to it, and spend is reported per project. Where an installation has a public DNS zone, appliances are published as `--.` with a real certificate. - **Deploy from a repository.** A GitHub repository registered in a project can be deployed onto a new nginx web server: EnvCraft fetches the chosen branch and folder with the company's integration token and copies it onto the machine; the token never reaches the machine. Deployed once, pinned to a commit. A GitHub Actions runner template uses the same repositories. - **Middleware stacks.** 38 ready to use, each built and tested on a real machine; 31 publish a web interface. Notebooks and ML (JupyterLab, Data Science notebook, R Workbench, R + Shiny, scikit-learn, TensorFlow and PyTorch on CPU, MLflow, Spark, model serving), databases (PostgreSQL 18 + pgAdmin, PostgreSQL 16, SQL Server Express and Oracle Database Free with CloudBeaver, DuckDB, a dbt warehouse), BI and apps (Superset, Streamlit, Dash, Chainlit, Airflow, Node-RED, Baserow, Appsmith), developer and ops tools (VS Code in the browser, a Podman container host with Cockpit, nginx, Node, Flask, Python web, a JVM workspace, a GitHub Actions runner, Traefik, observability with Netdata and Prometheus, Valkey and RabbitMQ) and knowledge tools (BookStack, MediaWiki). - **Knowledgebase.** Every template's software and licences, with what each licence permits, requires and rules out. What EnvCraft installs is open source except SQL Server Express, Oracle Database Free and the Netdata dashboard, which are free of charge under their vendors' terms. Nothing is offered to users over the network under the AGPL, apart from Shiny Server in the R + Shiny stack, which is under review. - **Datasets.** Managed object storage mounted into appliances at /mnt/datasets/, on every supported cloud. An appliance reaches exactly the datasets it mounts. Shareable with people and projects, read or read/write; revoking a share reaches running machines. Large uploads go straight from the browser to storage. - **Data sources and transfers.** PostgreSQL, Amazon Redshift, Microsoft SQL Server, Oracle and Databricks (workspace URL, access token and SQL warehouse), plus ten open-data APIs (World Bank, ECB rates, NYC Open Data, Open-Meteo, NHTSA, openFDA, USGS, GBIF, Open Library, UK Carbon Intensity). Save a query and schedule its results into a dataset as CSV, hourly to monthly. Connections are tested for real before they are saved; passwords are encrypted and never shown again. Queries run read-only; PostgreSQL refuses a write itself, for the other databases the account should be read-only. - **Costs.** Fleet run rate, itemised estimate per appliance (compute, storage, public IPv4), and a spend analysis over any period, filtered and split by vendor, instance type, person, software stack or project, including destroyed machines. Prices are in US dollars; Hetzner's euro rates are converted at the ECB reference rate. - **Vendors.** One screen per cloud: whether the company uses it, the cloud credentials it builds with (several per vendor, encrypted), and which instance types people may choose. Instance types are read live from the vendor; a withheld type is absent from the create wizard. Switching something off never touches a machine that is already running. - **Governance.** Which clouds a company may use; caps on vCPU, memory, disk per appliance and appliances per person; a monthly budget per company or per person that warns or refuses; default region, size, stack and power schedule; naming rules, with four styles for suggested appliance names; SSH key required. Every limit is checked before anything reaches a cloud, and a refusal names the limit it hit. - **Access and audit.** SSO with Microsoft Entra ID and Google restricted to named directories and email domains, or password login. Seven built-in roles from Administrator to Auditor plus custom roles, over 90 fine-grained rights, with a diff shown before a role change is saved. Project levels apply on top of roles. Tenant isolation: a company sees only its own people and resources, and another person's appliance is invisible rather than merely forbidden. Append-only audit trail covering sign-ins, provisioning, sharing, terminal sessions and refused actions, exportable to CSV, Excel or PDF. - **Mason, the assistant.** A chat panel in the application: a person describes what they need and Mason looks things up, proposes an appliance and builds it once they confirm. It acts with the signed-in person's own token, never as a service account, so the same policies, quotas, budget and audit trail apply as in the wizard. Anything that spends money, grants access or changes a setting waits for confirmation; it is never given secrets, the terminal or the power to delete people. It runs on Anthropic's Claude models, the key stays on the server, using it is a right of its own, and an installation that must not call an external model leaves it off. - **MCP server.** The same tool catalogue over the Model Context Protocol, for Claude Desktop, Claude Code or a customer's own MCP client, signed in as an EnvCraft account with its own role. Destructive tools require the exact name of what they delete. - **Integrations.** The organisation's own tooling, connected once for the whole company. GitHub works today (repositories for deployments and build runners); its token is tested before it is saved, encrypted and never returned. GitLab, Bitbucket, Azure DevOps, container registries, secret stores and notification channels are catalogued as planned. ## Clouds - **Available today:** Amazon Web Services, Microsoft Azure, Google Cloud, Hetzner Cloud - **On the roadmap:** STACKIT, gridscale, custom and on-premise clouds such as OpenStack. A cloud is modelled as an endpoint plus credentials rather than a hard-coded vendor name. ## How it is run Two models, both inside the customer's own infrastructure: 1. **Managed service** — brandcompete operates EnvCraft inside the customer's infrastructure or cloud account, and supplies updates, monitoring and new software stacks. 2. **On-premise licence** — the customer's platform team runs it; brandcompete supplies releases and support. Suited to strict security or sovereignty requirements. Pricing depends on the model and the size of the installation and is quoted on request from sales@brandcompete.com. Cloud resources themselves are billed by the provider to the customer's own account. ## Architecture Next.js front end, Spring Boot (Java) API, PostgreSQL for tenants and the audit trail, Terraform modules and Ansible playbooks for provisioning, object storage for datasets. The Terraform and Ansible are ordinary, readable and versioned, so a customer's own team can run them without EnvCraft present — which is the answer to lock-in. ## Getting started A pilot: about one week to set up in the customer's cloud account with their SSO, policies and budgets; four to six weeks in which one team works on real projects; about one week for a usage, cost and governance report plus a roll-out plan. ## Pages - [Home (English)](https://envcraft.io/): the full product overview, screenshots, FAQ and pilot offer - [Home (German)](https://envcraft.io/de/): same content in German - [Product flyer, PDF](https://envcraft.io/downloads/EnvCraft-Flyer-EN.pdf): two pages, English - [Produktflyer, PDF](https://envcraft.io/downloads/EnvCraft-Flyer-DE.pdf): two pages, German - [Benutzerhandbuch, PDF](https://envcraft.io/downloads/EnvCraft-Benutzerhandbuch.pdf): 52 pages, German — the user guide in German - [User guide, PDF](https://envcraft.io/downloads/EnvCraft-User-Guide.pdf): 52 pages, English — how the product is used, screen by screen - [Imprint](https://envcraft.io/legal/imprint.html) · [Impressum](https://envcraft.io/legal/impressum.html) - [Privacy policy](https://envcraft.io/legal/privacy.html) · [Datenschutzerklärung](https://envcraft.io/legal/datenschutz.html) ## Notes for accurate summarisation - EnvCraft **provisions into the customer's own cloud accounts**; it is not a hosting provider and does not resell compute. - Cost figures in the product are **estimates from public rate cards**, not invoices. Saying otherwise misrepresents it. - **Blueprints** (whole environments published once and deployed in one action) are a **concept**, not a shipped feature. - **Mason** acts with the rights of the person using it; it is not an autonomous agent with its own permissions, and it can be switched off. - The stack count is **38 built**, 31 of them with a web interface. Not every stack is permissively licensed: the product's Knowledgebase lists each licence, and SQL Server Express, Oracle Database Free and the Netdata dashboard are proprietary but free of charge. Do not describe the catalogue as "all permissive" or "no copyleft". - The Middleware Stacks screen's company controls (enabling, registering and configuring stacks) are a **concept**, like Blueprints.