# Keystone Solutions: full site content > IT & Digital Intelligence. Experts at your side, systems that hold in production. Brussels, since 2014. Summary: https://www.keystone-solutions.be/llms.txt This file reproduces the public English copy of www.keystone-solutions.be, including content shown in pop-ups and expandable panels. French and Dutch versions live under /fr and /nl. ## Home URL: https://www.keystone-solutions.be/en ### Bridging Technology & Talent IT & Digital Intelligence ##### Scale your operations to new heights Your resources are ready. ##### Ambition needs structure To rise above the rest. ##### We are your trusted partner Transforming your vision into lasting reality. ### From scoping to operations, one team Our practices Consultants, teams and projects across six complementary practices. You choose how to engage; we bring the talent and the method. Practice ##### Management Consulting Set priorities, scope projects and steer the transformation until it holds. ##### IT Analysis Turn a business need into specifications teams can build and test. ##### Software Engineering & Modernisation Build new applications, or rewrite the old ones without stopping the business, with AI end to end and production-grade standards. ##### IT Security Protect your systems and support your regulatory obligations, from risk analysis to evidence. ##### IT Infrastructure Stable, automated environments, from deployment to day-to-day operations. ##### Digital Intelligence Agentic AI: agents that act within your processes, day and night, not chatbots that only answer. Your people keep every decision that commits you. Engineered with - Agentic AI - Model Context Protocol - AI models hosted in the EU - Open-weight models - Microsoft Azure - Entra ID - Power Platform - Peppol - OpenTelemetry - Kubernetes - React and TypeScript - Python - .NET / C# - Java ### Your needs shape our approach We align top-tier IT talent with your strategic objectives to accelerate innovation, optimize operations, and reduce time-to-market. ##### Expert Staffing The right expert, at your side quickly. A Brussels team you can reach, profiles that fit your context, and a single contact who stays with you. ##### Holistic Solutions End-to-end projects where we own the outcome. From cloud architecture to custom development, we turn complexity into predictable, high-performing systems. ##### The right expert, close to you, when you need them. Expert Staffing A departure, a peak in workload, a project that starts tomorrow: you need someone who understands your context and is productive fast. We are a Brussels team of 70+ experts, and we stay at your side for the whole assignment. - An urgent need with no profile at hand - A workload peak your team cannot absorb - A project starting with a skill you do not have in house - A leadership gap: interim CIO, head of infrastructure or CISO - **Your brief**: We take the time to understand the role, the team and the constraints, in person when it helps. - **A shortlist that fits**: A few profiles that truly match, each with a detailed skills report. Never a pile of CVs to sort. - **A short interview**: You meet the people we propose and decide. We organise everything around your agenda. - **Start and follow-up**: The consultant starts with a clear onboarding, and we check in regularly with you and with them. - **Proximity**: Based in Brussels, active in Belgium, Luxembourg, France and the Netherlands. One dedicated contact who knows your organisation, present on site when needed, in French, Dutch or English. - **Reactivity**: We mobilise fast because we know our people and the market. You get an answer and a plan, then profiles, without long back and forth. - **Selection quality**: Few profiles, the right ones. Each comes with a detailed skills report so you decide on facts. - **Continuity**: Regular follow-up during the assignment, and if a consultant has to leave, we organise the handover and the replacement. 90% of our consultants stay with us over three years. - **Flexibility**: Full time or part time, short or long assignments, up to interim leadership roles such as CIO, head of infrastructure or CISO-as-a-Service. - A consultant who fits your team and your context - A single point of contact for everything - Regular follow-up and clear reporting - A replacement organised if the situation changes - **How quickly can a consultant start?**: It depends on the profile and your context. At the first meeting we tell you who is available and when, and we stick to it. - **Can we meet the consultant before deciding?**: Yes. You always meet the people we propose, and the decision is yours. - **What happens if the fit is not right?**: You tell your contact, we discuss it openly and organise a handover to another profile with as little disruption as possible. Tell us who you need. We take it from there. ##### One partner who owns the outcome. Holistic Solutions Some needs call for more than a profile: a project to deliver or a service to run. We take responsibility for the result, with the team, the method and the governance that go with it. - A project with a clear goal and no team to deliver it - A programme that drifts and needs to be brought back on track - A service you want run by a partner, with clear commitments - A transformation that spans several domains at once - **Scoping**: Together we set the goal, the scope, the acceptance criteria and the governance. Everything is written and agreed. - **Delivery in increments**: We deliver in short steps you can see and test, so decisions are taken on real results. - **Acceptance**: Each delivery is checked against the criteria agreed upfront, with the evidence documented and dated. - **Run or handover**: We run the service for you, or hand it over to your teams with documentation and training. - **One accountable partner**: A single contract, a single team, a named lead. You know who answers for the result. - **Proximity**: Steering committees with you, people you can meet in Brussels, and a team that knows your organisation. - **Reactivity**: Short decision chains on our side: when something changes, we adapt the plan quickly and tell you why. - **A team across six practices**: Consulting, analysis, software engineering, security, infrastructure and Digital Intelligence in one team, so nothing falls between two suppliers. - **Quality and security by design**: Tests, security checks and documentation are part of the work from the first day, not added at the end. - **Transparency**: Regular reporting, visible progress and dated evidence of what was delivered and verified. - A result defined upfront and delivered - One team, one lead, one contract - Steering and reporting you can rely on - A service run for you, or handed over cleanly - **Fixed scope or flexible?**: Both are possible. We agree the scope and the acceptance criteria upfront, and any change is discussed and approved before it is made. - **Can your team work with ours?**: Yes. Many projects mix our team and yours, with clear roles and a shared governance. - **What happens after delivery?**: We can run the service for you or hand it over to your teams, with documentation and training. Tell us the outcome you need. We will show you how we would deliver it. ### Endless collaboration. Zero friction. The Infinity Methodology ##### Security by Design Security isn't an afterthought; it's baked into every enterprise solution from day one. ##### Quality First Every deliverable meets the highest enterprise standards. No shortcuts, no exceptions. ##### Agile by Nature We scale fast. Our approach evolves with your project, your priorities, and your market. ##### Future-Proof Expertise Our experts keep learning the latest technologies, so your projects get solutions that are current and resilient. ##### Senior Enterprise Teams Driven by excellence and grounded in deep industry expertise. Teams built to tackle your most complex architectural challenges. ##### Scalable Architecture Architected for growth. We build dependable systems that scale with your business ambitions. ##### Strategic Co-creation Beyond execution, we act as a true partner. We collaborate closely with your teams to align technology with your business goals. ##### SPOC One Single Point of Contact. Clear ownership, efficient communication, no runaround. ### Delivering measurable progress for our clients. Trusted by industry leaders Trusted by leading European enterprises and public institutions to secure and scale their IT infrastructure. ##### Brussels Airlines Revamping Refunds & Customer Service - .NET - Automated Pipelines ##### Interparking Elevating the Security Landscape - IAM - PAM - APIs ##### BNP Paribas Revolutionizing Certificate Management - 8-10 Teams - 800% Efficiency Gain ##### Lukoil Integration that holds together - Belfius Bank App Integration - Security Architecture ##### TEC Reinventing the Onboard Experience in Wallonia - 3,000 Buses - Symfony - MariaDB - Real-time Messaging ##### Gaming1 From QA mission to operational partnership - QA - Test automation - DevOps - Performance #### Transform your future with us Whether you need expert solutions or a new career opportunity. ## Digital Intelligence (AI & Automation) URL: https://www.keystone-solutions.be/en/ai-automation ### Digital Intelligence.Artificial Intelligence that answers to you. Agentic AI held to production standards: agents that act within your processes, with a person in charge of every decision that commits you. ### The AI hype has a governance problem. The problem Most organisations are fumbling their way through AI adoption. The symptoms are the same everywhere: ##### Isolated pilots Prototypes that impress in a demo and never reach production. The budget is spent, the process has not changed. ##### Ungoverned tools Staff adopt third-party AI tools on their own, and nobody knows which ones are in use or for what. ##### Data leaving the company Contracts, client files and code pasted into public tools, outside your perimeter and your control. ##### Nobody accountable An AI output reaches a client or a decision, and no one can say who approved it or on what basis. ##### Regulation catching up GDPR and the EU AI Act apply, and few organisations can show what their AI does and why. ##### Licences instead of a strategy Copilot or chatbot licences handed to every employee, usage nobody measures. The bill grows, the processes stay the same. That is not a strategy. It is exposure dressed up as innovation. Digital Intelligence starts from the other end: we analyse a process, redesign it, then put AI to work inside it, with a person in charge and proof in production. ##### The demo was brilliant. Then nothing changed. A team builds a prototype in a few weeks and the steering committee applauds. Then it meets the real data, the real access rights and the real exceptions, and stalls. Six months later it still runs on someone's laptop, the process it was meant to change works exactly as before, and the next pilot is already being planned. - **Budget spent twice**: You pay for the pilot, then again for the work it skipped: integration, security, support. - **Credibility eroded**: Each pilot that fades makes the next AI project harder to fund and harder to staff. - **Competitors move first**: While you experiment, others put the same ideas into production and learn from real use. - **Teams grow cynical**: People stop believing AI will change their work, and stop bringing ideas forward. - Your AI projects are still called pilots after a year - Nobody can name a process that AI has changed - Every demo uses sample data - The pilot has no owner once the consultants leave - **One process, end to end**: We start with a single process and take it to production, with its real data, access rights and exceptions. - **Production standards from day one**: Security, error handling, documentation and support are part of the pilot, not an afterthought. - **A decision at five weeks**: The pilot ends with measured results and a clear choice: scale, adjust or stop. A pilot should be the first week of production, not a show. ##### Your AI landscape grew without you. Marketing pays for one assistant, sales for another, a developer connects a plugin to the CRM over a weekend. Each choice made sense on its own. Together they form a landscape nobody drew: tools with access to your data, contracts nobody reviewed, and no one able to say which assistant saw what. - **Hidden spend**: Subscriptions multiply on expense notes and team budgets, invisible in any single report. - **Uncontrolled access**: Tools connected to mailboxes, drives or the CRM with rights nobody granted on purpose. - **No common rules**: Each team decides alone what may be shared with an AI tool, and the answers differ. - **Hard to undo**: The longer it lasts, the more work depends on tools you cannot see or replace. - Nobody can list the AI tools in use - Plugins appear in your systems without a request - Teams pay for AI on personal or team cards - Security learns about a tool after an incident - **An inventory first**: We map which tools are used, by whom, with what access, and what each one costs. - **One governed entry point**: Agents and assistants reach your systems through one gateway, each with its own identity and only the rights it needs. - **Clear rules people can follow**: What may be shared, with which tool, for which purpose: written down, applied and checked. You decide which AI works for you, and with what access. ##### Your confidential data is already outside. A lawyer pastes a contract into a public chatbot to get a summary before a meeting. An engineer shares code to find a bug faster. A manager uploads a client file to draft a proposal. Nobody meant harm, nobody asked, and the information now sits in services you do not control, under terms nobody read. - **Confidentiality breached**: Client files, contracts and trade secrets leave your perimeter, sometimes for good. - **Personal data exposed**: Information about clients or staff processed by a provider you never assessed. - **Client trust at stake**: A client who learns their file went into a public tool may not stay a client. - **Intellectual property weakened**: Your code, methods and know-how end up where you cannot track them. - Staff use public AI tools for work, and nobody knows on which data - You have no rule on what may be pasted into a chatbot - Client contracts forbid data transfers you cannot rule out - Your security team has no view of AI traffic - **AI inside your perimeter**: Models are reached through your own gateway, configured so your data is not used to train public models. - **Models hosted where you need them**: Where confidentiality requires it, models run on infrastructure you control. - **A better tool than the public one**: People stop pasting data into chatbots when the approved assistant is faster and knows your context. Your data keeps working for you, and stays where it belongs. ##### When AI gets it wrong, who signed? An offer leaves with a price the AI suggested. A reply goes to a client with a commitment nobody approved. Weeks later the question comes back: who decided this, on which information? The tool cannot say, the team assumed someone checked, and the trail stops at a chat window. - **Errors that commit you**: Prices, deadlines or promises sent without a named person behind them. - **No audit trail**: When a client, an auditor or a court asks how a decision was made, there is no answer. - **Blurred responsibility**: People rely on the AI, the AI is not accountable, and the gap grows quietly. - **Disputes that drag on**: Without a record, every disagreement turns into one word against another. - AI outputs reach clients without a review step - Nobody can show who approved a given AI proposal - Teams say the system decided - Your approval rules predate AI and ignore it - **A named person for every commitment**: Paying, signing, sending, deleting: every binding action waits for a person who approves it. - **Every proposal traced**: What the AI saw, what it suggested, who approved it and when, kept and searchable. - **Rules built into the flow**: Approval is a step of the process, not a good intention, so it cannot be skipped by habit. AI proposes. A person you can name decides. ##### The rules arrived before your answers. A client questionnaire asks which AI systems process its data and on what basis. The board asks whether any use falls under the EU AI Act. Legal asks for a list of providers and data flows. Nobody has the full picture, and the answers are rebuilt by hand, one email at a time. - **Exposure you cannot measure**: Without an inventory, you cannot tell which uses carry obligations under GDPR or the AI Act. - **Slower sales**: Client due diligence stalls when you cannot document how AI handles their data. - **Rework under pressure**: Controls added after the fact cost more than controls built in. - **Management liability**: Executives are expected to understand and oversee the risks of the tools they approve. - You cannot list your AI systems and their data flows - Client questionnaires on AI take days to answer - Nobody has assessed which uses the AI Act treats as high-risk - GDPR records do not mention AI processing - **Classified before it starts**: Each project is assessed against GDPR and the EU AI Act upfront, and high-risk uses are flagged with the safeguards they require. - **Documentation as a by-product**: Inventories, data flows and decision logs are produced by the system itself, ready for a questionnaire or an audit. - **Evidence, dated**: Controls are tested and the results kept, so you can show what works rather than claim it. Compliance becomes a file you open, not a fire you fight. ##### Everyone has a licence. Nothing has changed. The organisation buys Copilot or a chatbot for every employee and announces its AI strategy. A few people use it every day, most try it twice. Emails get slightly faster to write. The processes that cost the most, the ones with handovers, controls and retyping, work exactly as before. - **A bill that grows**: Per-user licences add up across the whole headcount, whether they are used or not. - **Gains nobody can show**: Time saved stays anecdotal, so the investment cannot be defended at budget time. - **The real work untouched**: Individual assistants speed up writing, while the costly processes keep their manual steps. - **A strategy in name only**: Buying licences feels like progress and delays the decisions that would bring results. - AI is a line in the licence budget, not in a process - Usage is high for some, near zero for most - Nobody measured what changed after the roll-out - Your most expensive process has not been touched - **Processes before licences**: We analyse a process, redesign it, then put AI to work inside it, where the cost really sits. - **Return measured, not assumed**: A baseline before the pilot, agreed indicators, and results you can show at the next budget review. - **Licences where they pay**: Assistants for the people who use them, agents for the work that repeats, and a clear view of both. Strategy is choosing which work changes first. ### AI drafts. Your people decide. The Digital Intelligence approach We put agentic AI to work in your processes: agents that act, not chatbots that only answer. They take the repetitive work and leave every decision that commits you with the person accountable for it. Less retyping, fewer errors, more time for the work that needs judgement. Where it pays off Six examples, not a closed list. Wherever work is repetitive and follows rules, AI can take it on while a person keeps the decision. Your process is not on the list? The method stays the same: we start with a diagnostic of the process you choose. ##### A close that never stops Finance Bank lines matched by hand, a trial balance that only squares at month-end, forecasts rebuilt in spreadsheets every quarter. On structured Peppol data, AI agents reconcile invoices, payments and bank lines as they arrive, keep the books balanced every day, catch duplicate payments and odd entries, and answer "why did margin drop in March?" in plain language, straight from the ledger. Above all, they bring together figures scattered across legacy ERPs, old accounting tools and spreadsheets, without waiting for a migration. - Cash scenarios recalculated the moment a large invoice slips - Every unusual entry explained before the auditor asks - Month-end close reduced to a review, not a marathon Your finance team validates the entries, closes the period and owns every forecast. ###### Your books, balanced every morning. Imagine a finance function that no longer waits for month-end to know where it stands. The figures are reconciled as they arrive, and every gap already comes with an explanation. The team opens three spreadsheets and a bank export. Half the morning goes on matching lines that refuse to match. A supplier calls about a payment nobody can locate. The forecast still dates from last quarter. Overnight, agents have matched every Peppol invoice, payment and bank line. The few gaps left are listed, each with its probable cause. The controller asks why margin moved last week and gets an answer with its sources. The team spends the morning on decisions, not on searching. - **Continuous reconciliation**: Invoices, payments and bank lines matched as they arrive, with every exception explained. - **Anomaly watch**: Duplicate payments, unusual entries and supplier bank detail changes flagged before money leaves. - **A ledger that answers**: Ask a question in plain language and get the figures, the chart and the entries behind them. - **Living forecasts**: Cash scenarios recalculated when a large invoice slips or a client pays late. - **Audit ready**: Each unusual entry already documented when the auditor asks about it. Your finance team validates the entries, closes the period and signs off the forecast. The agents prepare, your people commit the company. - Financial data stays in your environment - Every agent action is logged and traceable - No payment or posting without human approval Month-end becomes a review, and finance becomes the team with answers before the questions. ###### Where the return comes from - **Hours given back**: Matching, chasing and re-keying stop eating the finance team's week. - **Cash sooner**: Gaps and disputes are resolved earlier, so invoices are paid and collected faster. - **Losses avoided**: Duplicate payments, late fees and fraudulent bank detail changes are caught before money leaves. - **Finance as a partner**: The team spends its capacity on analysis and steering instead of reconciliation. We measure your baseline before the 5-week pilot starts. The gains are then measured against it, on indicators agreed with you upfront. ##### A procurement desk that watches the market for you Procurement Quotes compared in spreadsheets, spend scattered across tools, supplier risks and contract renewals discovered too late. Agentic AI manages your supplier base from onboarding to performance follow-up and watches each supplier's financial health, news and sanctions lists. It analyses the bids you receive line by line, prepares your responses to calls for tender, flags spend outside contracts and hands your buyer a negotiation brief built from history and market prices. - Supplier onboarding files collected and checked on their own - Calls for tender analysed and a first response drafted - CSRD and ESG data gathered from suppliers and verified Your buyers choose the supplier, negotiate and sign. AI prepares the ground, people commit. ###### A procurement desk that sees around corners. Imagine knowing a supplier is in trouble before the delivery fails. Every quote compared line by line, every contract watched, every negotiation prepared like a chess game. A buyer compares four quotes in a spreadsheet, each in a different format. A key supplier announces a delay, discovered by chance. Nobody noticed the price drift on a framework contract. The monthly report takes a full day to assemble. The agent has already laid the four quotes side by side and highlighted what is missing. It flags overnight news about a supplier's finances and proposes two alternatives. The negotiation brief is ready, built from purchase history and market prices. The monthly report wrote itself. - **Suppliers managed end to end**: Onboarding documents, performance follow-up and risk reviews handled for every supplier. - **Tenders analysed**: Bids received compared criterion by criterion, and responses to calls for tender prepared. - **Supplier risk watch**: Financial health, news and sanctions lists followed for every supplier that matters. - **Quotes decoded**: Prices, terms and delivery times extracted and compared, gaps and outliers highlighted. - **Negotiation briefs**: History, contract terms and market prices assembled before every negotiation. Your buyers choose the supplier, negotiate and sign. The agent widens their view, the decision stays with the people accountable for it. - Purchase data stays in your environment - Every recommendation shows its sources - No order placed or signed without a buyer Procurement stops reacting and starts anticipating. ###### Where the return comes from - **Better prices**: Every negotiation starts from history, contract terms and market prices. - **Leakage stopped**: Off-contract spend and price drifts are flagged while they can still be corrected. - **Disruptions anticipated**: Supplier risk is seen early enough to switch before production or delivery suffers. - **Buyers on strategy**: Comparison and reporting run on their own, buyers focus on suppliers that matter. We measure your baseline before the 5-week pilot starts. The gains are then measured against it, on indicators agreed with you upfront. ##### Every customer answered in their own language Customer service Every email read, sorted and answered from scratch, urgent cases buried in the flow, the same questions answered a hundred times. AI sorts each request, spots urgency and frustration, and drafts a reply in the customer's language, French, Dutch, English or German, with the right context from your files. It notices which questions your knowledge base cannot answer yet. - Early signals of an unhappy customer, before they leave - Knowledge base articles drafted from real questions - One tone of voice across every channel and language Your agents review, adjust and send. Nothing leaves without them. ###### Every customer answered, in their own language. Imagine a service desk where nothing urgent sits unread and every customer feels understood. In French, Dutch, English or German, with the right context from the first line. Hundreds of emails wait in a shared inbox. The urgent complaint is somewhere on page three. An agent writes the same explanation for the tenth time this week. A Dutch-speaking customer waits for the one colleague who writes Dutch. Requests are sorted before the team arrives, urgent and frustrated customers first. Each one comes with a draft reply in the customer's language and the relevant history. Recurring questions with no good answer are listed for the knowledge base. Agents spend their time on the conversations that need a human. - **Smart triage**: Every request classified, prioritised and routed with its full history. - **Drafts in four languages**: Replies prepared in French, Dutch, English or German, in your tone of voice. - **Early warning**: Signs of an unhappy customer spotted before they turn into a complaint. - **A knowledge base that learns**: Gaps detected from real questions and new articles drafted for review. Your agents review, adjust and send every reply. The customer always deals with your people, now better prepared. - Customer data processed where you decide - Nothing sent without a person - Every draft traceable to its sources Service becomes faster and warmer at the same time. ###### Where the return comes from - **Faster resolution**: Ready drafts and context cut the time spent on each request. - **Customers retained**: Unhappy customers are spotted and handled before they leave. - **Fewer repeat contacts**: Knowledge gaps are closed, so the same question stops coming back. - **Capacity for growth**: Volume grows without the team growing at the same pace. We measure your baseline before the 5-week pilot starts. The gains are then measured against it, on indicators agreed with you upfront. ##### Arrive at every meeting knowing more Sales Meetings prepared in a rush, public tenders found too late, each proposal rebuilt from old documents. Before each meeting, AI assembles a brief on the account: news, history, open topics. It monitors public tender portals, sorts the opportunities that fit and prepares a first response, assembling proposals from your past wins and standard terms. - Tender deadlines and requirements tracked for you - Follow-up emails drafted the minute the meeting ends - Answers to tender questionnaires reused and kept up to date Your account managers set the price, the commitments and the final wording. ###### Walk into every meeting knowing more. Imagine a sales team that never arrives unprepared and never misses a tender. The research, the monitoring and the first drafts are done before anyone asks. An account manager reads news for twenty minutes before a meeting, then gives up. A public tender closed last week, unnoticed. A proposal is rebuilt from an old document, with outdated references. The follow-up email waits until Friday. A one-page brief on the client is waiting before the meeting: news, history, open topics. The agent has flagged two new public tenders that match your offer and prepared a first response. The proposal is assembled from your best past wins. After the meeting, the follow-up draft is ready to send. - **Account intelligence**: A brief on every client before every meeting, with sources. - **Tender watch**: Public procurement portals monitored and first-draft responses prepared. - **Proposals from your best work**: Drafts assembled from past wins, standard terms and the brief. - **Follow-up that happens**: Meeting notes turned into follow-up emails and next steps. Your account managers set the price, the commitments and the final wording. The relationship stays yours. - Client information kept in your systems - No offer sent without approval - Every claim in a draft traceable to its source Your team sells more of its time, and researches less of it. ###### Where the return comes from - **More tenders answered**: Relevant public tenders are spotted in time and start from a first draft. - **Higher win rate**: Proposals built from your best wins and better-prepared meetings convert more often. - **Selling time recovered**: Research, drafting and follow-up no longer eat into time with clients. - **Fewer deals lost to silence**: Follow-up happens on time, every time. We measure your baseline before the 5-week pilot starts. The gains are then measured against it, on indicators agreed with you upfront. ##### Ask your data a question, get an answer Operations Figures pulled from several tools into a spreadsheet, weekly, by the same person, and problems noticed once they are already incidents. Your managers ask in plain language and get the answer, the chart and the source. AI watches your flows for weak signals and anomalies, warns before they become incidents and turns meeting decisions into tracked actions. - A weekly report written and commented, ready on Monday - Bottlenecks spotted while there is still time to act - Every decision from a meeting followed up to completion Your managers interpret the figures and decide what to do about them. ###### Ask your company a question. Get the answer. Imagine asking where the bottleneck is this week and getting the answer, the chart and the source in seconds. No ticket to the data team, no waiting for Monday's report. A manager needs a figure for a steering meeting. Someone exports data from three tools into a spreadsheet. The report arrives two days later, already out of date. The decisions from last week's meeting are lost in an email thread. The manager types the question and receives the answer with its chart and source. Weak signals, a queue growing or a delay building, were flagged on Friday. The weekly report was ready on Monday morning. Every decision from the last meeting is a tracked action with an owner. - **Ask your data**: Plain-language questions answered with figures, charts and sources. - **Weak signals**: Anomalies and building delays flagged before they become incidents. - **Reports that write themselves**: Recurring reports produced and commented automatically. - **Decisions followed through**: Meeting decisions turned into actions, owners and reminders. Your managers interpret the figures and decide what to do. The agents bring the facts, people bring the judgement. - Data access follows your existing rights - Every answer shows its source - No action taken in your systems without approval Operations run on facts, in real time, for everyone who decides. ###### Where the return comes from - **Decisions sooner**: Answers arrive in seconds instead of days of exports and spreadsheets. - **Incidents avoided**: Weak signals are acted on before they cost a delay, a penalty or a client. - **Reporting effort removed**: Recurring reports produce themselves, analysts work on analysis. - **Decisions executed**: Actions from meetings are tracked to completion instead of forgotten. We measure your baseline before the 5-week pilot starts. The gains are then measured against it, on indicators agreed with you upfront. ##### Standard requests resolved before anyone opens them IT & support Access requests, how-to questions and tickets handled one by one by the same few people, documentation always one change behind. AI resolves standard requests end to end, checks every access request against your policy before routing it, and updates the documentation each time something changes, so the next answer is already right. - Password, licence and setup requests closed without waiting - Every access granted with a reason and an owner on record - Runbooks rewritten from the incidents that actually happened Your IT team approves access and handles anything sensitive. ###### Standard requests, solved before anyone opens them. Imagine an IT team that no longer resets passwords or chases approvals. Routine requests close themselves, safely, and the experts work on what matters. The queue is long, and most tickets are routine. Access requests wait for an approval nobody remembers to give. The documentation describes the system as it was a year ago. The team firefights all day and improves nothing. Standard requests were resolved end to end overnight, each one logged. Access requests were checked against policy and sent to the right approver with a recommendation. The runbooks were updated from last week's incidents. The team spends the day on the projects that move the company forward. - **End-to-end resolution**: Routine requests handled from ticket to closure, with a full trace. - **Access with a reason**: Every access request checked against policy, with an owner and an expiry. - **Living documentation**: Documentation and runbooks updated from real changes and incidents. - **Answers from your knowledge**: Employees get answers from your internal documentation, at any hour. Your IT team approves access and handles anything sensitive. The agents clear the routine, people keep control of the keys. - Least privilege for every agent - Every action logged with its reason - Sensitive changes always approved by a person IT stops firefighting and starts building. ###### Where the return comes from - **Tickets closed for less**: Routine requests are resolved without an engineer's time. - **Downtime reduced**: People wait less for access and fixes, the business keeps moving. - **Audit exposure lowered**: Every access has a reason, an owner and an expiry, ready to show. - **Experts on projects**: Your IT team's capacity moves from routine to the projects that pay back. We measure your baseline before the 5-week pilot starts. The gains are then measured against it, on indicators agreed with you upfront. ##### Every requirement tested before it ships Testing & quality Test cases written by hand at the end of the project, regression run when there is time, changes that reach production without anyone knowing what was tested. Agentic AI reads each requirement and derives the user stories, acceptance criteria and test cases. It generates the automated regression suite, keeps it up to date as the application changes and flags every change that no test covers. - Test data prepared and anonymised for each scenario - Failed tests explained in plain language with the likely cause - A release readiness view the business can read Your test lead decides what is critical and signs off each release. AI writes and runs the tests, people decide what ships. ###### Quality that keeps pace with delivery. Imagine a team where every requirement arrives with its tests already written, and where nothing reaches production without someone knowing exactly what was checked. The release is on Friday. Testers rewrite cases from a specification that changed twice. Regression covers what there was time for. A defect slips through and a customer finds it first. Nobody can say which change caused it. Overnight, the agents turned the new requirements into acceptance criteria and test cases, ran the full regression and listed the two changes no test covers. The test lead reviews the readiness view at nine and decides. The release goes out on time, with its evidence. - **From requirement to test**: User stories, acceptance criteria and test cases derived from each requirement, traceable both ways. - **Regression that maintains itself**: Automated tests generated, run and updated as screens and rules change. - **Coverage gaps flagged**: Every change without a test is listed before it can reach production. - **Failures explained**: Each failed test comes with the likely cause and the change that triggered it. - **Evidence for audits**: What was tested, when and with what result, kept for every release. Your test lead sets the priorities and signs off each release. The agents take the repetitive writing and running, the judgement on risk stays with people. ###### Where the return comes from - **Defects caught earlier**: Problems found before release cost far less than problems found by customers. - **Faster releases**: Regression no longer waits for the time to run it. - **Less rework**: Requirements, tests and code stay aligned, so fewer changes are made twice. - **Testers on what matters**: Exploratory testing and risk analysis replace repetitive case writing. We measure your baseline before the 5-week pilot starts. The gains are then measured against it, on indicators agreed with you upfront. - Test data anonymised before use - Every generated test reviewed and versioned - No release approved without a named person Quality stops being the last step and becomes part of every step. ##### Security questionnaires answered, evidence ready Security & third-party risk Supplier questionnaires filled in by hand for each client, evidence scattered across drives, audit and pentest reports that take days to turn into an action plan. Agentic AI pre-fills security questionnaires from your policies and past answers, maps each piece of evidence to the controls of ISO 27001, NIS2 and CyberFundamentals, and summarises audit and pentest findings into a prioritised action plan. - Your own suppliers' questionnaires collected and assessed - Expiring certificates and evidence flagged in advance - A board-ready view of open findings and their owners Your security officer reviews and signs every answer and every risk decision. AI prepares the file, people take responsibility for it. ###### Proof of security, ready before anyone asks. Imagine answering a client's security questionnaire in an afternoon, with every answer backed by current evidence, and knowing which of your own suppliers puts you at risk. A major client sends a questionnaire with hundreds of questions. Your security officer searches old answers, chases colleagues for evidence and loses a week. A pentest report sits unread. A supplier's certificate expired months ago and nobody noticed. The agent has pre-filled the questionnaire from your policies and past answers, attached the evidence and marked the few questions that need a human answer. The pentest findings are summarised into a plan with owners. An alert says a supplier's certificate expires next month. - **Questionnaires pre-filled**: Answers drafted from your policies, past responses and current evidence. - **Evidence mapped to controls**: Documents linked to ISO 27001, NIS2 and CyberFundamentals requirements. - **Findings turned into plans**: Audit and pentest reports summarised, prioritised and assigned. - **Supplier risk followed**: Your suppliers' answers collected, compared and followed up. - **Nothing expires unseen**: Certificates, policies and evidence watched for their renewal dates. Your security officer validates every answer sent and every risk accepted. The agent assembles, the accountable person decides and signs. ###### Where the return comes from - **Deals unblocked**: Questionnaires answered quickly keep sales cycles moving. - **Audit readiness**: Evidence is current and mapped, audits take less preparation. - **Risk reduced**: Findings and supplier weaknesses are tracked to closure. - **Experts on defence**: Security people spend their time on protection, not on paperwork. We measure your baseline before the 5-week pilot starts. The gains are then measured against it, on indicators agreed with you upfront. - Security documentation stays in your environment - Every answer traced to its evidence - Nothing sent to a client without sign-off Security becomes something you can prove, at any time. ##### HR questions answered, paperwork done HR administration The same payroll and absence questions answered by hand every week, onboarding files assembled document by document, certificates typed one at a time. Agentic AI answers payroll, leave and absence questions from your HR system and policies, prepares onboarding paperwork and drafts certificates and standard documents in the employee's language. It handles administration only and never evaluates people. - Onboarding checklists that follow themselves up - Policy answers that always cite the current rule - Monthly HR administration report assembled on its own Your HR team reviews every answer and signs every document. Decisions about people stay entirely with people. ###### HR teams back on the human side of HR. Imagine an HR team that no longer spends its mornings answering the same questions, and where every new colleague's paperwork is ready before day one. The HR mailbox opens with dozens of questions: remaining leave, payslip details, a certificate for a bank. Two new joiners start Monday and their files are incomplete. Answers depend on who is in the office. Overnight, the agent prepared replies to the routine questions with the right figures from the HR system and the policy that applies. The two onboarding files are complete, with what is still missing flagged. The certificates wait for a signature. The team spends the morning with people. - **Questions answered**: Leave, absence and payroll questions answered from your HR system and policies. - **Onboarding prepared**: Contracts, forms and access requests assembled and followed up. - **Documents drafted**: Certificates and standard letters prepared in the right language. - **Policies always current**: Every answer cites the rule in force, not last year's version. - **Administration only**: No evaluation, ranking or monitoring of people, by design. Your HR team validates every answer and signs every document. Anything that concerns a person's situation or career is decided by people, and only by people. ###### Where the return comes from - **Time given back**: Routine questions and paperwork no longer fill the HR agenda. - **Fewer errors**: Answers come from the HR system and the current policy, not from memory. - **Better first days**: New colleagues start with complete files and working access. - **Consistent answers**: Everyone gets the same answer to the same question, in their language. We measure your baseline before the 5-week pilot starts. The gains are then measured against it, on indicators agreed with you upfront. - Personal data stays in your environment - No evaluation or monitoring of employees - Every document signed by a person Administration runs on its own, HR gets back to people. Tell us which process costs you the most time or worries you the most. We start there. Tell us about your process ### From one process to production, step by step. How we work We start with a single process, prove the value in real conditions, then scale what works. Step What you receive ##### Process diagnostic We map one process with the people who run it: where the time goes, where errors come from, which decisions must stay human. We also look at how the process and the roles around it will change. - A map of the process as it runs today - The tasks AI can take, and the decisions that stay with your people - A pilot scope, with success criteria agreed upfront ##### Pilot in real conditions 5 weeks In five weeks, the automation runs on your real data, with your team, inside your environment. No demo data. Your team uses it on real cases and their feedback shapes the next version. - A working automation used by your team - Results measured against the criteria agreed at the diagnostic - A clear decision: scale, adjust or stop ##### Move to production We bring the pilot up to production standards: security, access rights, error handling, documentation and support. Procedures are updated and the service is handed over to your team. - An automation integrated into your tools - Documentation and a trained team - A named owner for every step of the process ##### Adoption & change management We redesign the way of working with the people who run the process, so the new tool becomes their habit, not an extra step. - Redesigned process maps and working instructions - Clear roles and responsibilities, including who validates what - Training by role and internal champions in each team - A communication plan, post-launch support and adoption tracking ##### Measurement & governance We track what the automation delivers and what it costs, and review it with you at regular intervals. - A dashboard: time saved, volumes handled, errors, cost - A log of every decision taken with AI assistance - A list of the next processes worth automating ##### Find the process where AI pays off first. Most AI budgets are spent before anyone has measured where the time and the errors really are. The diagnostic gives leadership a fact-based starting point, a scope it can defend and success criteria agreed before a single line is built. - Short interviews with the people who run the process every day, and with the person accountable for it - A walk through the process as it really runs, including workarounds, spreadsheets and manual checks - A map of where the time goes, where errors come from and where information is retyped - A review of the systems and data involved: where they live, who owns them, what they can expose - A clear line between tasks AI can take and decisions that must stay with a person - A first view of the return: what improves, for whom, and how it will be measured The process owner, two or three people who run the process, and someone who knows the systems involved. A senior consultant who leads the diagnostic and an engineer who checks what the systems can actually support. - A map of the process as it runs today, with its pain points - The tasks AI can take, the decisions that stay human, and why - A pilot scope: what is in, what is out, which data and systems - Success criteria and a baseline measured before the pilot - A first estimate of the effort and of the return Launch the pilot on a defined scope, adjust the scope, or stop here with a clear picture of your process. Either way, nothing is built without your agreement. - No data leaves your environment during the diagnostic - Success criteria are fixed before the pilot, so results cannot be argued after the fact - Decisions that commit you are identified upfront and kept with a person One process, looked at closely, is worth more than ten ideas on a slide. ##### Five weeks to see it work on your real data. A demo proves nothing about your data, your exceptions or your teams. The pilot runs inside your environment, on real cases, with the people who will use it, so leadership decides on evidence rather than on promises. - Connection to the systems in scope, with dedicated identities and only the access rights the pilot needs - AI agents built for the tasks agreed at the diagnostic, with a person approving anything that commits you - Weekly sessions with your team: what works, what does not, what to adjust - Real cases processed side by side with the current way of working - Measurement against the baseline and the criteria agreed upfront - A final review with leadership: results, limits and what production would require The process owner as sponsor, the people who run the process as first users, and an IT contact for access. A lead who steers the pilot with you, and engineers who build and adjust the automation week after week. - A working automation used by your team on real cases - Results measured against the agreed criteria and baseline - A list of what needs to change before production - A production plan with its effort and its risks - A clear recommendation: scale, adjust or stop Move to production, extend the pilot to adjust it, or stop. The pilot is built so that each of these three answers is a good outcome for you. - The pilot runs on a defined scope, in your environment, with access you can revoke at any time - Nothing that commits you is sent, paid or signed without a person approving it - Every action of the agents is logged and can be reviewed In five weeks, you know. Not because we told you, because your team saw it. ##### From a pilot that works to a service you can rely on. Many pilots stop at the demo stage because nobody hardens them. Production is where security, continuity and ownership are settled, so the automation keeps delivering when the project team has moved on. - Security review: identities, access rights, secrets kept in a vault, network restrictions - Error handling and alerts, so an incident is spotted before users notice it - Integration into your tools and your support process - Documentation written for the people who will run it, not for the project - Training for users and for the team that supports them - A named owner for every step, and a handover your team signs off The future owner of the service, your IT and security teams, and the key users. Engineers who harden and integrate the automation, and a lead who organises the handover. - An automation integrated into your tools and your support - Security and access reviewed and documented - Monitoring and alerts in place - Documentation and a trained team - A named owner for every step of the process Run it with your own team, or let us run it with you. In both cases, you own the automation and its documentation. - Every access is checked against a refusal test, not only an approval test - Rollback is planned before the switch - No binding action without a named person, in production as in the pilot A pilot proves value. Production keeps it. ##### The tool works. Now your teams make it theirs. Most AI projects that fail do so after go-live: the automation runs, but nobody changes how they work. Adoption is where the return is won or lost, so we plan it as carefully as the technology. - New ways of working co-designed with the people who run the process, not imposed on them - Process maps, working instructions and decision rules updated to include the AI agents - Roles and responsibilities clarified: who supervises the agents, who validates what, who handles exceptions - Training by role, from the daily user to the manager who reads the results - Internal champions in each team, who relay questions and feedback - Where relevant, early dialogue with the works council and clear communication to every team concerned The process owner, team leads, the people who run the process every day, HR and, where relevant, employee representatives. A change lead who has run transformations before, and the engineers who built the automation, available to adjust it from team feedback. - Redesigned process maps and working instructions - A clear roles and responsibilities matrix, including who validates what - Training sessions and guides by role - A network of internal champions - A communication plan and post-launch support - Adoption indicators, reviewed with you Extend the new way of working to other teams or sites, or adjust it first where adoption is slower. - Nobody is asked to trust a tool they have not seen working on their own cases - Every change in responsibilities is written down before the switch - Feedback from the teams is collected and acted on, not filed Technology changes a process. People change how a company works. ##### Know what it delivers, what it costs, and what comes next. An automation that nobody measures is a cost line waiting to be cut. Measurement and governance show leadership the return month after month, keep control over every decision AI assists, and point to the next process worth automating. - A dashboard of time saved, volumes handled, errors and cost per process - A log of every proposal made by AI, who approved it and when - Regular reviews with you on results, incidents and adjustments - Model and cost choices revisited as better or cheaper options appear - Compliance checks against your policies, GDPR and the EU AI Act - A shortlist of the next processes, ranked by expected return The process owner, finance or controlling for the return, and compliance where relevant. A lead who runs the reviews and engineers who keep the automation and its costs in check. - A dashboard: time saved, volumes handled, errors, cost - A log of every decision taken with AI assistance - Review notes with the actions agreed - A ranked list of the next processes worth automating Extend Digital Intelligence to the next process, adjust what runs, or keep it as it is. The decision rests on measured results. - Costs are visible per process and per month, with no surprise invoice - Every AI-assisted decision can be explained to an auditor - Agentic automation stays within the rules you set Measured once, the return becomes your argument for the next step. ### What stays under your control Security & governance Digital Intelligence works inside your rules. You decide what AI may do, and you can check what it did. - **Secured access**: Each automation has its own identity and only the access rights it needs, revocable at any time. Secrets are kept in a vault, never in the code, and every automation is security tested before it goes live. - **Who validates what**: Every action that commits you, paying, signing, sending, deleting, waits for a named person to approve it. AI proposes, people decide. - **Your data in Europe**: Your data is hosted in European regions and not used to train public models. When an AI model runs outside Europe, it does so under zero data retention; where confidentiality requires it, models run in Europe or on infrastructure you control. - **Every decision traceable**: Each AI proposal is logged: what it saw, what it suggested, who approved it and when. You can answer an auditor at any time. - **Compliance from day one**: Before a project starts, we assess it against GDPR and the EU AI Act: risk class, transparency, human oversight and logging. Uses the AI Act treats as high-risk are flagged upfront, with the safeguards they require. - **Costs you can see**: AI usage is measured per process and per month. You know what each automation costs and what it returns. Models and tools are chosen case by case, including models hosted in your own environment. None is imposed. ### The expertise behind it Engineering Digital Intelligence rests on engineering we practise every day in production, on our own business first: agentic AI, where agents act within processes under human control. Here is what that means for you. - **Agentic AI and MCP**: Agents act inside your systems through the Model Context Protocol, the open standard that connects AI to business tools without a one-off integration each time. - **Multi-model orchestration**: Several model providers, EU-hosted where required, and open models run in your own environment: each task gets the model that does it best at the lowest cost, and no single vendor holds you hostage. - **Models in your environment**: Open-weight models run on infrastructure you control whenever the data must stay inside. - **Cost under control**: Prompt caching and per-call measurement keep the AI bill predictable, process by process. - **Document understanding**: Scanned PDFs, forms and letters read natively, including documents that carry no text layer at all. - **Zero-trust APIs on Azure**: API Management, Entra ID, OAuth and app roles: every caller is identified, every access is scoped and can be revoked. - **Full observability**: OpenTelemetry, Application Insights and Log Analytics: every agent action is logged, measured and alerted on. - **AI plus Power Automate**: AI models read and propose, Microsoft Power Automate workflows (Power Platform) move the work between systems, with Dataverse and Peppol connecting the agents to the processes your teams already run. ### We don't show mockups. We show what is running. Production grade. Our own business runs on the same architecture we deliver to clients. business conversations handled on our platform in the last 12 months Every AI output is a proposal, not a decision. #### Real systems. Not demos. 14 MCP servers and 239 API endpoints sit behind one gateway and one identity. Around 2,000 e-signature operations a month run through it, with no one pressing a button. actions our AI agents can perform across 14 MCP servers Live automation flows built across our environments of AI outputs that commit us are approved by a person first AI proposes, a named person decides. #### Road fines on our company fleet In our own house Fines arrive through the Justice eBox or as a local scan sent by email, and from there nobody has to chase them. AI reads each one and identifies the vehicle and its driver; Microsoft Power Automate runs the follow-up. For a federal fine, the declaration naming the driver is prepared within the 15-day legal window and a person confirms it. For a municipal or other fine, the driver is informed directly. a few cents AI cost per fine ##### A fine arrives. Nobody has to chase it. Every fine on our company fleet follows the same path, from the moment it reaches us to the moment it is handled. AI models read, Microsoft Power Automate workflows orchestrate, within the legal deadline. The two ways a fine comes in - **Through the Justice eBox**: Fines sent electronically by the authorities are picked up every morning, with no one having to open the mailbox. - **As a local scan**: A paper fine received at the office is scanned and sent by email. From there, it joins exactly the same path as the electronic ones. What happens next - **AI reads the fine**: The scanned document is read as it is, image included. The plate, the fine number and the official references are extracted into a strict, checked format. - **The vehicle is identified**: The plate is matched against our fleet register, whatever way it was written on the fine. - **The driver is found**: Fleet and HR records tell who was driving that vehicle on that date. - **The follow-up starts on its own**: A Microsoft Power Automate workflow opens the fine file and fills it in with every reference, so nothing has to be retyped. - **Declared or informed, depending on the fine**: For a federal fine, the declaration naming the driver is prepared for the authorities and a person confirms it, within the 15 days the law allows; the driver is not contacted by us. For a municipal or other fine, there is nothing to declare: the driver receives the fine and the next steps. - **Everything is recorded**: Each fine keeps its status and history. Contested fines are handled by a person. What it changes - **No fine forgotten in a drawer**: Electronic or paper, every fine enters the same path the day it arrives. - **Deadlines met**: The driver is identified within the legal window, without anyone watching the calendar. - **Time given back**: No more reading, retyping and searching for who had which car on which day. - **A few cents per fine**: That is the AI cost of reading one fine, measured on our own runs. Guardrails - If the AI cannot read a fine with certainty, the run stops before anything is written. - Every run is logged, so each fine can be traced from intake to the driver. - The document is read by the AI model under zero data retention: the provider never stores it. Our records stay in our environment, with access limited to the people who need them. Which of your processes still waits for someone to open an envelope? ### What changes for your business. Business impact ##### Time back for your teams The repetitive work moves to AI. Your people spend their time on the cases that need judgement. ##### Fewer errors, fewer re-entries Data is entered once and checked automatically, so mistakes are caught before they cost you. ##### Growth without the extra workload Volumes can rise without manual work rising with them, because your processes absorb the load. #### Let's architect your Digital Intelligence roadmap. A first 45-minute conversation about your Digital Intelligence maturity. No generic playbook: we look at where automation would actually pay off for you. ## Digital Intelligence: how we build it URL: https://www.keystone-solutions.be/en/ai-automation/how-we-build-it ### How we build it Back to Digital Intelligence Digital Intelligence Agentic AI, where agents act inside your processes, has to meet the standards of any production system: identified, secured, measured and accountable. This page sets out how we design it, without the jargon and without the secrets. #### Principles - **Process first, model second**: We start from a process and the decisions it carries, then choose where AI helps. The model is a component, never the strategy. - **A person for every binding act**: Paying, signing, sending, deleting: anything that commits you waits for a named person. Agents prepare, people decide. - **Nothing we cannot measure**: Quality, cost and time are measured from the first day, against a baseline taken before the pilot. - **Your data, your perimeter**: Data stays where your rules say it must, and the architecture lets you change model or provider without starting again. #### A reference architecture Every engagement adapts it, but the layers stay the same. Each one answers a question an auditor, a CISO or a CFO will ask. - **Your business systems**: ERP, CRM, document stores, mailboxes, line-of-business applications. They stay where they are. - **One gateway, one protocol**: Systems are exposed to agents through a single API gateway and the Model Context Protocol. A new agent reuses what exists instead of adding an integration. - **Agents with their own identity**: Each agent has its own identity and only the roles it needs. Every call can be traced to one agent and revoked without touching the others. - **A model gateway**: Calls go through a gateway that routes to several providers, or to open-weight models hosted in your environment, with caching and cost tracking on every call. - **Workflow orchestration**: AI models read and propose; Microsoft Power Automate workflows, part of Microsoft Power Platform, carry the work from one system to the next, with retries, approvals and a full run history. - **Human approval**: Binding actions stop at an approval step, with the context, the proposal and the reasons laid out for the person who decides. - **Observability across the stack**: Logs, metrics, traces and alerts cover every layer, so you see what each agent did, when, at what cost and with what result. #### Model strategy The right model is the cheapest one that holds the quality on your real data. - **Measured, not assumed**: Candidate models are compared on real documents and real cases, and run twice on the same input: stability matters as much as accuracy. - **Native document reading**: Scanned documents go to models that read the PDF itself. A model that cannot see the page must return nothing, never a guess. - **Prompt caching**: Stable instructions and reference material are placed first and cached, so repeated calls cost a fraction of the first. - **Plausibility before writing**: Any extraction that writes into a system passes a plausibility check first. An answer that does not fit stops the flow. #### Security by design Agents get access to systems that matter. Security is built in from the first line, then proven. - **Zero-trust APIs**: Every boundary validates the token, the issuer, the audience, the expiry and the role. Knowing a key is never enough. - **Least privilege**: One identity per trust boundary, roles scoped to the task, access reviewed and revocable. - **Secrets in a vault**: Keys and credentials live in a vault with rotation, never in code, logs or telemetry. - **Restricted networks**: Services only accept traffic from the gateway, so no one can go around the controls. - **Proof by the negative**: We test that what must be refused is refused. An access that works proves nothing about the restriction. #### Governance and compliance - **Every proposal traced**: What the agent saw, what it proposed, who approved it and when: the record answers an auditor at any time. - **EU AI Act upfront**: Each use case is classified before work starts. High-risk uses are flagged with the safeguards they require, or left aside. - **GDPR by default**: Personal data is minimised, kept in its perimeter and never sent where it does not need to go. - **Documentation that stays true**: Architecture, data flows and decisions are documented when they change, so the next person can take over. #### Running it - **Logs that persist**: Every service ships its logs and traces to a central workspace from day one. - **Alerts on what matters**: Error rates, latency, failed extractions and unusual cost trigger an alert before users notice. - **Cost per process**: AI spend is reported per process and per month, next to the time and errors it removes. - **Kill switch**: Every automation can be paused in one step, and resumes without losing work. #### From one process to production - **Diagnostic**: We map one process with the people who run it and agree the success criteria. - **Pilot in real conditions**: In five weeks the automation runs on your data, with your team, inside your environment. - **Production**: Security, access rights, monitoring, documentation and a named owner for every step. - **Adoption**: New ways of working co-designed with your teams: updated procedures, clear roles, training by role and internal champions. - **Measurement**: Results are compared with the baseline, then we choose the next process together. #### What we do not do - **No black boxes**: You can see what every agent does and why. Nothing runs that you cannot inspect. - **No tool sprawl**: One gateway, one way to connect, one place to measure. Each new agent makes the platform stronger, not more fragile. - **No binding act without a person**: An agent proposes. A named person decides anything that commits you. #### People first A tool that nobody adopts delivers nothing. Change management is built into the method, in step 4, and starts at the diagnostic. - **Processes redesigned with the people who run them**: New ways of working are co-designed with the teams on the ground, then written down as updated procedures. - **Who validates what**: Roles and responsibilities are set before go-live, including the person who approves every binding action. - **Training by role**: Each role learns what changes for it, with the AI literacy the AI Act expects from teams that use AI. - **Champions in each team**: Internal champions relay questions, collect feedback and help colleagues through the first weeks. - **Social dialogue early**: Where relevant, the works council and employee representatives are informed and consulted early, not at the end. - **Adoption tracked after launch**: Usage, feedback and results are followed after go-live, and the process is adjusted until it becomes the team's reflex. See step 4 of the method #### Your data in Europe Your data is hosted in European regions. When an AI model runs outside Europe, it runs under zero data retention: the provider stores nothing. When confidentiality requires it, we use models hosted in Europe or in your own environment. - **European hosting by default**: Applications, databases and documents are deployed in European cloud regions unless you decide otherwise. - **Zero retention outside Europe**: When a model runs outside Europe, the request is processed and forgotten: nothing is stored or used for training. - **EU or in-house models when it matters**: Confidential processes use models hosted in Europe or open models running in your own environment. #### AI Act by design The EU AI Act applies to the AI we build with you. We assess, prepare and document what it requires from the first workshop, without promising more than an assessment can prove. - **Risk classified upfront**: Every use case is assessed against the AI Act risk categories before work starts, and the result is documented. - **No prohibited practices**: We do not build systems that fall under the practices the AI Act prohibits. - **High-risk uses handled with care**: Uses such as employment decisions or creditworthiness are flagged and not deployed without the safeguards the regulation requires. - **Transparency for people**: When people interact with an AI system or receive AI-generated content, they are told so. - **Human oversight and logs**: A named person oversees each system, and its actions are logged so they can be explained afterwards. - **AI literacy for your teams**: The teams concerned are trained to use AI with judgement, an obligation that applies since February 2025. ## Applications URL: https://www.keystone-solutions.be/en/applications #### Software we built for ourselves. Ready for you. Applications Eight applications designed, built and run in-house at Keystone to take the repetitive work out of our own operations. Each one can now serve your organisation, configured for your teams and your tools. Built and run in-house at Keystone ##### Keystone Contracts Contract lifecycle Every contract, from first draft to renewal, in one place. Generate, sign, renew and index your staffing and subcontracting contracts without chasing documents. Contracts for consultants and subcontractors live in Word files, email threads, e-signature portals and the HR system. Renewals slip, indexation is calculated by hand, and nobody sees the margin of a contract at a glance. Operations and contracting leads in consulting and staffing firms. - Contract, framework agreement and annexes generated from your templates - Multi-party electronic signature - Subcontractors complete their own onboarding - AI reads contract PDFs and extracts the key terms - Renewals tracked and rates indexed automatically on the Agoria index - Margin and cost dashboards, plus yearly client satisfaction surveys Rates are visible only to the roles that need them, every change is logged, and the application speaks French, English and Dutch. It connects to your HR system, your Peppol invoicing, your e-signature tool and your applicant tracking system. Web application with a serverless back end, Microsoft Entra ID sign-in and group-based roles, data kept server side, AI calls through a secured model gateway. ##### Keystone Hours Time to invoice From signed timesheet to invoice, without re-keying. Timesheets approved by your clients and turned into invoices, with every blocker explained. Timesheets arrive as scanned PDFs, spreadsheets and emails. Someone re-keys the hours, chases the client signature, checks absences and creates the invoice, and a duplicate slips through now and then. Finance and administration teams of firms that bill by time spent. - Monthly entry, or upload of a scanned PDF or spreadsheet with the hours extracted by AI - Client approval through a secure signed link - An invoicing queue that explains every blocker and creates the invoice in your invoicing tool - Duplicate detection before anything is billed - Billed and purchased days reconciled for subcontractors - Absences cross-checked with the HR system Built as a work queue rather than a report: each line says what is missing and who must act. Guided tours and three languages make it usable from day one, and it pairs with Keystone Contracts to cover the whole path from contract to invoice. Web application with serverless functions, role-based access per user identity, every call audited, security scans in the delivery pipeline. ##### Keystone Support Copilot Agentic helpdesk Every request answered in its own language, faster, by your team. AI agents prepare the reply in your shared mailboxes. A person checks it and sends it. HR, fleet and accounting mailboxes fill up with repetitive questions whose answers sit in other tools. Teams spend their day searching instead of answering. Back-office and customer service leads who run shared helpdesk mailboxes. - A draft reply in the language of the sender - An internal note with sources, confidence and points to check - Facts fetched from your HR, invoicing and other business systems - Attachments read, scanned documents included - Whole workflows handled end to end, such as road fines on a company fleet - Nothing leaves without a person Replies are grounded in your own data rather than generic text, and a person stays in the loop for every message. Prompt caching keeps the cost per draft low. Containerised agent, tools exposed through the Model Context Protocol behind an identity-checked API gateway, leading language models with a fallback. ##### Parqube Workplace Office parking booking, without spreadsheets or messages. Employees book a spot for themselves or a visitor, managers handle the spots and follow usage. With hybrid work there are fewer spots than employees and nobody knows who is coming. Spreadsheets and group messages lose the spots released at the last minute, and visitors circle the building. Companies with fewer parking spots than employees, and the office and facility managers who run them. - Booking by the hour, for yourself or for a visitor (name and plate) - Car park view by level: free, partly booked or occupied - Standard, compact, accessible and EV charging spots - Recurring reservations over several days - Calendar file (.ics) for Outlook, Google or Apple Calendar - Spot management, blocks for works and usage statistics - Installable web app, in French, English, Dutch and German - Export of your data as JSON or CSV Who booked stays private: employees see a spot as taken, without a name or plate, and the masking happens on the server. Try it in a free demo with your own prefilled car park, no account needed. Software as a service hosted in the EU (Microsoft Azure, West Europe), data isolated per customer, no trackers. Directory and single sign-on, API, Teams and Outlook invitations, EV chargers and plate reading are integrations available on request. https://www.parqube.com/ https://demo.parqube.com/?lang=en https://www.parqube.com/pricing/ ##### Certificate Autopilot Managed service Your certificates renew themselves. Your APIs stay up. TLS certificates renewed automatically, so no service goes down because a certificate expired. A TLS certificate renewed by hand is a certificate that will expire one day. When it does, every API and webhook behind it stops at once. IT and DevOps leads running services on Microsoft Azure. - Daily automatic renewal with Let's Encrypt - DNS validation through a CNAME alias, even when DNS is hosted at Microsoft 365 - A dedicated vault for certificates - Versionless binding for API Management, App Service, Functions and Container Apps - Role-protected dashboard - Expiry alerts as a safety net Built on a proven open-source project. Keystone brings the integration, the hardening and the day-to-day operation: least privilege, no stored secrets, and checks that what must be refused is indeed refused. Azure Functions, Key Vault, Azure DNS, role-based access control and alerting. ##### Keystone Skills Skills management Know who knows what, to staff a request or build a project team in minutes. A live map of the skills in your team, kept up to date by the people themselves. When a client asks for a profile, or a project needs a team, knowing who can do what sits in a few heads and in outdated spreadsheets. Skill gaps only show up once the project has started. HR, sales and delivery leads of service companies, and project managers who need to build the right team. - Self-assessment of skills and levels - Team skill matrices - Search by skill and level - A shared skills catalogue, with requests for new entries - Profile pre-filled from the CV by an AI assistant - Three languages People own their profile and the AI only helps them fill it in: it never scores anyone. Every change is kept in an append-only log. Web application with serverless functions and a serverless database, Microsoft Entra ID sign-in. ##### Keystone Growth People development A yearly development cycle that people actually follow. Objectives, quarterly check-ins and 360° feedback in one guided process, from the first draft to the yearly review. Development plans live in spreadsheets and Word templates. Objectives are set in January and forgotten by March, check-ins depend on each manager's diligence, feedback is collected by email, and HR cannot see where each person stands in the cycle. HR leads and people managers in consulting, IT and professional services firms on Microsoft 365. - Objectives co-written by the employee and the manager, with weighting and approval - Quarterly check-in windows with comments, an Outlook meeting and the employee's sign-off - 360° feedback from colleagues, and from clients through a secure one-time link - Self-reflection and manager review to close the year - Team dashboard with reminders, so nobody falls behind in the cycle - HR console for populations, calendars, email templates and guidelines Built around a conversation between the employee and the manager rather than a form to fill in once a year. Every step and every change is logged, private manager notes stay private, and the tool speaks French, English and Dutch. People write every assessment: no algorithm scores anyone. Web application with a serverless back end, Microsoft Entra ID sign-in with group-based roles, a business workflow enforced server side, a full audit trail and a daily archive. ##### Keystone Hub Digital workplace One front door to every internal application. Each employee sees the applications they are entitled to and what needs their attention, on a single screen. Internal tools multiply: HR, helpdesk, parking, time tracking. Each has its own address and its own to-do list, so employees bookmark a dozen links, miss pending tasks, and send everyday requests by email because nobody knows where they belong. IT and operations leads in growing companies on Microsoft 365 that run several internal or home-made applications. - One sign-in, with the list of applications filtered by each person's rights - A personal dashboard showing pending actions from each application - Quick request forms, such as facilities requests, feedback or a business lead - Same look and navigation across every application - New applications plugged in without changing the existing ones - French, English and Dutch The Hub owns no business data: each application stays the authority on its own data and the Hub only shows what each person is entitled to see. It is the delivery model behind our other applications, so a new tool joins a workplace that already exists. Web portal with Microsoft Entra ID single sign-on and on-behalf-of calls to each application, a shared design system, and a modular architecture with clear boundaries enforced at build time. Pilot #### From contract to invoice Keystone Contracts and Keystone Hours work together: the contract defines what can be billed, and the approved timesheet becomes the invoice. #### AI connectors for Belgian SaaS Expertise We also connect AI assistants and agents to the tools Belgian companies run on: invoicing and Peppol, e-signature, HR systems and workflow tools. Through the Model Context Protocol, each agent gets its own identity and only the rights it needs. #### Software we built for ourselves. Ready for you. Applications Eight applications designed and run in-house at Keystone, now available to your organisation. ## Management Consulting URL: https://www.keystone-solutions.be/en/management-consulting ### Clear decisions. Change that lasts. We help leadership teams choose what matters, scope it properly and steer the change until your teams own it. The people who advise you are the people who stay for the delivery. #### Transformation has less room for error than ever Regulation is tightening, budgets are under scrutiny and skilled people are scarce. Every programme you launch competes for the same attention, money and talent. - **Regulation reaches the boardroom**: NIS2, DORA and the EU AI Act place accountability on management. They call for owners, decisions and evidence, well beyond an IT project. - **Too many priorities, too few people**: With the talent shortage, every initiative you start takes capacity from another. Choosing what not to do has become a leadership skill. - **Programmes that drift**: Vague scope, slow decisions, teams that never adopt the new way of working: that is where budgets quietly disappear. - **Project scoping**: Objectives, scope, risks and success criteria set before the start, so everyone is talking about the same project and knows when it is finished. - **Governance**: Bodies, roles and a decision rhythm suited to your organisation, without unnecessary committees. Each decision has an owner and a date. - **Programme management**: Tracking commitments, trade-offs and risks, with alerts raised early and a view that leadership can read in a few minutes. - **Change management**: Supporting the teams involved from the first day, so that the new way of working is actually used once the project is closed. #### What changes for you - **A portfolio you can defend**: Priorities ranked with the reasoning written down, so you can explain to your board why this project goes first and that one waits. - **Decisions that stay decided**: Trade-offs approved in writing by the right people, so they are not reopened at every steering committee. - **Change that is used**: Teams working the new way after we leave, because they helped shape it rather than having it imposed. - **Listen**: We start from your objectives and from what is blocking today, by talking to the people who do the work, not from a ready-made method. - **Decide**: We propose a reasoned order of priorities, say plainly what should stop, and have the trade-offs approved in writing. - **Support**: We stay through the execution and hand over to your teams step by step, until the result holds without us. #### Call us when... - Your project portfolio has grown faster than your capacity to deliver it - A strategic programme is late and nobody can say exactly why - NIS2, DORA or the AI Act require decisions your organisation has not yet taken - Steering committees meet often but rarely decide - A new system is live but your teams still work the old way ##### A consultant in your teams An experienced profile joins your organisation as programme manager, PMO lead or transformation lead, or steps in as interim CIO or head of infrastructure, works within your governance and passes the know-how on to your people. ##### A scoped assignment A scope, a deliverable and a deadline, under our responsibility: a scoping study, a governance model, a programme restart or a change plan. - **How are you different from a large consulting firm?**: Our consultants advise and then stay for the execution, so you work with the people who wrote the recommendations. We size the team to the problem, and we can call on our IT analysis, development, security and infrastructure practices when the plan turns into work. - **Can you help us prepare for NIS2, DORA or the EU AI Act?**: Yes, on the organisational side: who owns what, which decisions to take and in what order, and how to track progress. Our IT Security practice takes over for the technical work. Compliance remains your responsibility, and we help you build the path towards it. - **How quickly can a consultant start?**: It depends on the profile and the scope. At the first meeting, we tell you which profiles are available and when they can start. - **Where do you work?**: From Brussels, we work with enterprises and public institutions in Belgium, Luxembourg, France and the Netherlands. - **Can you provide an interim CIO or head of infrastructure?**: Yes. When a leadership role is vacant or a transformation needs a dedicated lead, a senior profile takes it on in your organisation, steers the teams and suppliers, and prepares the handover to a permanent appointment. A decision to make, a programme to put back on track? Tell us where things stand. We will tell you frankly where we would start. #### Expertise & technologies - Portfolio and programme governance - Change management - Digital Intelligence roadmaps - NIS2, DORA and EU AI Act readiness - ISO 27001 readiness - Process redesign - Architecture and vendor choices #### A digital programme that had become a catch-all, turned into a plan leadership can decide on Example from the field A mid-size industrial company had a digital programme that kept growing: a recent ERP, planning and maintenance tools, payroll, infrastructure, cybersecurity, collaboration tools and AI, with no single owner, several external vendors and teams already at capacity. Leadership needed a clear, costable picture in time for its strategic plan and the next budget. Keystone stepped in as interim CIO and orchestrator. What we did - Set a written scope before starting, signed with the order: a fixed envelope of sessions where one session can replace another but never be added, and a functional target rather than a technical one. - Ran a kick-off with the managing director to agree the people to meet, the calendar and the documents needed. - Gathered the information needs of the other partners already working with the company in one round, so the teams were never asked the same questions twice. - Delivered a short project brief within the week: calendar, people involved, confirmed scope, a sample interview guide and an internal announcement ready to send. - Interviewed every member of the leadership team, then key managers on site, with a visit of the shop floor. - Held a short weekly steering point with a written status, and a check on the main orientations before the final presentation, so that no conclusion would be a surprise on the day. What leadership received - A detailed as-is assessment of processes, applications, data and organisation - An executive summary for the leadership team - The opportunities identified, including AI use cases and applications to deploy - All delivered on schedule, ahead of the presentation to the leadership team What comes next Details anonymised ## IT Analysis URL: https://www.keystone-solutions.be/en/it-analysis ### Clarity first, code second Most IT projects that go wrong were unclear long before they were late. Our analysts turn business needs into requirements your teams can build, test and defend, in words both business and IT understand. #### A vague requirement is the most expensive line in the budget Budgets are under scrutiny, experienced profiles are scarce, and NIS2, DORA and the EU AI Act expect organisations to explain how their systems behave. There is less room than ever for building the wrong thing. - **Rework is a hidden cost**: A misunderstanding found in testing or in production is paid for twice: once to build it, once to undo it. - **Regulators ask why**: When an auditor asks what a system does and on which rule, traced requirements and dated decisions give you the answer. - **Knowledge walks out the door**: Business rules that live in a few heads or in legacy code turn every departure and every migration into a risk. - **Business analysis and process mapping**: Understanding the processes, the people involved and the rules in force, as close to the field as possible, and drawing the process as it really runs. - **Requirements**: Stating what the solution must do, with concrete examples rather than long descriptions, and separating what is essential from what is nice to have. - **Specifications**: Precise acceptance criteria that developers can implement, suppliers can quote on and tests can verify. - **Acceptance testing**: Checking with users that what is delivered matches what was expected, before it reaches production. #### What changes for you - **Decisions on solid ground**: Scope, priorities and trade-offs are set out in business terms, so you decide with the facts on the table. - **Fewer surprises at delivery**: The examples written at the start become the tests run at the end, so what is built matches what was agreed. - **A system you can explain**: To an auditor, a regulator or a new colleague: the reason behind each rule is written down and dated. - **Ask**: A missing business rule is a question to ask the people who own it, never an assumption to make on their behalf. - **Illustrate**: Every requirement rests on real, numbered examples that become the test cases, so business and IT read the same thing. - **Trace**: Every decision is written down and dated, so that later on everyone knows why the system does what it does. #### Call us when - A project is late and nobody agrees on what done means - Business and IT describe the same need in two different ways - You are replacing a legacy system whose rules nobody fully remembers - An audit or a NIS2 or DORA review asks how a process really works - Your developers are ready to build but the backlog is not ##### An analyst in your team A business analyst or product owner embedded in your organisation, your tools and your rituals, for as long as you need them. ##### A turnkey analysis phase A framed scope, a specification package and acceptance criteria, delivered ready for your developers or your supplier. - **Why pay for analysis when we could start building straight away?**: Because changing a sentence costs less than changing a system. Analysis moves the hard questions to the moment they are cheapest to answer. - **Do your analysts work in agile teams?**: Yes. They write user stories with acceptance criteria, refine the backlog with the team and can take the product owner role. The method follows your organisation, not the other way round. - **Can you analyse a system you did not build?**: It is a frequent case. We rebuild the business rules from the people, the documents and the existing behaviour, then write them down so they no longer depend on anyone's memory. - **How does analysis help with NIS2, DORA or the EU AI Act?**: These frameworks expect you to know and document how your processes and systems work. Traced requirements and dated decisions provide that documentation as part of the project. They support your compliance work, they do not replace legal or audit advice. A need that is still blurry? Let's put it in writing before the first line of code is written. #### Expertise & technologies - Business and functional analysis - Process mapping - Requirements and user stories - Acceptance criteria and test scenarios - Data and integration analysis - Peppol and e-invoicing flows - Power Platform and Dataverse - AI use-case scoping ## Software Engineering & Modernisation URL: https://www.keystone-solutions.be/en/it-development ### Rewrite the old. Build the new. Faster with AI, accountable in production. We rewrite legacy applications in a fraction of the usual effort, without a big bang: business rules extracted from the existing code, parity tests before the switch, old and new side by side. We quantify it after analysing your application and context. We also design, build and integrate your web and mobile applications, with AI speeding up the writing and tests deciding what reaches production. #### Software has become the bottleneck Across Belgium and Europe, experienced developers are scarce, ageing systems still carry the core of the business, and AI tools promise a speed that rarely survives an audit. Leaders need delivery that is both faster and defensible. - **Legacy that holds the business hostage**: The application that runs the core of the business is the one nobody dares to touch. AI-assisted rewriting finally makes replacing it a reasonable decision rather than a gamble. - **Too few hands, too many priorities**: Hiring senior developers takes months you do not have, while the roadmap keeps growing. - **AI code nobody can vouch for**: Generated code that is untested, undocumented or careless with data turns a gain in speed into a liability. - **Business applications**: Web and mobile tools built around how your teams really work, from internal portals to customer-facing apps, connected to the systems you already run. - **Integration**: APIs and data flows linking your applications, your ERP and your partners, with authentication, error handling and monitoring designed in from day one. - **Application rewrite and modernisation**: We read the existing code with AI, extract and document the business rules it really applies, write parity tests that prove the new system behaves like the old one, then run both side by side and switch over step by step. - **AI-augmented development**: AI accelerates the writing of code, tests and documentation. Specification, human review and automated checks keep control of the result, and your code and data stay within the limits you set. #### What changes for you - **A legacy exit you can plan**: The rewrite becomes a sequence of measured steps, each proven by tests, instead of a multi-year programme with a single risky go-live. - **Speed you can defend**: Shorter cycles from idea to production, with tests and documentation as evidence of what was built and why. - **Software you can take over**: Readable code, written specifications and up-to-date documentation, so your own teams can maintain the application, with or without us. - **Specify**: The need is written down and approved before the code, with acceptance criteria and a level of rigour proportional to the cost of an error. - **Test first**: Each criterion becomes an automated test. Whether a developer writes the code or AI assists, the work is done when the tests pass and an experienced developer has reviewed it. - **Deliver under control**: Every change goes through automated checks on quality, security and dependencies, and ships with its documentation. Progress is shown in working software. #### Call us when - A critical application is understood by only one person - Your roadmap outgrows the developers you can hire - Systems that should talk to each other still rely on manual exports - Your teams code with AI and you need rules that hold up - A legacy application is too critical to stop and too costly to keep ##### Developers in your teams Experienced developers join your teams, adopt your tools and rituals, and bring our way of working with AI: specify, test, review. ##### A turnkey project We take responsibility for delivery, from specification to go-live, with an agreed scope, clear milestones and a single point of contact. - **Is code written with AI safe to put into production?**: Only when it is treated like any other code. With us, AI assists the writing; every change is specified, covered by tests, reviewed by an experienced developer and checked for security before release. - **What happens to our source code and data when you use AI tools?**: We agree the rules with you before the first line: which tools are allowed, where data may be processed and what must never leave your environment. Your confidentiality and sovereignty requirements set the frame. - **Can you rewrite our legacy application without stopping the business?**: Yes, that is how we work. AI helps us read the old code and extract its business rules, which your experts validate. Parity tests are written before anything changes, the new and old systems run side by side, and users move over in stages, with a way back at every step. - **Will our teams be able to maintain what you build?**: That is the point of the method. Specifications, tests and documentation are delivered with the code, and we can organise a handover to your teams or continue supporting the application, as you prefer. An application to rewrite, build or connect? Tell us where it stands today. We will show you how to take it to production, and what it takes to keep it there. #### Expertise & technologies - React and TypeScript - Python - Node.js - Java - .NET / C# - Agentic AI and MCP - Multi-provider AI models, EU-hosted where required - Playwright and Vitest - CI/CD with GitHub Actions ## IT Security URL: https://www.keystone-solutions.be/en/it-security ### Security your board can stand behind NIS2 has made cybersecurity a management responsibility. We help you decide what to protect first, put the right controls in place and keep dated evidence that they work. #### Cybersecurity is now a board matter Since the Belgian NIS2 law came into force in October 2024, management bodies must approve security measures, oversee them and be trained. Financial entities also answer to DORA, while ransomware keeps looking for the weakest link. - **Accountability at the top**: Directors can be held liable when obligations are not met. They need a picture they can act on, not a technical report they cannot read. - **Deadlines that do not wait**: A significant incident must be flagged to the CCB within 24 hours. Who decides and who notifies is settled in advance, not on the night itself. - **Risk that arrives through suppliers**: Service providers, software and shared accounts are part of your attack surface, and NIS2 expects you to manage them as such. - **Risk analysis and awareness**: We map what is critical to your business, rank the threats, and train your staff to spot the phishing and fraud attempts aimed at them. - **Application security**: Authentication, access rights, secrets management and supplier integrations: sound practices built into your applications from the design stage. - **Regulatory support**: NIS2, CyberFundamentals, DORA, ISO 27001 readiness: we turn the texts into a prioritised plan, concrete measures and documented evidence. - **Verification**: We test that protections actually hold, including that what must be refused is refused, and we record each result with its date. #### What changes for your management - **A clear view for the board**: Risks ranked in business terms and decisions on record, so management can show it approved and oversaw the measures. - **Evidence ready before it is requested**: Policies, controls and test results filed and dated, ready for an auditor, an assessment body, a regulator or a client questionnaire. - **A team that knows what to do**: Roles, escalation and notification steps agreed in advance, so a serious incident is handled with method rather than improvised. - **Secure by default**: Everything is protected by default. Every exception is declared, justified and has a named owner. - **Early in the project**: Security checks happen before testing starts, when a fix costs a conversation rather than a rebuild. - **Proven and dated**: A control counts only once it has been verified. We document the evidence, so you can show it rather than assert it. #### Call us when - You are unsure whether NIS2 applies to you, or in which category - Your board is asking for a clear answer on cyber risk - A conformity assessment or ISO 27001 audit is coming up - A major client sends you a security questionnaire - You need a CISO, but not a full-time one ##### A security expert in your team A profile who strengthens your security team or secures your projects, up to a part-time CISO (CISO-as-a-Service) who reports to management and steers the programme. ##### A defined security assignment A gap analysis against NIS2, CyberFundamentals or ISO 27001, a prioritised action plan and its implementation, on an agreed scope with clear deliverables. - **Does NIS2 apply to my organisation?**: It depends on your sector and your size. We review the criteria with you and document the reasoning. Even outside its scope, clients who are covered may pass security requirements on to you as a supplier. - **Can Keystone certify us?**: No, and that is by design. Conformity assessments and certifications are carried out by bodies authorised for that purpose. Our role is to prepare you: measures in place, evidence in order, gaps closed before the assessor arrives. - **What does a part-time CISO actually do?**: Sets security priorities with management, steers the action plan, reports to the board, holds suppliers to account and acts as point of contact in a crisis. The time commitment is agreed with you and adjusted as your needs change. - **We are a financial entity. Do you cover DORA?**: Yes. DORA has applied since January 2025, with its own requirements on ICT risk, incident reporting, resilience testing and ICT third-party providers. We link them to your existing measures, so you run one programme rather than two. What would you show your board tomorrow? Let's review together what is protected, what is proven, and what is not yet. #### Expertise & technologies - Entra ID, OAuth/JWT and app roles - Zero-trust API gateways - Secrets in Azure Key Vault - Automated certificate management - Supply-chain checks in CI/CD - ISO 27001 readiness - NIS2 and CyberFundamentals - Negative testing of access controls ## IT Infrastructure URL: https://www.keystone-solutions.be/en/it-infrastructure ### Infrastructure that holds when it matters We design, automate and run your cloud and on-premise environments, so every release can be reproduced, every incident is spotted early and your costs stay readable. #### Infrastructure is now a board-level subject Cloud bills that drift, regulators asking about continuity under NIS2 and DORA, data that must stay in Europe and fewer engineers to share the load: infrastructure decisions now reach the executive table. - **Costs you can explain**: Cloud spend grows quietly through idle resources and oversized environments. Every euro should be traceable to a service and an owner. - **Continuity you can prove**: NIS2 and DORA ask you to demonstrate how you detect incidents and recover from them. A recovery plan that has never been tested is a hope. - **Sovereignty you can document**: Where your data lives, who can reach it and under which jurisdiction: clients, auditors and regulators now ask these questions in writing. - **Moves you can steer**: A data centre move or a cloud migration touches every application at once. Without an inventory, a dependency map and a rollback plan, one weekend can stop the business. - **Cloud and on-premise**: Environments sized for real usage, in the cloud, in your data centre or both, with costs and data location under control. - **Automation and infrastructure as code**: Environments described in code and deployed through pipelines, with no manual handling and no secrets left in scripts. - **Observability**: Logs, metrics and alerts in place from day one, to detect a problem before your users do. - **Operations, resilience and moves**: Day-to-day monitoring, updates, incident management, backups and recovery tests that are actually run, and data centre moves managed from inventory to cut-over. #### What changes for your organisation - **Fewer surprises in production**: Releases follow the same automated path every time, so a deployment stops being an event. - **A bill you can read**: Resources are tagged, sized and reviewed, so finance and IT discuss the same figures. - **Answers ready for the audit**: Architecture, access rights, backups and recovery procedures are documented, which is what a NIS2 or DORA review looks for. - **Automate**: What is repeated gets scripted, so every deployment is identical to the previous one and every environment can be rebuilt. - **Monitor**: An application without alerts is an application whose outages you learn about from your users. Alerts are set before go-live. - **Document**: Every environment is described and kept up to date, so anyone can take it over, starting with your own team. #### Call us when - Your cloud bill rises faster than your activity - Releases depend on one person and a checklist - An auditor asks for your recovery plan and its last test - Legacy servers run critical processes nobody dares to touch - Your team spends its days firefighting instead of improving - A data centre move or migration is coming and nobody owns the plan ##### An engineer in your teams A cloud, DevOps or systems engineer who joins your team, works with your tools and passes on what they set up. ##### A turnkey setup An environment, a deployment pipeline, a migration or monitoring, delivered, tested and documented, then handed over to your teams. - **Do you only work with public cloud?**: No. We work on public cloud, private cloud, on-premise and hybrid environments that combine them. The choice follows your constraints: cost, data location, regulation and the skills already in your team. - **Can you help us prepare for NIS2 or DORA?**: We handle the infrastructure side of these frameworks: backups, recovery tests, access control, monitoring and documentation. Legal interpretation stays with your compliance team or advisers. - **How do you keep our data in Europe?**: We choose EU regions and services, check where backups, logs and support access are located, and document it so you can answer your clients and auditors. - **What happens when the engagement ends?**: Everything we set up lives in your repositories and your accounts, described in code and documented. Your team can take it over without depending on us. - **Can you manage a data centre move?**: Yes. We build the inventory and the dependency map, plan the cut-over windows with your business, prepare and test the rollback, and coordinate the suppliers involved until the last system runs in its new home. Ready to make your infrastructure predictable? Tell us where it hurts today: costs, releases, outages or audits. We will look together at what to automate, monitor and document first. #### Expertise & technologies - Microsoft Azure - AWS - Container Apps and Functions - Docker and Kubernetes - Infrastructure as code - OpenTelemetry and Application Insights - Log Analytics and alerting - Let's Encrypt automation ## Why Keystone URL: https://www.keystone-solutions.be/en/about Key figures: 70+ experts, 350+ completed projects, revenue above EUR 7.5M, 91% client satisfaction (2025), a 70/30 diversity balance. ### Keystone Solutions A Brussels IT partner since 2014: the people, the figures and the commitments behind our work. ### A decade of building trust About Our Story Keystone Solutions was founded in 2014 in Brussels by Frédéric Dubois and Jean-Marc Heidingsfeld, with a clear belief: delivering enterprise-grade IT solutions can be both rigorously professional and deeply human. More than a decade on, that belief still guides us. Based in Brussels and active across Belgium, we have grown steadily by investing in lasting client relationships rather than scale for its own sake. Our clients know us. Our experts know their operations. We are deliberately not a global giant. We are a strategic local partner with senior expertise, short decision chains, and the agility to work at your rhythm. Large enough to handle complex enterprise assignments, focused enough to care about every single one. This approach has won the trust of major Belgian enterprises and turned first engagements into long-term partnerships. At Keystone Solutions, proximity is a practice. It's how we work. ### Three commitments before we start ##### Partnership-driven Approach We do not take on projects lightly. When we commit, we are fully dedicated, fully accountable, and fully invested in your success. ##### Enterprise-grade Standards & Security In a competitive landscape, quality sets us apart. We deliver solutions that are innovative, reliable, and built to last. ##### Scalable & Agile Delivery Rapid delivery without rigidity. We move quickly, adapt to change, and keep you ahead without compromising quality. ### Why we stand out A Unique Approach A Culture of Excellence ##### Forward-Thinking We embrace next-generation technologies and methodologies so our clients don't just keep up, they lead. ##### Client-Centric Every solution starts with your challenges, not our catalog. We tailor, we listen, and we build trust through results. ##### Built to Last No short-term fixes. Our solutions are built for longevity and adaptability, evolving with your business. ##### Diverse Expertise Our team brings varied backgrounds, perspectives, and specializations, enabling us to tackle complex architectural challenges with fresh thinking. ##### Continuous Innovation Our commitment to continuous development keeps our experts at the cutting edge, translating into sharper, more resilient solutions for your enterprise. ##### Transparent Partnership We operate with full transparency and integrity. No hidden agendas, no surprises: just an honest, reliable partnership. ## Careers URL: https://www.keystone-solutions.be/en/careers ### Where reliability meets excellence Accelerate your IT career with enterprise-scale projects. Keystone Solutions is a launchpad for IT professionals. Join a team of experts and work on high-impact missions for industry leaders in cybersecurity, hyperautomation and software engineering. ### What We Stand For ##### Synergy The whole is greater than the sum of its parts. By combining strengths and collaborating deeply, we achieve outcomes that none of us could deliver alone. ##### Transparency Trust is founded on honesty. We communicate clearly, share openly, and build lasting partnerships on genuine dialogue. ##### Ownership We take full responsibility for our work. We stand by our deliverables and see every engagement through to completion. ##### Noble Purpose Respect is non-negotiable. We value diversity of background and perspective, and we ensure every person is treated with dignity. ##### Excellence We hold ourselves to high standards and continuously improve. We aim to deliver better outcomes every day. ### Your growth matters to us all, we invest in it. At Keystone Solutions, your development is a strategic priority. Our Performance Development Process aligns your technical ambitions with our enterprise goals, providing a clear roadmap for your career progression. ##### Co-defining Objectives We start the year by establishing clear, co-created goals. It's about building a shared vision for your next 12 months of impact, going beyond standard KPIs to focus on real skill advancement. ##### Continuous Alignment Benefit from quarterly check-ins and ongoing mentorship with your People Manager. We address challenges early and adjust your trajectory year-round. ##### 360° Feedback Your impact is discussed through peer reviews, client feedback and self-assessment, so the picture of your work is transparent and fair. ##### Recognition The annual cycle ends with a transparent review of your technical achievements and client impact. It informs recognition and the next steps in your career. ### Work hard. Play together. A team that connects beyond deadlines is a team that delivers. The K-Club is our employee-run community think golf days, padel tournaments, team trips, and spontaneous after-works. No pressure, all good vibes. ### Elevate your expertise Calling top-tier IT professionals ready to build secure, scalable, and future-proof systems.