Platform

1. Specification

The platform layer is where sovereignty is cheapest. Linux, PostgreSQL, Kubernetes and the major languages are already open, foundation-governed and run by UK operators. The evidence nonetheless finds proprietary platform lock-in in the layers above them (key finding 5): the managed service wraps the open component in a proprietary API. The profile is about keeping the open component reachable.

2. Layer profile

Id	Criterion	Standard
PL-1	The operating system and runtime are open source under foundation or community governance.	Linux; Open Container Initiative images
PL-2	Databases expose the upstream open interface, not a proprietary superset the application comes to depend on.	PostgreSQL wire protocol and SQL standard; documented extension list
PL-3	Workloads are described declaratively and run unchanged on another conformant platform.	Kubernetes conformance
PL-4	Storage formats are open and readable outside the product.	POSIX file systems; open object storage API
PL-5	Build and deployment use open tooling the buyer can run itself.	Open build systems; infrastructure as code
PL-6	Languages and frameworks are governed by a foundation or standards body.	ECMA, ISO, the Python Software Foundation, the Rust Foundation and their peers

Already adopted in UK government

No Open Standards Board profile covers operating systems, databases or runtimes (Open standards for government). The de facto position is strong: Linux, PostgreSQL and Kubernetes are already run across government, usually inside a managed service. The profile asks that the open component stays reachable, not that anything new is adopted.

3. Open-source solutions that meet the profile

Not yet assessed. Candidates: Debian and Ubuntu, PostgreSQL, Kubernetes distributions, OpenTofu.

4. Public services implementing the standard

Not yet recorded.

5. Skills and horizon

Horizon 1 onward. Platform engineers and database administrators able to run the open components rather than rent the managed wrapper. See the roadmap.

What this section rests on 36 findings

Every published finding in the Body of Knowledge for the layers this section covers. The Handbook recommends; the Findings show where we are. Open any row in the Stack Playground to see its sources.

Published findings for the layers covered by Platform
Finding	Organisation	Product	Vendor	Owner country	Index
BBC-019	BBC	MPEG-DASH streaming format with BBC-maintained dash.js fork (web and connected TV playback)	DASH Industry Forum / BBC fork	Open source (community)	82 · Sovereign
BBC-020	BBC	Time Addressable Media Store (TAMS) open spec for cloud media production	BBC R&D (spec); AWS (open-source implementation)	United Kingdom	88 · Sovereign
BBC-021	BBC	Amazon Redshift data warehouse (audience analytics) with S3 data lake	Amazon Web Services	United States	33 · Dependent
BBC-022	BBC	Snowflake (live editorial dashboards fed from Piano Analytics)	Snowflake	United States	33 · Dependent
BBC-023	BBC	Redis (caching/queueing in web stack); historic MySQL	Redis Ltd / OSS community; Oracle (MySQL)	Open source (community)	87 · Sovereign
BBC-024	BBC	React + Node.js server-side rendering (WebCore; Simorgh for World Service sites)	Meta (React); OpenJS Foundation (Node.js)	Open source (community)	82 · Sovereign
BBC-025	BBC	AWS Lambda serverless compute (page rendering)	Amazon Web Services	United States	30 · Dependent
BBC-026	BBC	Unified Origin dynamic packaging for iPlayer (Video Factory)	Unified Streaming	Australia	44 · Dependent
BBC-027	BBC	JavaScript/TypeScript (Node.js) - dominant language for BBC Online and open-source repos	OSS community	Open source (community)	82 · Sovereign
BBC-028	BBC	Java, Python and Scala (data platform, APIs, R&D media tooling)	OSS community; Oracle (Java)	Open source (community)	82 · Sovereign
BBC-029	BBC	GitHub Copilot (AI coding assistant) and GitHub hosting	Microsoft (GitHub)	United States	45 · Dependent
BBC-030	BBC	Nginx-based in-house Global Traffic Manager (front door for BBC Online)	F5 (Nginx) / BBC in-house	United States	85 · Sovereign
BBC-031	BBC	CDNs for BBC Online and iPlayer (Akamai, Fastly; BBC in-house caching)	Akamai; Fastly	United States	33 · Dependent
DEF-026	Defence	Apple iOS/iPadOS on MoD-issued iPhones and iPads (MODNET mobile; Chat-MoD available on them)	Apple	United States	30 · Dependent
DEF-029	Defence	Pega low-code platform for RAF and Royal Navy recruitment (applicant support and reporting)	Pegasystems	United States	23 · Exposed
DEF-030	Defence	Automation Garage: Blue Prism robotic process automation and Microsoft Power Platform (Capgemini support)	Blue Prism (SS&C); Microsoft; Capgemini	United States	39 · Dependent
DEV-004	Devolved Governments	SCOTS shared desktop and network service (Microsoft software, run by SG iTECS)	Microsoft (software); SG iTECS (operator)	United States	24 · Exposed
DEV-014	Devolved Governments	OutSystems low-code platform for benefits case management, portals and apps	OutSystems (via Softcat; Deloitte configuration partner)	Unknown	14 · Exposed
DEV-043	Devolved Governments	EventStoreDB (event-sourced store for health timeline) on Azure DevOps	Event Store	United Kingdom	84 · Sovereign
DEV-059	Devolved Governments	Drupal open-source CMS professional services	Drupal (community) - contractor not named	Open source (community)	93 · Sovereign
GOV-029	Central Government	VMware vSphere virtualisation (Broadcom)	Broadcom (VMware)	United States	42 · Dependent
HE-017	Higher Education	Microsoft Windows 10/11 desktop and Windows Server (Microsoft EES licensing)	Microsoft	United States	36 · Dependent
HE-026	Higher Education	Oracle Java SE (Jisc sector agreement)	Oracle	United States	45 · Dependent
LG-013	Local Government	ChromeOS / Google-first desktop estate	Google	United States	33 · Dependent
LG-015	Local Government	SAP HANA database under SAP S/4HANA (migrated from ECC Oct 2025)	SAP	Germany	48 · Dependent
NHS-011	NHS	Microsoft Windows 10/11 Enterprise desktops (licensed via national Microsoft agreement)	Microsoft	United States	28 · Dependent
NHS-013	NHS	NHS App on iOS and Android	Apple; Google	United States	26 · Dependent
NHS-017	NHS	Oracle Database / E-Business Suite under ESR and NHSBSA systems	Oracle	United States	47 · Dependent
NHS-019	NHS	Amazon DynamoDB / Aurora (NHS login and cloud-native Spine services)	Amazon Web Services	United States	23 · Exposed
POL-017	Policing	Windows 10/11 desktop OS (under Microsoft 365 E3 + E5 Security EA)	Microsoft	United States	33 · Dependent
POL-018	Policing	Android mobile OS on officer handsets	Google (Android) / Samsung	United States	35 · Dependent
POL-020	Policing	Software AG database on the PNC mainframe (Adabas family)	Software AG	United States	33 · Dependent
POL-021	Policing	Microsoft SQL Server (server licences under force EA)	Microsoft	United States	52 · Partly sovereign
POL-022	Policing	Microsoft Power Platform automation and AI agents (Microsoft-funded programme via Ingentive)	Microsoft (Ingentive delivery)	United States	29 · Dependent
SCH-018	Schools	PostgreSQL (Oak National Academy platform)	PostgreSQL Global Development Group	Open source (community)	78 · Sovereign
SCH-020	Schools	Next.js / React (Oak National Academy and modern edtech SaaS)	Vercel; Meta	United States	74 · Partly sovereign

Change this section

The recommendations in this section are made by The Sovereign Stack Consortium, now forming.

Sections are Markdown in a public repository. Propose a change as a pull request, or open a discussion first. Contributions are reviewed by the section's maintainers under the Handbook governance. Text is licensed CC BY 4.0.