ALVPHA Upstream takes on inventory, SBOM, triage, lifecycle, security processes and upstream delivery for public IT and software landscapes — as an external, contractually defined function.
Procuring or deploying open source is only the first step. In day-to-day operations, questions arise that often have no clear owner:
ALVPHA Upstream takes on exactly this operational gap.
All three layers are part of the service and build on one another: transparency as the base, operations on top of it, upstream delivery as the highest tier.
E1 captures the estate: inventory, SBOM and licence status across the landscape — the basis of all evidence.
We can commit to our own processes and handling times. We do not guarantee: community response times, maintainer reactions, acceptance of a pull request, a merge, or external release dates.
Transparency across OSS components, SBOM capability, lifecycle and governance risks, plus a prioritised 90-day action plan.
An operational pilot for monitoring, triage, lifecycle, support and defined upstream processes.
Extended operational OSS delivery with security triage, patch/contribution management and auditable evidence.
The reference scope describes the typical extent of each package. Price and final scope are defined individually and documented in writing before commissioning. No artificial splitting of contracts.
Detailed service descriptions are available on request — via the contact form or directly by email. REQUEST SERVICE DESCRIPTION →
For public contracts at the German federal level, direct commissioning can in principle be possible.
For supplies and services, a negotiated procedure without a call for competition can be possible.
For innovative services from young start-ups, further simplified procurement options can be relevant.
The thresholds stated refer to German federal procurement. Their applicability in a specific case is assessed by the respective contracting authority. The same rules do not automatically apply to German federal states, municipalities, public enterprises and other institutions. Contracts must not be artificially split.
The specific service window is defined in each individual offer.
Matching your specific system and repository landscape against the reference scope.
Subject matter, price, duration, data protection/security and points of contact.
Access, responsibilities, governance and escalation paths.
Execution, status, technical work and traceable results.
No. The focus is on operational responsibility: inventory, triage, lifecycle, support, security processes and upstream delivery.
No. Internal teams keep product and system responsibility. ALVPHA takes on the clearly delimited OSS operations scope.
No. We exclusively guarantee our own processes and services.
Not automatically. The simplifications mentioned refer to procurement at the German federal level. Other contracting authorities must review their own procurement framework.
Individually. Price and final scope are defined in writing before commissioning, based on the scope check. The reference scope describes the typical frame of each package.
No. We make technical determinations on components, licences and processes, but do not replace individual legal advice.
Briefly describe your organisation, system landscape, open-source stack and current need for action. We will assess which standardised package fits.
