Reduce daily context switching
Users can move from dashboard to mail, calendar, contacts, tasks, files, and archive without leaving the same work surface.
Vianordis--:--:-- UTCVianordis / ED. 02 / 2026
§ 07 — App support
Workplace
One sovereign workspace for the work people actually repeat every day.
Workplace brings mail, calendar, contacts, tasks, files, archive search, and Ask Workplace into one Continuum interface. It keeps the familiar protocols organizations already run, but wraps them in shared identity, tenant context, EU-resident infrastructure, and an optional Bicameral assistant.
01 — Problem
Workplace data is split across too many tools and jurisdictions.
Most organizations run mail, calendar, contacts, files, tasks, chat, and compliance search as separate surfaces. Users lose time switching context, administrators must secure several identity paths, and regulated teams still need to prove where communications, files, and AI processing happen.
- Mail, calendars, contacts, files, and tasks live in separate interfaces even though users treat them as one workflow.
- US platform suites create procurement and legal concerns for European organizations that need stronger data-sovereignty posture.
- Calendar and contact data often depends on proprietary sync layers instead of open CalDAV and CardDAV standards.
- Communication archive and eDiscovery workflows are usually separate add-ons with their own permissions, exports, and search behavior.
- AI assistants can blur the boundary between private human communication, governed data access, and model execution.
02 — Solution
Workplace v2 keeps the protocols, but gives users one governed shell.
The application is a Next.js 15 and React 19 workspace built on the Continuum design system. It signs users in through the platform Keycloak realm, preserves the access token for backend protocol clients, and exposes daily work through a single shell with dashboard, mail, calendar, contacts, tasks, files, archive, settings, and AI entry points.
- Mail uses authenticated API routes that connect to Dovecot IMAP and SMTP with the user's Keycloak-derived XOAUTH2 session.
- Calendar and contacts use CalDAV and CardDAV clients against sabre/dav-compatible services, keeping portability and standards visible.
- Files connect to DAM APIs with bearer-token access for upload, download, delete, metadata, and file-type handling.
- Ask Workplace and the floating assistant route through governed application APIs and Bicameral rather than bypassing tenant identity.
03 — Benefits
Give users one place to work without hiding operational boundaries.
Workplace consolidates common work patterns while preserving explicit backend responsibilities for identity, protocols, files, archive, and AI.
Use open collaboration protocols
IMAP, SMTP, CalDAV, and CardDAV keep mail, scheduling, and address-book behavior portable and inspectable.
Keep identity central
Keycloak and the shared @gsc/auth package provide token refresh, issuer validation, single sign-on, sid capture, and back-channel logout support.
Make archive part of work
eDiscovery search, semantic search, saved searches, export preparation, PII warnings, retention metadata, and legal hold indicators live beside daily communication.
Add AI deliberately
Ask Workplace renders structured views for mail, calendar, contacts, and navigation, while the optional H2A assistant is hidden unless tenant AI entitlement is present.
Operate it as a platform app
The Kubernetes deployment includes readiness and liveness checks, non-root containers, rolling updates, resource limits, and least-privilege CI deploy rights.
04 — How it works
From sign-in to daily work in three layers.
- 01
Authenticate once
Users sign in through Keycloak. The session keeps the access token and identity claims needed by mail, calendar, contacts, DAM, and assistant calls.
- 02
Work through the Continuum shell
The shell exposes Dashboard, Ask Workplace, Mail, Calendar, Contacts, Tasks, Files, Archive, and Settings with a consistent navigation and account model.
- 03
Call the right backend
Workplace routes each action to the proper service: IMAP/SMTP for mail, CalDAV/CardDAV for groupware, DAM for files, archive APIs for eDiscovery, and Bicameral for assistant sessions.
05 — Features
What Workplace v2 provides.
Dashboard and quick actions
Show recent mail, upcoming events, contacts, pending task count, system status, and shortcuts for composing mail, creating events, adding contacts, and creating tasks.
Mail client
Browse folders, read messages, compose and send mail, save drafts, mark read or unread, star messages, delete, move, and inspect attachments.
Calendar
Display monthly views, create events, manage all-day events, choose event types, toggle calendars, inspect upcoming events, and delete events through CalDAV.
Contacts
Search CardDAV address books, filter contacts, switch grid and list views, inspect rich profiles, use tags and favorites, and create contacts through the API.
Files
List DAM assets, upload files, download documents, delete assets, show file categories, sizes, and modified dates, and use tenant bearer-token access.
Archive and eDiscovery
Search archived email, toggle semantic search, use filters and facets, save searches, select records, create exports, and expose role-aware archive metadata.
Tasks
Track work in board, list, or grid views with status, priority, assignees, tags, due dates, progress, comments, and project filters.
Ask Workplace
Use a deterministic GenUI endpoint to ask for unread mail, calendar events, contacts, or navigation and receive structured tables or actions.
06 — Architecture
Architecture and operating model.
Workplace v2 is a Next.js application deployed as a Kubernetes service, with explicit integrations for identity, data protocols, archive, files, assistant routing, and database-backed meeting state.
- Next.js 15, React 19, TypeScript, and @gsc/continuum provide the browser application, shell, forms, tables, cards, GenUI console, and floating chat launcher.
- NextAuth v5 through @gsc/auth connects to the gosecCloud Keycloak realm and preserves platform claims such as tenant, customer, subject, roles, access token, and id token.
- Mail API routes use Dovecot IMAP and SMTP clients with XOAUTH2 tokens from the user session.
- Calendar and contact API routes use tsdav clients for CalDAV and CardDAV access, with iCalendar and vCard parsing and creation logic.
- File views call DAM APIs for asset listing, upload, download, delete, and metadata handling.
- Archive views call archive APIs for role, preferences, search, semantic search, saved searches, labels, exports, AI summaries, and attachments.
- Assistant resolution decodes tenant AI entitlement from the access token and routes H2A sessions through gscBicameral when enabled.
- PostgreSQL schemas cover workplace meeting schedules, invitations, preferences, templates, calendar connections, recent meetings, notes, and notification queue records.
07 — Use cases
Where Workplace fits.
Sovereign daily productivity
Replace fragmented mail, calendar, contacts, files, and task surfaces with one EU-operated workspace.
Regulated communication
Give legal, compliance, and audit teams archive search, semantic search, saved searches, exports, PII indicators, and legal hold visibility.
Open-protocol groupware
Operate mail, calendars, and contacts on IMAP, SMTP, CalDAV, and CardDAV instead of proprietary synchronization layers.
AI-assisted workspace navigation
Let users ask for inbox, calendar, contacts, archive, tasks, or files views while keeping AI entitlement and tenant context explicit.
Platform consolidation
Connect Workplace to DAM, Archive, Bicameral, Keycloak, PostgreSQL, and Meet-related scheduling data under one tenant-aware application.
Public sector and regulated enterprises
Serve organizations that need daily collaboration tools without handing core communication workflows to non-European platform jurisdiction.
08 — Integrations
Connects the services behind daily work.
Workplace intentionally keeps its backend boundaries visible so each data domain can use the right protocol, service, and governance model.
Keycloak
Keeps access tied to organization accounts, roles, and sign-in policy.
@gsc/auth
Shows how this service fits into the wider Vianordis environment instead of standing alone.
FreeIPA / LDAP
Shows how this service fits into the wider Vianordis environment instead of standing alone.
Dovecot IMAP
Connects communication records so messages can be used in the governed workflow.
SMTP
Connects communication records so messages can be used in the governed workflow.
sabre/dav CalDAV
Connects scheduling data so time, meetings, and availability stay part of the workflow.
sabre/dav CardDAV
Connects address-book data so people and organizations remain visible in context.
DAM API
Lets approved systems connect without ad hoc exports or manual copy-paste.
Archive API
Lets approved systems connect without ad hoc exports or manual copy-paste.
gscBicameral
Shows how this service fits into the wider Vianordis environment instead of standing alone.
AI Hub provider routing
Shows how this service fits into the wider Vianordis environment instead of standing alone.
PostgreSQL
Stores structured service records in a controlled tenant-aware backend.
Meet rooms
Shows how this service fits into the wider Vianordis environment instead of standing alone.
Kubernetes
Shows how this service fits into the wider Vianordis environment instead of standing alone.
Continuum UI
Shows how this service fits into the wider Vianordis environment instead of standing alone.
Zabbix-ready health checks
Shows how this service fits into the wider Vianordis environment instead of standing alone.
09 — Trust
Security, sovereignty, and operational trust.
Workplace is designed as a tenant-aware application in the same platform model as the rest of Vianordis: central identity, explicit service boundaries, EU infrastructure, and role-aware access to sensitive workflows.
Identity
Keycloak OIDC, token refresh, issuer validation, session claims, and back-channel logout are handled through the shared auth package.
Tenant context
User, tenant, customer, and role claims are carried in the session and used by downstream service calls.
Protocol transparency
Mail, calendar, and contacts use IMAP/SMTP, CalDAV, and CardDAV rather than opaque vendor-only APIs.
AI gating
The assistant is hidden unless tenant AI entitlement is present, and H2A messages route through Bicameral.
Deployment posture
The Kubernetes deployment uses two replicas, rolling updates, probes, resource limits, non-root execution, and read-only root filesystem settings.
Compliance workflow
Archive roles govern search, semantic search, AI analysis, legal hold visibility, retention information, and export capability.
10 — Pricing
Use the published Workplace rate or scope a sovereign rollout.
Workplace is sold as a daily workspace service. Pricing depends on user count, archive and eDiscovery requirements, AI enablement, file storage needs, migration scope, and whether the deployment is managed, dedicated, hybrid, or on-premises.
11 — FAQ
Questions technical buyers usually ask.
Is Workplace only email, calendar, and contacts?
No. Workplace v2 includes mail, calendar, contacts, tasks, files, archive/eDiscovery, settings, Ask Workplace, and optional Bicameral assistant integration.
Which protocols does it use?
Mail uses IMAP and SMTP. Calendars use CalDAV. Contacts use CardDAV. Files use DAM APIs, and archive workflows use the archive service API.
How does sign-in work?
Users authenticate through Keycloak using the shared @gsc/auth package. The session carries the access token and tenant claims used by backend service calls.
Does Workplace include AI?
Yes, when enabled for the tenant. Ask Workplace can produce structured workspace views, and the floating assistant routes H2A sessions through gscBicameral.
Can it support eDiscovery?
Yes. The archive module supports full-text and semantic search, saved searches, selection, export preparation, PII indicators, retention metadata, and legal hold visibility depending on role.
Is the app deployed as a platform service?
Yes. The inspected v2 deployment defines a Kubernetes deployment and service for workplace-ui with readiness/liveness probes, rolling update strategy, and least-privilege CI deployment permissions.
12 — Next step
Bring daily work, archive evidence, and AI assistance into one sovereign shell.
See how Workplace can consolidate communication, scheduling, contacts, files, tasks, archive search, and assistant workflows without abandoning open protocols or European infrastructure control.