A European community platform, not built on US cloud
Most community apps you can name are a thin layer on top of a very large American cloud provider. Winposible is not. Here is exactly what runs where, and what that does and does not buy you.
What we actually run
Every part of Winposible runs on servers we rent directly from a European hosting provider:
- Web and API — our own machine, our own reverse proxy, our own TLS.
- Database and authentication — a self-hosted stack, not a managed service on someone else's platform.
- Media storage — European object storage, served through our own proxy so files never require a third-party domain to load.
- Voice relay — our own STUN and TURN servers. When two people in a voice room cannot connect directly, the audio relays through our machine, not a commercial WebRTC service.
- Email — our own mail server with SPF, DKIM and DMARC. Account emails do not pass through a third-party sending provider.
- Video processing — uploaded video is transcoded on our own server.
Why we did this
The honest first reason is cost. A solo-funded project cannot afford managed-everything pricing at scale, and the per-gigabyte economics of large clouds are brutal for a platform that stores video. Moving to our own hardware was a survival decision before it was a principled one.
The second reason follows from the first: every managed service you remove is one fewer company holding your users' data, one fewer vendor whose breach becomes your breach, and one fewer set of terms that can change under you. In 2026, when a third-party verification vendor's compromise exposed roughly 70,000 government ID images belonging to another platform's users, that stopped being an abstract argument.
What this does not mean
We would rather be precise than impressive:
- This is not end-to-end encryption. Messages are encrypted in transit and at rest, but we operate the servers and can technically access data. If your threat model requires that nobody — including us — can read your messages, use a dedicated E2E messenger instead. That is a legitimate requirement and we do not meet it.
- Our own infrastructure is not automatically more secure. Large cloud providers employ security teams we cannot match. What we get is fewer parties and full control, not superior engineering.
- We are not GDPR-certified. We follow the rules and keep data in Europe, but there is no certification badge here and we will not pretend otherwise.
- Company registration is in Türkiye, with infrastructure in the EU. If your organisation requires an EU-registered vendor specifically, we are not that today.
Who this is a good fit for
Communities that want distance from the large US platforms without running their own server; groups that care where their files physically sit; anyone who would rather deal with a small operator they can actually reach than a support form. If you need certifications, enterprise agreements or E2E encryption, there are better answers than us.