How IT security "Made in Germany" comes to life

84 percent of German IT decision-makers believe that government agencies and critical infrastructure should prioritize European software. At the same time, only about 20 percent of companies actually use European cybersecurity solutions (source: Myra report "State of Digital Sovereignty 2025").

This is not a contradiction I observe in others; it is a structural problem I know well because I constantly hold myself to the same standard.

I have been advising companies, corporations, and government agencies on IT security for over 25 years. Our positioning at agilimo is clear: IT security made in Germany. For us, this is not a marketing claim, but a stance with concrete consequences for which solutions we recommend and which we use ourselves.

This article is about one of those consequences: our decision to choose ZEP as our project time tracking system. And about why this decision has more to do with integrity than with software selection.

Made in Germany – Ambition and Practice

What we recommend to our clients applies to us as well.

The geopolitical debate surrounding digital sovereignty has grown louder in recent years—and rightly so. US laws like the CLOUD Act require US providers to hand over data to US authorities, regardless of whether that data is stored on European servers. This is not an abstract threat; it is a structural risk that affects companies and government agencies processing sensitive data.

For us at agilimo , this debate is nothing new. We aligned our consulting philosophy with data sovereignty early on: no compromises on the origin of security solutions, and no dependencies on providers operating outside of European law.

However, this also means we must apply the same standards internally that we advocate externally. Anyone who advises clients on digital independence but relies on US cloud tools for project billing, communication, or time tracking has a credibility problem.

I do not want to have that credibility problem.

Project business requires more than just trust

In project business, transparency is what determines trust.

agilimo operates using two billing models: time and material, and fixed-price projects. In both models, there is one question that every client asks sooner or later, sometimes openly, sometimes between the lines: "How can I verify what was actually delivered?"

That is a legitimate question. And the only reliable answer to it is not a statement of trust, but transparency through data. Clients commissioning IT security projects are often making significant investments. They no longer expect blind trust; they expect proof. Structured performance records, clear project statuses, and traceable billing. This is not a sign of distrust toward us as a service provider. It is professional project management on the client side. And I respect that.

This is precisely where the core benefit of accurate project time trackinglies: not just knowing internally what was achieved, but being able to provide the client with complete and verifiable proof. This strengthens the client relationship more sustainably than any list of references.

Why we use ZEP instead of another solution

A decision we have not regretted.

When we systematically addressed the topic of project time tracking a few years ago, the market offered a wide range of options. International all-in-one solutions embedded in US cloud ecosystems would have been technically capable. We chose ZEP anyway, for the same reasons we advise our clients to use German and European security solutions:

1. Data sovereignty without compromise. ZEP is a German product, data is stored in Germany, and GDPR compliance is not a matter of interpretation, but the standard. For us, that is non-negotiable.
2. Project time tracking as a core competency. ZEP Operationsis not an add-on module from a generalist, but a specialized software that does exactly what we need: record project times precisely, analyze them, and prepare them for billing. Without any detours.
3. A reliable partner, not a hyperscaler. I value working with companies that take responsibility for their product and are accessible—not ones where you get lost in a support ticket system.

How we use ZEP at agilimo

I’ll describe three scenarios from our everyday life at agilimo. Textbook examples? Not here! Because this is how we really work:

Scenario 1: Time and material billing

For projects that we bill based on effort, our consultants log their hours directly to work packages in ZEP Operations. The result is a performance report that we can hand over to the client without any editorial effort: who spent how much time on which work package and when.

That sounds like a given. But it isn't; at least not when you're working with Excel spreadsheets or poorly configured general-purpose tools. The quality of your performance reports determines whether a client approves an invoice without comment or starts asking questions.

Scenario 2: Fixed-price projects and profitability control

For fixed-price projects, project time tracking is not a billing tool, but a management instrument. We continuously compare actual hours against the planned target hours. If a project is at risk of going off track—if the actual effort exceeds the estimate—it becomes visible early on, not just during the final review.

This gives us the opportunity to react proactively: by adjusting the scope, seeking a conversation with the client, or reallocating internal resources. And the post-calculation from completed projects flows directly into the calculation of future proposals. This makes our proposals more realistic and protects our margins.

Scenario 3: Utilization, capacity, and planning

We are a growing consulting firm. The questions that occupy our leadership team every day are: Who is available? Where are the bottlenecks? Which projects can we take on without jeopardizing ongoing ones?

The KPIs from ZEP—utilization rates, availability, hours worked per team and project—are the foundation for this. Not gut feeling, but reliable data.

Transparency as a hallmark of quality

What our clients get out of it: clarity instead of blind trust.

I want to return to the point I made at the beginning. Transparency is not a service extra that we kindly offer our clients. It is the foundation of a professional service relationship, especially in a field like IT security consulting, where the work performed is often not immediately visible.

Through ZEP, our clients receive structured reports on hours worked, project progress, and budget consumption. This creates accountability on both sides: no surprises in billing, no unexplained service items, and no loss of trust due to unclear documentation.

The result is a client relationship based on proven performance, not just good intentions. That is the difference between a service provider and a reliable partner.

Conclusion

Integrity starts internally.

I began this article by noting that most companies demand digital sovereignty for others but apply different standards internally. That is not an accusation—IT migrations are complex, and existing systems are not replaced without good reason.

But I believe that integrity in consulting means sticking to your own principles even when it would be more convenient to make an exception. For us, the decision to use ZEP was not a major strategic pivot. It was a logical answer to the question: Do you practice what you preach?

For us, ZEP is a reliable tool that accurately maps our projects, provides our clients with solid evidence, and gives our internal planning processes a sound data basis. And it is a German product, which makes it agilimo the right choice.

Marcus Heinrich

CEO & Founder, agilimo Consulting GmbH