Katholino: A modern childcare provider with secure cloud IT for thousands of staff
- Client: Katholino, the Archdiocese of Cologne’s new childcare provider (including service company)
- Sector: Education and social services
- Challenge: Setting up an independent IT infrastructure for a growing organisation (long-term target: 8,000 staff) – whilst meeting the highest data protection requirements and working to a tight schedule
- Solution: Greenfield approach based on modern cloud technologies, including Microsoft 365, Entra ID, a zero-trust security architecture, a robust data protection setup and centrally managed end devices for several hundred staff in childcare centres and administration
- Results: A self-sufficient, highly secure IT landscape; the productive launch of around 35 nursery schools within a few months; the deployment of several hundred end devices; personal tablets for educational staff; and digitised processes replacing paper – scalable to up to 500 nursery schools
Are you planning to spin off a business from your company?
Is your charity facing similar challenges? Please feel free to contact Christian Holtschneider, our project manager, at any time:
Challenge: A new operating body for over 500 childcare centres – and an IT system built from scratch
The Archdiocese of Cologne is responsible for over 500 childcare centres in North Rhine-Westphalia, which were previously organised across many smaller operating bodies. By establishing a central operator alongside a service company, the Archdiocese aimed to consolidate administration, improve efficiency and create a modern working environment. As a legally new organisation without existing systems, this presented an opportunity to build a modern, cloud-native IT landscape with ‘security by design’.
There were only a few weeks between the start of the architecture phase in November 2024 and the go-live in March 2025 – and by then, not only did the first pilot nurseries need to be operational, but, above all, the administration’s entire basic and core IT infrastructure had to be in place. Around 35 nurseries were to be up and running by 1 August. At the same time, it was necessary to rebuild all identities, authorisations, specialist processes and end devices from scratch. Data protection proved particularly challenging: the new operator uses specialist systems such as KiTaPLUS, which process sensitive data relating to children and their health that requires special protection – whilst, by design, no such data is processed within the Microsoft environment. These requirements had to be reconciled with the desire for modern cloud technology and digitised workstations.
All in all, the starting point was a complex one: a new organisation, an IT and operational structure that needed to be built from scratch, and a tightly scheduled roll-out – all with the aim of delivering a secure, scalable and practical IT system by the respective deadline.
Solution: Greenfield IT meets Zero Trust and Zero Touch
Following a brief architectural assessment, Comma Soft initially deployed an architect on-site and then quickly established its own dedicated team for the project. Working closely with Katholino, a complete greenfield IT landscape was thus created within a few months.
Foundation: Identities, Tenant and Security by Design:
At the heart of the new environment is a modern cloud infrastructure based on Microsoft 365 and Entra ID. This comprises an Identity & Access Management system, including the design of user creation and licensing models that take into account the organisation’s non-profit status, role and authorisation concepts for administrators, management and teaching staff, as well as clear access rules – designed so that the security architecture forms the first line of defence for all systems, even though particularly sensitive data relating to children and health is deliberately not processed in Microsoft 365. Under the new Zero-Trust architecture, access was, as a rule, permitted only via known, managed devices; threat detection was modernised and, in addition to a consistent
Foundation: Identities, Tenants and Security by Design:
At the heart of the new environment is a modern cloud infrastructure based on Microsoft 365 and Entra ID. This comprises an Identity & Access Management system, including the design of user provisioning and licensing models that take into account the organisation’s non-profit status, role and authorisation concepts for administrators, management and teaching staff, as well as clear access rules – designed so that the security architecture forms the first line of defence for all systems, even though particularly sensitive data relating to children and health is deliberately not processed in Microsoft 365. As part of the new zero-trust architecture, access was restricted in principle to known, managed devices only; threat detection was modernised and, alongside consistent multi-factor authentication, guest access was also reduced. As part of the new security and operational planning, the focus was then on administration concepts for sensitive tasks, preparations for the subsequent handover to an IT service provider, and the automation roadmap.
End devices and the modern workplace:
In parallel with the architecture, our team procured, set up and commissioned several hundred end devices in a short space of time – including laptops and monitors for the administration, as well as group laptops and personal tablets for teaching staff, and children’s tablets with educational software in the nurseries. What makes this special is that: All Windows and mobile devices are rolled out and hardened via a central device management system. Instead of ‘blank’ devices, a pre-configured Katholino image is used, which handles automated onboarding (‘zero-touch’), complies with all predefined security policies and comes with a standard app suite tailored to each role. A tedious manual set-up process for staff? Not necessary.
Keeping sensitive data secure in Germany:
Data protection was one of the most challenging aspects of the project, as the new organisation handles highly sensitive data relating to children, health and development, which falls under data protection categories 2 and 3 – in other words, information that requires particularly stringent protective measures due to its sensitive nature. To meet these requirements, a German data storage solution was introduced, in which all information requiring special protection is stored. Collaboration, standard data and Office processes continue to run via Microsoft 365, whilst sensitive content is processed exclusively in the German cloud storage or within the framework of other specialist systems – such as KiTaPLUS. At the same time, the entire Microsoft environment has been specifically hardened: telemetry and analytics functions that could transfer data to third countries have been deactivated, as have features that would use content for AI training. The nursery software itself has been integrated into the new identity and authorisation framework, enabling user roles and access to be precisely controlled – all whilst striking a balance between modern cloud usage and the consistent protection of particularly sensitive data. Overall, this has resulted in a data protection setup that capitalises on the advantages of modern cloud technologies whilst simultaneously meeting high regulatory expectations and addressing concerns regarding. The nursery software itself has been integrated into the new identity and access management framework, enabling user roles and access rights to be managed effectively – striking a balance between modern cloud usage and the rigorous protection of particularly sensitive data. Overall, this has resulted in a data protection setup that capitalises on the benefits of modern cloud technologies whilst meeting high regulatory standards and addressing concerns regarding US hyperscalers.
Go-live, rollout and handover to the provider:
The journey from an empty office to a fully operational nursery environment was short but intense. At the administrative site, our team first set up the entire basic infrastructure – including internet, Wi-Fi and workstations – whilst, at the same time, hundreds of end devices were being prepared and loaded with software. In the first rollout phase, around 35 childcare centres went live, with others following step by step. On site, we supported the teams with training to ensure staff could use the new devices and basic IT functions confidently. We designed the entire architecture so that the service provider can scale and professionalise it according to clearly defined patterns.
Results and benefits: Secure IT for today – scalable for 500 childcare centres of tomorrow
The benefits of the new IT landscape are already evident in the first phase of expansion:
- Self-sufficient, modern IT organisation: A fully autonomous infrastructure, technically independent of the Archdiocese of Cologne’s IT systems, including new identities, processes and specialist procedures.
- Scalable foundation for up to 8,000 staff: We have designed the architecture, security and operational concepts to accommodate full-scale deployment. They serve as the model for all other sites.
- Secure processing of sensitive data: Data protection-compliant design for children’s health, development and care data – particularly sensitive data is stored exclusively in the German cloud.
- Digital workspace for early years professionals: Personal tablets for early years practitioners; digital processes replace paper (e.g. for booking sessions); and devices are equipped with specifically allocated applications.
- Efficient roll-out: The go-live for around 35 childcare centres took just a few months – a rapid roll-out despite complex conditions.
The combination of modern cloud architecture, zero-trust security and rigorous data protection makes Katholino a flagship digital project in the social sector – and one of the organisations clearly leading the way in modern security architecture and cloud-native workplaces. This is also reflected in the feedback we have received from our client:
