Secure cloud IT for nursery providers

Katholino
Modern childcare provider with secure cloud IT for thousands of staff

At a glance

Client: Katholino, the Archdiocese of Cologne’s new childcare provider (including service company)
Sector: Education and social services
Challenge: Setting up an independent IT infrastructure for a growing organisation (long-term target: 8,000 staff) – whilst meeting the highest data protection requirements and working to a tight schedule
Solution: Greenfield approach based on modern cloud technologies, including Microsoft 365, Entra ID, a zero-trust security architecture, a robust data protection setup and centrally managed end devices for several hundred staff in childcare centres and administration
Results: A self-sufficient, highly secure IT landscape; the productive launch of around 35 nursery schools within a few months; the deployment of several hundred end devices; personal tablets for educational staff; and digitised processes replacing paper – scalable to up to 500 nursery schools

Are you planning to spin off a business from your company?

Is your charity facing similar challenges? Please feel free to contact Christian Holtschneider, our project manager, at any time:

Get in touch

Comma Soft Berater Christian Holtschneider

Challenge
A new operating body for over 500 childcare centres – and an IT system built from scratch

The Archdiocese of Cologne is responsible for over 500 childcare centres in North Rhine-Westphalia, which were previously organised across many smaller operating bodies. By establishing a central operator alongside a service company, the Archdiocese aimed to consolidate administration, improve efficiency and create a modern working environment. As a legally new organisation without existing systems, this presented the opportunity to build a modern, cloud-native IT landscape with ‘security by design’.

There were only a few weeks between the start of the architecture phase in November 2024 and the go-live in March 2025 – and by then, not only did the first pilot nurseries need to be operational, but, above all, the administration’s entire basic and core IT infrastructure had to be in place. Around 35 nurseries were due to be up and running by 1 August. At the same time, it was necessary to rebuild all identities, authorisations, specialist processes and end devices from scratch. Data protection proved particularly challenging: the new operator uses specialist systems such as KiTaPLUS, which process sensitive data relating to children and health that requires special protection – whilst, by design, no such data is processed within the Microsoft environment. These requirements had to be reconciled with the desire for modern cloud technology and digitised workstations.

All in all, this presented a complex starting point: a new organisation, an IT and operational structure that had to be built from scratch, and a tightly scheduled roll-out – all with the aim of providing secure, scalable and practical IT by the respective deadlines.

Approach
Greenfield IT meets Zero Trust and Zero Touch

Following a brief architectural assessment, Comma Soft initially deployed an architect on site and then quickly built up its own team for the project. Working closely with Katholino, a complete IT landscape was thus established from scratch within a few months.

At the heart of the new environment is a modern cloud infrastructure based on Microsoft 365 and Entra ID. This comprises an Identity & Access Management system, including the design of the user management system and licensing models that take into account the organisation’s non-profit status, as well as role and authorisation concepts for administrators, management and teaching staff, and clear access rules – all designed so that the security architecture forms the first line of defence for all systems, even though particularly sensitive data relating to children and health is deliberately not processed in Microsoft 365. As part of the new zero-trust architecture, access was, as a rule, restricted to known, managed devices; threat detection was modernised; and, alongside consistent multi-factor authentication, guest access was also reduced. As part of the new security and operational planning, the focus was then on administration concepts for sensitive tasks, preparations for the subsequent handover to an IT service provider, and the automation roadmap.
In parallel with the architecture, our team procured, set up and commissioned several hundred end devices in a short space of time – including laptops and monitors for the administration, as well as group laptops and personal tablets for teaching staff, and children’s tablets with educational software in the nurseries. What makes this special is that: All Windows and mobile devices are rolled out and hardened via a central device management system. Instead of ‘blank’ devices, a pre-configured Katholino image is used, which handles automated onboarding (‘zero-touch’), complies with all predefined security policies and comes with a standard app suite tailored to each role. A tedious manual set-up process for staff? Not necessary.
Data protection was one of the most challenging aspects of the project, as the new organisation handles highly sensitive data relating to children, health and development, which falls under data protection categories 2 and 3 – in other words, information that requires particularly stringent protective measures due to its sensitivity. To meet these requirements, a German data storage solution was introduced, in which all information requiring special protection is stored. Collaboration, standard data and Office processes continue to run via Microsoft 365, whilst sensitive content is processed exclusively in the German cloud storage or within the framework of other specialist systems – such as KiTaPLUS. At the same time, the entire Microsoft environment has been specifically hardened: telemetry and analytics functions that could transfer data to third countries have been deactivated, as have features that would use content for AI training. The nursery software itself has been integrated into the new identity and authorisation framework, enabling user roles and access to be managed effectively – all whilst striking a balance between modern cloud usage and the consistent protection of particularly sensitive data. Overall, this has resulted in a data protection setup that capitalises on the benefits of modern cloud technologies whilst simultaneously meeting high regulatory expectations and addressing concerns regarding US hyperscalers.
Der Weg vom leeren Büro zur produktiven Kita-Landschaft war kurz und intensiv. Am Verwaltungsstandort hat unser Team zunächst die komplette Basisinfrastruktur mit Internet, WLAN und Arbeitsplätzen aufgebaut, während parallel hunderte Endgeräte vorbereitet und mit Software bespielt wurden. In der ersten Rollout-Welle gingen rund 35 Kitas live, weitere folgten Schritt für Schritt. Vor Ort unterstützten wir die Teams mit Schulungen, damit Mitarbeitende die neuen Geräte und Grundfunktionen der IT sicher nutzen können. Die gesamte Architektur haben wir so gestaltet, dass der Dienstleister sie nach klar definierten Mustern skalieren und professionalisieren kann.

Results and benefits
Secure IT for today – scalable for 500 nurseries of tomorrow

The benefits of the new IT landscape are already evident in the first phase of expansion:

Self-sufficient, modern IT organisation: A fully autonomous infrastructure, technically independent of the Archdiocese of Cologne’s IT systems, including new identities, processes and specialist procedures.
Scalable foundation for up to 8,000 staff: We have designed the architecture, security and operational concepts to accommodate full-scale deployment. These serve as the model for all other sites.
Secure processing of sensitive data: Data protection-compliant design for children’s health, development and care data – particularly sensitive data is stored exclusively in the German cloud.
Digital workspace for educational staff: Personal tablets for nursery staff; digital processes replace paper (e.g. for booking sessions) and devices are equipped with specifically allocated applications.
Efficient implementation: The go-live for around 35 nurseries took just a few months – a rapid roll-out despite complex conditions.

The combination of modern cloud architecture, zero-trust security and rigorous data protection makes Katholino a flagship digital project in the social sector – and one of the organisations clearly leading the way in modern security architecture and cloud-native workplaces. This is also reflected in the feedback we have received from our client:

Carl von Wedel, IT Programme Manager, Archdiocese of Cologne:

For us as an archdiocese, it was crucial that the new provider be operational from day one – with a modern, secure IT system that reliably protects the most sensitive data and is scalable in the long term.

Danyel Zirbes, Head of IT, Katholino:

Comma Soft has managed to set up a completely new, self-sufficient infrastructure in a very short space of time – including a security and data protection framework that meets our high standards.

Agnes Busch, Managing Director, Katholino:

With the new IT infrastructure, we can finally provide our nurseries with the modern tools they deserve – without compromising on data protection and security.