Capabilities
What we use, and why.
This is the actual stack across our portfolio — not a wish list. Every entry is in production on at least one Keltus project. Click the book icon on any row for a plain-English explanation of what it is and why it matters.
Frontend
Static-first, hand-crafted UI. We pick the framework that fits the product, not the trend.
| Technology | What we use it for | On | More info |
|---|---|---|---|
| Astro | Static-first site framework. Pages pre-built to HTML, zero JS unless we explicitly ship it. |
| |
| React | The dominant framework for interactive web apps. Always with TypeScript. |
| |
| TypeScript | JavaScript with type-checking. Catches a class of bugs at compile time. |
| |
| Tailwind CSS | Composable design tokens — build consistent UIs from a fixed palette. |
| |
| Vite | Dev server + bundler. ~10× faster feedback loop than the previous generation. |
| |
| Tiptap | Headless rich-text editor with server-side allow-list validation. |
| |
| TanStack Query | Handles caching, refetching, and retries for server data. |
|
Backend
High-throughput services in Go, with Node for tooling and PHP where the ecosystem fits.
| Technology | What we use it for | On | More info |
|---|---|---|---|
| Go | Google's language for high-traffic servers. Single-binary deploys, predictable performance. |
| |
| Node.js + Express | JavaScript on the server. Useful when one language spans the stack. |
| |
| PHP 8 | Modern PHP — fast, clean, and the right tool when editorial tooling already exists for it. |
| |
| Python | The universal glue language for scraping, scripts, and data extraction. |
| |
| Directus 11 | Headless CMS where editors log in to manage content. |
| |
| chi (Go router) | Composable HTTP router for Go services. Nested groups, middleware, the good parts. |
|
Mobile
Native iOS and Android — not React Native compromises.
| Technology | What we use it for | On | More info |
|---|---|---|---|
| Swift + SwiftUI | Native iOS — smoother animations, real platform conventions, full API access. |
| |
| Kotlin + Jetpack Compose | Native Android with the modern declarative UI framework. |
| |
| WebRTC | Peer-to-peer voice and video — Google Meet, Discord, Zoom all use it. |
|
Data & Search
Storage, search, and caching tuned to each workload.
| Technology | What we use it for | On | More info |
|---|---|---|---|
| MariaDB | Battle-tested relational database. Used by Wikipedia and Google. |
| |
| PostgreSQL | The other major relational DB — stronger for JSON, geo, and complex queries. |
| |
| Meilisearch | Typo-tolerant full-text search with sub-100ms responses. |
| |
| Pagefind | Build-time search index that runs entirely in the visitor's browser. |
| |
| Redis | In-memory cache and queue. Microsecond response, not millisecond. |
|
Security & Crypto
Post-quantum-ready crypto, modern auth, defense-in-depth — built in, not bolted on.
| Technology | What we use it for | On | More info |
|---|---|---|---|
| CRYSTALS-Dilithium | NIST-standardized post-quantum signature scheme. |
| |
| SPHINCS+ | Post-quantum signature scheme as a backup to Dilithium — different math. |
| |
| Signal Protocol | The crypto behind Signal, WhatsApp, and any genuinely E2E messenger. |
| |
| X25519 ECDH | Modern elliptic-curve key exchange for per-device session keys. |
| |
| AES-256-GCM | Modern symmetric encryption with built-in tamper detection. |
| |
| ECDSA P-256 | Digital signatures for device identity, generated in hardware where possible. |
| |
| RSA Blind Signatures | RFC 9474 — sign something without seeing what you signed. |
| |
| Merkle Trees | Tamper-evident summaries of huge datasets. Bitcoin and Git use them. |
| |
| WebAuthn / Passkeys | Phishing-resistant passwordless auth. The default on every new project. |
| |
| Argon2id | Current OWASP-recommended password hashing. Memory-hard against GPU cracking. |
| |
| TOTP 2FA | The six-digit code in your Authenticator app. Backup factor for passkeys. |
| |
| mTLS | Mutual TLS — both ends of the connection prove identity, not just the server. |
| |
| Android Keystore + BouncyCastle | Hardware-isolated keys + the crypto library for algorithms Android does not ship. |
|
AI / ML
Self-hosted models for sensitive data, cloud models when the workload justifies it, and custom personalities that know your business.
| Technology | What we use it for | On | More info |
|---|---|---|---|
| Ollama (self-hosted) | Open-source AI models running on your own GPU. Nothing leaves the box. |
| |
| Anthropic Claude | Anthropic's hosted reasoning model. What we reach for when the workload justifies it. |
| |
| Custom AI personalities | A bot that knows your brand voice, your rules, and what it must not say. |
| |
| Corporate knowledge (RAG) | AI that answers questions about YOUR documents, not just general knowledge. | — | |
| Pluggable LLM layer | Provider interface in code — swap Ollama → Claude → OpenAI without rewriting. |
| |
| Tesseract OCR | Reads text from images and PDFs. Runs locally, no cloud call needed. |
|
Infrastructure
Self-hosted, monitored, fast to deploy. No surprise vendor lock-in.
| Technology | What we use it for | On | More info |
|---|---|---|---|
| nginx | Web server in front of nearly every modern site. TLS, caching, reverse proxy. |
| |
| Let's Encrypt | Free, auto-renewing HTTPS certificates. The padlock in your browser. |
| |
| Cloudflare | Global edge cache + DDoS protection. Sits between visitors and origin. |
| |
| systemd | Linux's service supervisor. Starts services on boot, restarts on crash. |
| |
| sharp + WebP/AVIF | Image pipeline. Generates responsive variants in modern formats at build time. |
| |
| FFmpeg | The swiss-army knife of video and audio. Twitch and YouTube run on it. |
| |
| GeoLite2 / MaxMind | Offline IP-to-location database. No external lookup needed. |
| |
| Brevo (transactional email) | Outbound email that actually reaches the inbox. Deliverability is the hard part. |
|