COSUP
Composable Open Source University Platform
Universities should own their digital infrastructure.
Not rent it. Not hope it stays available. Own it.
The cost of not owning
your infrastructure
Capital Cloud
Universities pay $100–150 per user, per year to a handful of hyperscalers. A medium-sized institution spends $1.5 million or more annually on SaaS licenses1EDUCAUSE Core Data Service, 2022Central IT spending ranges from 2.6% to 8.0% of total institutional expenditures depending on institution type. Cloud and SaaS licensing represents an estimated 20–30% of central IT budgets.Derivation: ~$150/student × 10,000 students ≈ $1.5M/year.educause.edu — Analytics Services it does not own, cannot audit, and cannot leave. Cloud has become a capital extraction mechanism disguised as a service.
The CLOUD Act
Since 2018, United States law grants American authorities extraterritorial access to data stored by US companies2CLOUD Act — Pub.L. 115–141, Div. V, 2018Signed into law March 23, 2018. Requires providers to comply with data requests "regardless of whether such communication, record, or other information is located within or outside the United States."congress.gov — H.R.4943 — even on European soil. Student records, research data, financial information: all reachable without the institution's knowledge or consent. Sovereignty is not a feature you can purchase from the vendor that undermines it.
Digital Inequity
The same SaaS stack that costs a wealthy European university €2 million per year3EDUCAUSE Core Data Service, 2022Universities spend 2.6–8.0% of institutional budgets on IT. For a large European institution (15,000+ students, €50M+ budget), the SaaS portion ranges from €1.5M–€3.5M annually by region.Estimate based on EDUCAUSE CDS spending ratios applied to European institution budgets.educause.edu — Analytics Services is entirely unaffordable for institutions in the Global South. The current model creates a two-tier system: universities that can afford vendor platforms, and those left behind. Education technology should not reproduce economic inequality.
Fragmentation
Fifteen or more disconnected SaaS products4Productiv, State of SaaS, 2024The average enterprise SaaS portfolio comprises 342 applications. Individual teams use 60–80 apps on average. Higher education institutions typically manage dozens of core cloud systems."Fifteen or more" is a conservative lower bound based on enterprise data.productiv.com — SaaS Statistics, each with its own identity system, billing cycle, and data silo. No unified search. No shared automation. No coherent student experience. Integration is the university's problem — never the vendor's.
Total Cost of Ownership
An illustrative 5-year comparison for 10,000 users: Microsoft 365 licensing at ~€6/user/month totals €4.05 million including staff and training5Chapter 25 — True Cost of Ownership (COSUP Book)Illustrative comparison: Microsoft 365 €4,050,000 vs COSUP €750,000 over 5 years for 10,000 users. Microsoft 365 A1 for Education is free. Actual costs vary significantly by institution size, negotiated academic contracts, and deployment model.Derivation: €6/user/month × 10,000 users × 60 months = €3.6M licensing.. Universities spend 2.6–8.0% of institutional budgets on IT, with SaaS licensing consuming 20–30% of central IT budgets6EDUCAUSE Core Data Service, 2022Central IT spending ranges from 2.6% to 8.0% of total institutional expenditures. Cloud and SaaS licensing represents an estimated 20–30% of central IT budgets.educause.edu — Analytics Services. Vendors can raise prices unilaterally. With self-hosted infrastructure, cost is under your control. This is not a guarantee — it is a starting point for your own analysis.
What if you built it yourself?
COSUP is a composable, fully open-source platform that gives universities complete ownership of their digital infrastructure.
It integrates learning, collaboration, administration, communication, payments, artificial intelligence, and security into a single coherent system — designed to work together from the start.
It is self-hosted. The university's data stays on the university's servers, under the university's jurisdiction.
It is modular. Institutions choose what they need and replace what they outgrow.
It is reproducible. Every instance is identical, auditable, and version-controlled.
Licensed under the GNU GPLv3 — free as in freedom, forever.
COSUP is a proof of concept — with 192 automated tests, self-healing monitoring, and active production hardening. We build in the open.
What COSUP replaces
Every capability below is open-source, self-hosted, and integrated under a single identity system.
Built on the shoulders
of open source
We don't reinvent. We compose. Every component is a mature, community-driven project — and COSUP connects them into one platform.
Learning
Content
AI
Serverless
Identity & Security
Payments
Communication
Five layers between the internet
and your data
Defense in depth. Every layer assumes the one above it has been compromised.
Machine-learning firewall. Blocks injection attacks, cross-site scripting, and zero-day exploits before they reach any application.
Every connection encrypted (TLS). Strict security headers enforced. Each request authenticated and routed through a single controlled entry point.
Unified authentication across every service. Role-based access — student, instructor, administrator — enforced at the gateway, not the application.
Every password generated, rotated, and distributed automatically. No hardcoded credentials. No shared spreadsheets. No human in the loop.
Four isolated network tiers. User-facing applications cannot reach the data layer directly. Internal databases have zero internet access — inbound or outbound.
Your student records, research data, and institutional files sit behind five independent security layers — on servers you own, in a jurisdiction you control. No cloud provider. No foreign subpoena. No back doors.
Built for institutions
that believe in ownership
Public Universities
Reclaiming digital sovereignty. Running your own infrastructure means your data, your rules, your jurisdiction.
The Global South
World-class infrastructure at zero licensing cost. Education technology should be accessible to every institution, not just wealthy ones.
Research Universities
GDPR and data-residency compliance without compromise. Sensitive research data never leaves your servers.
Public Good Advocates
Any institution that believes education infrastructure should be a public good — not a subscription.
One command. Entire university.
A single script detects your environment, generates credentials, provisions 70 services, and runs health checks — in minutes, not months.
Full deployment demo — coming soon
70 services. 1 platform. 0 vendor lock-in.
Start here
COSUP is open source. Explore the code, read the documentation, join the conversation.