Our new website is live – and here’s how we built it

Of course, every agency thinks its own website is brilliant. We’re writing about it anyway – because this site shows how we build things when no one’s telling us what to do. Everything we recommend to businesses, public authorities and start-ups, we’ve implemented ourselves here. If you want to know what we mean by ‘digital sovereignty’: you’re using it right now.

A repo, a legal case, all in Europe

We could have set up the website in the traditional way: a headless CMS here, the front end there, with an API in between. But we didn’t. Next.js and the open-source CMS Payload run as a single application on our end – one repository, one process, nothing that needs to be maintained, secured or paid for separately. The whole thing runs as a container on our own servers with a German hosting provider. No Vercel, no US CDN. Even the fonts come from us, not from Google.

In terms of content, the site is a modular system: 28 building blocks from which our editorial team assembles pages – hero sections, process steps, comparison tables, key figures, case studies. A new page doesn’t require a ticket to be raised with the development team. And because we use it ourselves every day: content can also be managed internally via the Model Context Protocol, and Claude Code can read and edit pages directly. In production, this access is disabled by default.

No cookie banner. Really, there isn't one.

The first thing you might notice is something that’s missing. There’s no cookie banner – not because we’re hiding one, but because there’s nothing you need to consent to. Our visitor statistics are managed via a self-hosted open-source solution that doesn’t store anything on your device or read anything from it. As such, Section 25 of the TDDDG simply doesn’t apply.

Where we do actually need consent, we ask for it exactly where it’s required: directly at the embedded YouTube video or Spotify player. The content is only loaded once you’ve given your consent. And underpinning this, as a second layer of protection, is a strict content security policy that determines what can be loaded in the first place. For us, data protection isn’t just a banner. It’s built into the architecture.

A chatbot that can say ‘I don’t know’

In the bottom right-hand corner, there’s a chatbot powered by conduco AI. Its most important feature sounds rather unspectacular at first: it knows nothing – apart from what’s on this website. Every answer comes from a search through our own content. If something isn’t there, it tells you exactly that and suggests you contact us directly. No making things up, no beating about the bush. You don’t need an account, and we only track how conversations go – never what they’re about.

And in one instance, we made a conscious decision not to use AI

The website is available in German, English and Dutch. We’re based in Westmünsterland; the border is just a stone’s throw away – for us, that’s not something special, but simply part of everyday life.

Translation is carried out at the touch of a button using DeepL. Yes, you read that right: not using a language model. A specialised translation model is structurally incapable of inventing figures or making promises – a language model only adheres to the prompt for as long as the prompt itself lasts. In any case, nothing is saved until a human has looked at it. Of all people, us – the very ones who build and train generative AI? That’s precisely why. For us, AI is a question of tools, not a matter of faith.

A little anecdote by the way: without our glossary, ‘conduco’ would become ‘I lead’ in the English version. The word is Latin, and machine translation tools are thorough.

How we work

The website’s repository contains a written design and work contract, which serves as the basis for development. Colours are sourced exclusively from a central token file. Every animation must have a specific purpose. Each component is built first for smartphones, then for larger screens. If text is missing, we do not invent a placeholder, but ask for it. And before anything goes live, it undergoes a series of checks comprising type checking, static analysis and automated tests – from individual components right through to click paths in a real browser.

Does a company website really need all that? Probably not. But that’s just how we build them. We do the same for our own site as we do for our clients’ platforms.

Are you planning a website or platform and want to run it with confidence – without relying on the cloud, without a barrage of adverts, and with AI used only where it really helps? Get in touch. We’d be happy to show you what this could look like for your project.