/SERVICES

The Challenge

Sweco needed to host their Meridian Enterprise platform in the cloud for a major international enterprise. The requirements were strict: enterprise-grade security, full GDPR compliance, and a managed services model that would let Sweco focus on the application layer while a specialized partner handled the infrastructure.

Their needs were clear from day one:

• Production-grade reliability. The Meridian platform is business-critical for the end customer's engineering documentation workflows. Any downtime directly impacts project delivery.
• Security-first architecture. The end customer required a vulnerability scan and penetration test before go-live, setting a high security bar from the start.
• Clear separation of responsibilities. Sweco handles the application (Meridian installation, configuration, database), NubeX handles the cloud infrastructure (compute, network, storage, identity, security).
• Cost-conscious operations. A separate acceptance environment needs to be available for upgrades and testing, but should cost virtually nothing when not in use.
• GDPR compliance. All data must reside in EU locations with encryption at rest and in transit.

The Solution

We designed and implemented a production-grade Azure environment from the ground up, with clear separation between production and non-production workloads, all managed through Terraform and protected by multiple layers of security.

Compute & Application Architecture

The Meridian stack runs across purpose-built Windows Server virtual machines, each sized to its specific role:

• Application servers (Meridian Enterprise) running on memory-optimized E-series VMs deployed across availability zones for production resilience
• Dedicated SQL Server on a compute-optimized instance with Premium SSD data disks for database-intensive workloads
• Document management servers with large Premium SSD data disks for engineering file storage
• Active Directory for centralized authentication across the environment
• Web servers hosting the Meridian web interface with automated certificate renewal

Every VM uses Azure's Automatic Patching by Platform, managed through environment-specific maintenance windows to ensure security patches are applied predictably without business disruption.

Security & Compliance

Security was a foundational requirement, validated through an independent penetration before go-live. The security posture has only strengthened since:

• Azure Key Vault
• Activity Log Alerts
• Subscription-level diagnostic logging
• Data encryption at rest and in transit across all components, meeting GDPR requirements for EU data residency.

Backup & Disaster Recovery

All production VMs are protected by Azure Recovery Services Vault with daily backups and 15-day retention. Production and non-production backups are stored in separate vaults, preventing accidental cross-environment operations.

Cost Optimization

Non-production VMs are automatically started at 7:00 AM and stopped at 8:00 PM on weekdays through Azure Automation runbooks. This eliminates unnecessary compute costs during evenings, nights, and weekends. A separate schedule ensures test VMs are started before and stopped after maintenance windows, so patching is never missed.

The automation uses environment tags for dynamic VM discovery, meaning new test VMs are automatically included without configuration changes.

Azure Reserved Instances are actively tracked with automated reservation expiration notifications delivered to Slack, ensuring cost commitments are reviewed before renewal deadlines.

Managed Services & Observability

NubeX provides full Cloud Platform Management following ITIL best practices:

• Proactive monitoring and alerting using Azure-native toolsets integrated with NubeX's centralized monitoring platform
• Monthly OS sanity checks including anti-virus verification and critical Windows patching
• Incident management with defined priority levels and Service Level Targets
• Service Desk for reactive support and change requests

A dedicated monitoring service principal provides read-only access to Azure metrics and logs, enabling proactive alerting and performance tracking without over-privileged access.

Conclusion

This partnership, now in its sixth year, demonstrates the value of a clear responsibility model: Sweco brings deep Meridian application expertise, NubeX brings cloud-native infrastructure knowledge. Together, we deliver a platform that meets the strict security, compliance, and reliability requirements of large international enterprises.

The result: a Meridian platform that runs reliably with automated patching, cost-optimized non-production environments, comprehensive security monitoring, and full infrastructure auditability through code.

Interested in professional Azure managed services for your application platform? Get in touch.

/INSIGHTS

Your trusted partner for Cloud Neutral Platform Managed Services