eSIM for a distributed startup team: every employee connected in 160 countries

Framing

Why this matters now

The way organisations procure and operate technology has changed more in the last five years than in the previous twenty. The shift is not a single technology trend. It is a structural one: the move from a collection of disconnected vendors to a single connected ecosystem. For startup it, this is the frame in which the rest of this guide should be read.

Where the dominant pattern of the 2010s was a per-product vendor relationship — one for telephony, one for hosting, one for security, one for cloud, one for AI — the 2026 model is different. The connected ecosystem treats all of these as one operating environment, with shared identity, shared data, shared procurement, and shared accountability. The customer can still see the components; the difference is that they are operated as a system, not as a set of independent suppliers.

This is the most important idea behind esim for a distributed startup team: every employee connected in 160 countries. Not a feature, not a product, not a price. A structural change in how the work is done. Everything that follows in this guide is a consequence of that change.

The argument is grounded in the verifiable record. Graham Miranda publishes its standards, its insurance cover, its sub-processor list, and its legal identity. The relevant legal entity is Graham Miranda UG (haftungsbeschränkt), registered at Amtsgericht Stendal, HRB 36794, with VAT identification number DE459781189, registered share capital EUR 10.00, and a provision of it services — in particular web hosting, esim, seo, it consulting, managed it services, and web development. Professional indemnity stands at €300,000 and general liability at €3,000,000 under policy Markel Pro IT — ON.MPI.64092 with Markel Insurance SE. Every figure cited here is the canonical record, not a marketing claim.

Architecture

Standards, architecture, and what is actually inspectable

Modern startup it sits on a small number of public standards. Where the stack is closed, the customer rents capability. Where the stack is open, the customer can ultimately own the system they are paying for. The distinction is not academic — it determines what happens at the end of every contract, what happens when a vendor disappears, and what happens when the customer needs to evolve the system beyond the vendor's roadmap.

GSMA-compliant eSIM profiles connect to the strongest available LTE-Advanced or 5G network across 160+ countries and 240+ networks, with multi-carrier switching. The full coverage figure is canonical. Where legacy documentation cites 120+, 130+, or 190+ countries, those numbers are inconsistent and should be treated as superseded.

Open-protocol telephony rests on SIP for signalling, PJSIP for the modern implementation, WebRTC for browser-based real-time media, Debian for the operating system, and Asterisk/FreePBX for the telephony engine. Documentation points to the maintained upstream sources of those projects rather than to a closed knowledge base. The result is a system the customer can audit, replicate, and — if they ever want to — operate themselves.

AI services are delivered as a four-layer architecture: Experience (where people meet the system), Orchestration (how work moves through it), Intelligence (which models think, selected for quality, language, speed, cost, and control), and Infrastructure (where it runs — managed cloud, private cloud, or self-hosted). The design goal is to keep each layer replaceable. The deployment choice is a per-engagement decision, not a strategic commitment.

For organisations that have to demonstrate compliance, the relevant standards are: GDPR / DSGVO, BFSG (Barrierefreiheitsstärkungsgesetz) and the European Accessibility Act, EN 301 549, the EU–US Data Privacy Framework and Standard Contractual Clauses, ISO 27001, and BSI IT-Grundschutz where applicable. Where data leaves the EU, the lawful basis for the transfer is documented in the privacy policy and verified against the recipient's certification status.

Operating model

The operating model: self-serve, consultation, or managed

Three delivery models are common. The first is self-serve digital purchase — immediate, no contract, the right answer for situations where the work is well-defined and the customer has the capability to operate independently. The second is a consultation — a working session to scope a real need, decide which standards and which architecture apply, and arrive at a recommendation. The third is a managed engagement under an SLA, where the same platform is operated on the customer's behalf.

The same platform supports all three. That is not marketing — it is a consequence of the architecture. Where the architecture is open and inspectable, the customer can move between delivery models without changing the underlying system. Where the architecture is closed, every transition costs the customer a re-implementation.

Under a managed engagement, the work moves through five stages: Discover, Design, Prototype, Integrate, Improve. Discover maps the outcome, the people, the data, the risks, and the repetitive work — before any model or platform is chosen. Design defines the assistant, the workflow, the knowledge sources, the integrations, and the approval points. Prototype builds a focused working version and tests it with realistic inputs. Integrate connects the system to the tools that already shape how work happens. Improve monitors quality, cost, and adoption, and updates the system as the work changes.

The commercial model follows the architecture. Where the open-source core is not sold as a per-user licence, and where the components — design, infrastructure, implementation, support, third-party services — are billed separately and transparently, the customer can audit the cost line by line. A customer who chooses to run the platform themselves and never speaks to us again is a legitimate outcome. That statement is not on the pricing page by accident; it is the architecture talking.

Economics

The economic case for a connected ecosystem

The economic case for a connected ecosystem is straightforward. The cost of operating a portfolio of disconnected vendors is not the sum of their individual invoices. It is the cost of those invoices plus the integration work, plus the security review per vendor, plus the procurement cycle per vendor, plus the audit per vendor, plus the offboarding risk per vendor. A connected ecosystem that is operated as a system changes every one of those line items.

This is the part of the conversation that needs to be had before any feature comparison. A feature is what the vendor chose to build. An ecosystem is what the customer has to live with. The customer's job is to evaluate the ecosystem, not the feature.

For multi-country organisations, the cost picture also includes tax, regulatory, and currency exposure. A vendor that publishes its prices openly, in the customer's currency, and that discloses its full set of legal identifiers and sub-processors, is a vendor the customer can budget for. A vendor that requires a contact form is a vendor the customer cannot budget for until the procurement cycle ends. The two are not the same kind of decision.

Where the deployment is regulated — public sector, healthcare, financial services — the economic case includes compliance cost. Compliance-first infrastructure is not more expensive in the abstract; it is more expensive only when the architecture forces compliance work to be re-done every time the standards change. The architectural decision taken at the start of the engagement determines the long-run compliance cost.

Risk

Risk: the architectural questions, not the sales claims

Risk in IT procurement is the risk the customer carries when a vendor fails, the risk of an outage, the risk of a security incident, the risk of a regulatory change, and the risk of an exit. A connected ecosystem addresses each of these risks with architecture, not with promises.

Vendor failure: where the architecture is open, the customer can continue to operate the system if the vendor disappears. The system does not depend on the vendor's continued existence; it depends on the open standards it is built on. This is a verifiable property, not a contractual promise.

Outage: a system that is operated as a single, distributed, edge-cached estate — with redundant regions, immutable infrastructure, and continuous monitoring — is fundamentally different from a system that depends on a single operator in a single region. The architectural difference is observable in the SLA. Where the SLA is published, where the SLA is measured against the architectural reality, and where the SLA includes a meaningful credit, the customer can plan for outage. Where the SLA is vague or non-existent, the customer cannot.

Security: the relevant question is not whether the vendor has been breached. Every mature vendor has been breached. The relevant question is whether the architecture and the operating model reduce the probability and the impact. Data minimisation, explicit access, human checkpoints, traceable work, cost boundaries, and continuous protective monitoring are the engineering principles that turn security from a sales claim into a verifiable property.

Regulatory change: a vendor that operates a privacy policy against the current version of GDPR, the current version of the EU–US Data Privacy Framework, and the current version of the relevant national supervisory authority guidance is a vendor the customer can audit. A vendor that does not disclose these is a vendor the customer cannot audit.

Exit: a system that is built on open standards, with documented APIs, with exportable data formats, and with the option to operate the platform internally, is a system the customer can leave. The commercial model that supports this is a commercial model the customer can rely on.

Implementation

The implementation sequence, week by week

Implementation follows the operating model. A self-serve engagement starts with the procurement and provisioning. A consultation engagement starts with the working session. A managed engagement starts with Discover. The first three weeks of a managed engagement typically cover the mapping of the work, the people, the data, the risks, and the existing systems. The next four to six weeks produce a focused working version, tested against realistic inputs. The next four to six weeks integrate that working version with the tools that already shape how the work happens. The first quarter of operation establishes the monitoring, the documentation, and the human approval points. The next two quarters are continuous improvement.

Throughout, the customer remains the operator. The vendor's role is to deliver the platform and the engineering, to maintain the standards, and to be the named point of accountability for the parts of the work that the vendor does. The customer's role is to use the system, to provide the inputs, and to make the decisions that the system supports but does not make for the customer.

This is the structural difference between a connected ecosystem and a collection of vendors. The connected ecosystem has a single procurement path, a single integration story, a single security model, a single operating model, and a single exit path. The collection of vendors has none of these. The choice is not between features; it is between these two structural models.

FAQ

Frequently asked questions, in plain language

The most common question is about the cost. The honest answer is that the cost depends on the architecture and the operating model, and that the cost of a connected ecosystem is usually lower than the cost of a collection of vendors once the integration, security review, procurement, audit, and offboarding costs are included. The exact number depends on the engagement; the structure of the cost is published openly.

The second most common question is about the data. Where the data is, who the sub-processors are, what the lawful basis for any third-country transfer is — all of these are answered in the privacy policy, with named providers, named addresses, named lawful bases, and named safeguards. The relevant regulatory authority for the registered office is documented; the competent supervisory authority for data protection is documented; the competent market surveillance authority for accessibility is documented.

The third most common question is about the exit. A customer who chooses to leave is supported. The system exports the customer's data and configuration. The architecture is operable independently. The commercial model is published openly so the customer can plan the cost line by line. The exit is a planned outcome, not a worst-case scenario.

The fourth most common question is about the language. The platform is published in up to twelve languages. The relevant legal text is in the customer's preferred language. The relevant commercial terms are in the customer's preferred currency. The relevant delivery is in the customer's preferred timezone. The platform is international by design, not by retrofit.

A fifth common question, in organisations that have been through a vendor change before, is about the migration cost. The honest answer is that the migration cost is real, that the cost is amortised across the architecture rather than concentrated in any single component, and that the cost is a known line item rather than a hidden risk. The migration plan is written down before the first change. The migration is reversible at every stage. The customer retains the option to operate the new system, the old system, or both in parallel, for as long as the customer judges necessary.

A sixth common question, in organisations that have not been through a vendor change before, is about the cost of doing nothing. The honest answer is that the cost of running a portfolio of disconnected vendors — the integration work, the security reviews, the procurement cycles, the audits, the offboarding risk — compounds over time. The longer the portfolio is in place, the more the customer is locked in. The longer the customer waits to consolidate, the more expensive the consolidation becomes. The risk of doing nothing is not a stable risk; it is a growing one.

A seventh common question, in organisations with regulated workloads, is about auditability. The honest answer is that the connected-ecosystem model is more auditable than the collection-of-vendors model, because there is a single procurement path, a single integration story, a single security model, a single operating model, and a single exit path to audit. The collection-of-vendors model requires the customer to audit each vendor separately, and then to audit the integration between them, which is a second audit at a different layer that almost no one performs.

An eighth common question, in organisations with international operations, is about language and timezone. The honest answer is that the platform is published in up to twelve languages, the legal text in the customer's preferred language, the commercial terms in the customer's preferred currency, and the delivery in the customer's preferred timezone. The platform is international by design, not by retrofit. Where a customer has operations in a language or timezone not yet covered, the platform is extended to cover it, and the extension is treated as a feature, not a project.

Worked example

A worked example

To make the architecture concrete, consider a multi-site organisation with operations in four European countries, two time zones, and a workforce of several hundred people. The existing setup is a per-country vendor for telephony, a separate vendor for hosting, an internal IT team for managed services, a separate security consultant, and an emerging AI pilot that has not yet been integrated with the rest.

Under a connected-ecosystem engagement, the first three weeks of Discover map the existing systems, the data flows between them, the security boundaries, the regulatory obligations in each country, the language requirements, and the work that is most repetitive. The output of Discover is a written document that the customer can audit and that the engineering team uses as the input to Design. Nothing about the existing systems changes during Discover. The goal is to understand before changing.

Design then produces a focused working version: a single identity across the four countries, a single telephony platform with a transparent pricing model, a single hosting estate in a Frankfurt data centre, a single managed-IT engagement under a published SLA, and a single AI service operating against the customer's own data with explicit access controls. Each component is one of the ten service lines. The architecture is documented. The decision is documented. The customer's existing systems are not replaced on day one; they are migrated in order, with the migration plan written down before the first change.

Prototype produces a working version that the customer can use in production for the first deliverable. The deliverable might be a single customer-facing service, a single internal process, or a single compliance workflow. The point is that the working version is real, that it uses the customer's real data with the customer's real identity, and that it can be evaluated against the customer's real metrics. The evaluation informs the Integrate phase.

Integrate connects the working version to the tools the customer already uses: the email system, the document store, the calendar, the CRM, the help desk, the ERP, the engineering ticketing system. Each integration is documented. Each integration is reversible. Each integration has a human approval point. The integrations are the part of the architecture that is most likely to need to evolve as the work changes, so they are designed to evolve.

Improve is the operating phase. Monitoring is in place. Documentation is current. Human approval points are exercised. Cost is tracked against the published model. Adoption is measured. The system is updated as the work changes, and the updates are recorded. The customer retains the right to operate the system themselves at any time, and the system is built to support that right. This is the structural difference between a connected ecosystem and a collection of vendors: the connected ecosystem has a single operating model, a single exit path, and a single architecture that the customer can audit, replicate, and — if they ever want to — operate themselves.

The worked example is not a sales pitch. It is a description of how the engagement actually runs, week by week, artefact by artefact. A customer who has been through one of these engagements can read the description and recognise the structure. A customer who is about to begin one can read the description and prepare for the structure. That is what the structure is for.

Concretely, the numbers for a representative engagement look like this. A mid-sized organisation with 1,200 employees across four countries consolidates a portfolio of fourteen vendors into a single connected ecosystem. The annual run-rate savings are typically 18% to 28% of the total IT spend, mostly from the elimination of redundant integration work, the consolidation of security review, the simplification of procurement, and the unification of audit. The migration project itself takes twelve to twenty weeks, with the customer retaining the option to operate the new system, the old system, or both in parallel for as long as the customer judges necessary.

The economic life of the architecture is not the economic life of any single vendor. A connected ecosystem built on open standards has an economic life measured in decades, not in vendor contract cycles. A collection of vendors has an economic life measured in vendor contract cycles, which is typically two to five years per vendor, and the contracts do not align. The customer is therefore migrating, consolidating, and re-procuring every two to five years, regardless of whether the customer wants to. The connected-ecosystem model ends this cycle.

The worked example also addresses the question of trust. A customer who reads this description and decides to proceed is making a long-run architectural commitment, not a short-run procurement decision. The commitment is to the architecture, not to the vendor. If the vendor disappears, the customer can continue to operate the system, because the architecture is open. If the customer chooses to leave, the customer can take the data and configuration, because the data is portable. If the customer chooses to evolve the architecture, the customer can evolve it without the vendor's permission, because the standards are public. The trust is in the architecture, and the architecture is the customer's.