Regulated customers ask for evidence. Your software should be able to provide it.

Customers from regulated industries pass their requirements on to you: exit rules under DORA, supply-chain security under NIS2, questions from their auditors. We build with you: AI features for which you never hold your customers' documents, support you run yourself, and business applications in which every step can be traced.

DORA · NIS2 · Cyber Resilience Act

1. 01

   AI features without holding customer documents

   Incoming invoices, contracts or job applications in your product, read by AI, without your customers' documents ever being readable on your side.

   Agent

   Reads the document on a trusted Mac in your customer's organization and returns data in exactly the schema your application sends, with the page and passage for each value.

   System

   Document, schema and result are end-to-end encrypted. The Relay in between sees sizes, timestamps and error codes, even if you operate it.

   Human

   A person in your customer's organization checks the values; values without evidence are marked as unverified.

   Products

   Edge AI Fabric

2. 02

   Self-hosted support and customer portal

   Several customers, each with its own service agreement, contacts and hourly rates. Communication, responsibility and work records stay together on the ticket.

   System

   Two clocks per ticket, response and resolution, according to the rules agreed with each customer. Working time is recorded with a work note and exported monthly for billing.

   Agent

   Optional: asks for missing information; suggestions for priority and labels apply only after confirmation. AI runs only once you have enabled it and set up a provider.

   Human

   Your team replies, decides and can take over at any time.

   Products

   TCKT

3. 03

   Building a regulated business application

   Tenant separation, approvals, versioned rules and audit exports come from the platform instead of being rebuilt in every project.

   System

   Process Core runs your processes with durable state, checks identity, permissions and tenant context at one common ingress, and records every transition in a journal.

   Human

   Your team writes the domain rules and the application. Whoever publishes a change cannot activate it; a second person does.

   Products

   Process Core

4. 04

   Exit-ready for customers in financial services

   Your customers in financial services need an exit strategy for ICT services that support critical or important functions, including yours where it supports one. Architecture and documentation decide whether moving to another provider would be a project or mean starting over.

   System

   Data in formats your customers can take with them, the business process separated from the infrastructure that runs it, and a documented way out for every dependency.

   Human

   Your customer decides which ICT services support critical or important functions. You provide the documents for their exit plan.

   Products

   Digital resilience

1. 01 · UploadYour customer uploads an invoice in your application
2. ↓
3. 02 · SendDocument and JSON schema, end-to-end encrypted; the Relay brokers without being able to read
4. ↓
5. 03 · Read on the deviceA trusted Mac in your customer's organization returns data in exactly the schema, with evidence for each field
6. ↓
7. 04 · CheckA person checks the values; values without evidence are marked as unverified
8. ↓
9. 05 · SaveYour application saves the confirmed values; the Relay has logged sizes, timestamps and error codes, no content

• DORA

  Applies since 17 January 2025

  In short

  Financial entities have to manage ICT third-party risk. For ICT services that support critical or important functions, they need exit strategies, and the contracts have to provide for them, including an adequate transition period.

  What software can contribute

  Self-hosted operation, portable data formats and a documented way out make it easier for your customers to show their exit strategy.

• NIS2

  German implementation in force since 6 December 2025

  In short

  Cloud computing service providers, which can include SaaS providers, as well as managed service providers and managed security service providers are covered themselves from medium size. Essential and important entities also have to manage the security of their supply chain, including their direct service providers.

  What software can contribute

  Self-hosted tools with permissions per customer, separated customer data and traceable records of who did what.

• Cyber Resilience Act

  Reporting obligations since 11 September 2026; fully applicable from 11 December 2027

  In short

  Manufacturers of products with digital elements, including software placed on the EU market, report actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours. From 11 December 2027, security requirements apply throughout the support period, including vulnerability handling and security updates. Pure SaaS is generally not covered unless it is remote data processing for such a product.

  What software can contribute

  A vulnerability report runs as a process with its deadlines, responsibilities and approvals, and every step is recorded.

05 — Talk to us

Which of your customers' requirements can you meet today only with considerable effort?

After that we talk about your product, your customers' contracts and where AI may read their documents.

Talk to an engineer ↗