Bounded
Bounded provides supplier security assessment software for critical infrastructure operators, connecting supplier contracts, responses, proposed amendments, and follow-up actions in a single platform. The platform reviews existing agreements, identifies gaps against security requirements, prepares contract changes, and drives follow-through so customer teams can focus on decision-making. It maps supplier dependencies beyond the first tier and is designed for NIS2, CRA, and AI Act compliance, with all data stored on EU-operated infrastructure.
- Cybersecurity
- Regulatory & Compliance Technology
- Software Only
Funding
Founders
Founder details are not available yet.
Product
Problem
Critical infrastructure operators face complex supplier security assessments that require gathering responses, agreeing on contract changes, and following through on remediation. A security finding alone is insufficient—someone must still collect answers, negotiate amendments, and ensure completion, creating a fragmented workflow that delays risk reduction.
Solution
Bounded provides supplier security assessment software that connects agreements, supplier responses, proposed amendments, and follow-up actions in a single platform. The platform reviews existing contracts, gathers supplier responses, and prepares contract changes, while driving follow-up so customer teams can focus on decision-making rather than administrative tracking. Evidence remains attached to the work throughout the assessment lifecycle, and the platform maps supplier dependencies beyond the first tier to understand the relationships behind each contract. Customer documents and permanent platform data are stored on Bounded-operated infrastructure in the European Union, with external processing minimized and disclosed.
Target Audience
Primary customers are critical infrastructure operators and organizations subject to NIS2, CRA, and AI Act compliance obligations that need to assess and manage supplier security risk.
Features
- Contract-to-action workflow connecting supplier agreements, responses, proposed amendments, and follow-up in one system
- Supplier dependency mapping that surfaces sub-supplier relationships for more comprehensive review
- EU-operated infrastructure with explicit jurisdictional boundaries and disclosed sub-processors
- Non-European sub-processor mapping to expose and act on jurisdictional exposure
- Designed for NIS2, CRA, and AI Act compliance requirements
- ISO/IEC 27001:2022 certified with AES-256-GCM document encryption and isolated key vault
- AI processing limited to necessary, preprocessed, and minimized text extracts—original files are never sent to AI models