One product. Everything else follows.

Kombine's customers are companies that fall under NIS2, DORA or the Lithuanian cybersecurity requirements. All three ask for the same thing in different words: show, on demand and with a date on it, that your security works. Kombine is where the showing happens.

The hard part is rarely the security itself. A company will have an asset list, a vulnerability scan, a risk register in a spreadsheet and supplier contracts in a shared drive, and every one of them was correct on the day it was written. Then an auditor asks one question that touches all four. Two weeks disappear into answering it.

We are also somebody's supplier. Every customer who records Kombine in its own third-party register is running the same assessment on us that Kombine exists to help it run on everyone else. That is a good constraint to build under. It is why the architecture, the security model and the data handling are published in full, and why this site carries no customer logos and no certification badges. When there is something to show, it will have a date on it.

Fewer obligations properly, over every obligation approximately. A framework that is almost right is worse than one that is absent: an absent framework sends you off to check, and an almost-right one makes you confident. So the answer to whether we cover something is sometimes no, and it is a real no.

The second rule is that a customer has to be able to leave. The platform we operate is the same platform that installs on a customer's own hardware against a licence key, which means a customer can audit us without taking our word for anything and can go elsewhere without a migration project. Self-hosting is not an enterprise upsell here. It is the constraint that keeps this company honest, and we would rather be held to it than trusted.

For contracts, procurement forms and vendor onboarding. Most software companies keep this on a terms page, if they publish it at all. We repeat it on every page a buyer is likely to open, because a supplier that is hard to verify turns into a finding in somebody else's report.