Zurich · Copenhagen · Founded 2022

Vendor security review should never be an unverified group project.

Bastion Ledger was founded by cryptography, clearing-house security, and regulatory systems engineers who grew tired of watching skilled security analysts spend half their week chasing spreadsheet attachments.

Bastion Ledger engineering workspace in Zurich at dusk

2022

Founded in Zurich & Copenhagen

Security & distributed systems engineers

100%

EU/Swiss sovereign hosting, zero model training

99.98%

Trailing 12-month pipeline availability

Operating Principles

Four rules behind every product decision.

Vendor assurance is an engineering graph, not an email sport.

Chasing account executives for static spreadsheets wastes months without catching real architectural risk. Software should harvest public evidence first and bother humans only for genuine control deltas.

Auditors deserve deterministic math, never black-box guesses.

We use language models strictly to cite page numbers and highlight exceptions inside dense PDFs. Risk tiers are always computed by transparent, version-pinned rule trees your team controls.

Respect the supplier's engineer.

Every password wall you put in front of a vendor security lead delays your own procurement deal. Cryptographic domain-bound magic sessions protect sensitive artifacts while keeping response times under 48 hours.

Single Sign-On is a baseline control, never a luxury upsell.

Security tools that hold third-party penetration tests should never charge extra to enforce SAML or OIDC authentication. We include SSO across Scale and Sovereign tiers without per-seat taxes.

Engineering & Regulatory Leadership

Led by practitioners who have sat on both sides of external audits.

Henrik Lindholm

Co-Founder & Chief Executive Officer

Copenhagen

Previously led enterprise security engineering across Nordic payment clearing networks; 14 years in applied cryptography and ISO 27001 audit automation.

Maren Solberg

Co-Founder & Chief Technology Officer

Zurich

Former principal systems architect building formal policy verification engines and high-assurance banking ledgers in Switzerland.

Lukas Vetter

VP of Distributed Infrastructure

Zurich

Designed multi-region envelope encryption planes and zero-trust telemetry pipelines for European cloud providers.

Clara Lindqvist

Director of Regulatory Architecture

Copenhagen

Former supervisory ICT risk advisor specializing in EU DORA, NIS2 supply-chain registries, and financial outsourcing audits.

Our Own Security & Sovereignty Posture

SOC 2 Type II

Unqualified annual attestation covering Security, Availability, and Confidentiality criteria.

ISO/IEC 27001:2022

Certified Information Security Management System audited by an accredited European registrar.

EU & Swiss Residency

Primary workspaces pinned to Frankfurt (eu-central-1) or Zurich (eu-central-2) with envelope KMS isolation.

Zero Foundation Training

Contractual DPA guarantee that zero uploaded reports or supplier answers ever train external models.