Company · Who we are

A letter from the two of usPalma · October 2026

We started Bolted in 2014. For most of the decade since, that meant the hardest kind of app: medical alerts that have to wake someone.

It left us one standard: the app running on the real device, and a written account of why it works. We hold everything to it, from an early Apple Vision Pro app to our own games.

Code is cheap now. Knowing when it is wrong is not. So we stay small on purpose. AI does the routine work. The judgment stays with us.

Our first product, Reach, launches in November. When software has to work, someone has to answer for it. We would like that to be us.

Sebastian and AndresSan Francisco and Palma

Four rules since 2016. Press one.

01

Real hardware, or it did not happen.

Demos run on the device they will ship on. A simulator is where we start, never where we finish.

Supplier facts, for your quality team

Your agreements	We sign yours. NDA, MSA, quality agreement. Change and defect notification, right to audit, records retention and named subcontractors are all acceptable clauses.
Qualification	Questionnaire, then a remote audit of our software lifecycle against ISO 13485 7.4, IEC 62304 and your SOPs, with findings closed before work starts.
People	Both founders background-checked, on your managed devices or VDI, trained on your design-control and SCM procedures, with training records kept.
IP and data	Work for hire. No PHI. Everything written for you is assigned to you. No patient data in test environments. No client source goes to an external model without your written permission.

All 12 facts

IEC 62304	SOUP records and safety class, known anomalies evaluated against your hazards, verification evidence, a change notice before every release.
Section 524B	SBOM in CycloneDX or SPDX, support status and end-of-support dates, a vulnerability notice inside thirty days.
IEC 60601-1-8	Applicability table. Which alarm-system clauses a phone can meet, which it cannot, and why. An argument your risk file can cite.
Continuity	Both founders on every engagement. Code in escrow with triggers you define. Work documented so a handover is a checklist.
ISO 13485	Your quality system, our audited lifecycle. Until we hold a certification of our own, the audit is the evidence.
Insurance, entity	Sent with the NDA. Certificates of professional indemnity and cyber cover, the legal entity, address and identifiers.
Coverage	San Francisco and Palma. A working day that overlaps the Americas in the morning and Europe in the afternoon. Windows written into the SOW.
Payment	Invoice against your purchase order, net 30 to 60. Fixed fees for scoped work, monthly for one of us in your team. No change orders on a fixed scope.