Stackbridge

Supplier information

Written for procurement: who you would contract with, what is supplied, what support means, and what the tender file holds. What is not in place yet is stated here rather than discovered later.

Last updated 3 November 2026

1.Who you would contract with

Legal name
VersaMinds
Trading as
Stackbridge
Registered office
P.V. Bavegemstraat 17, 9200 Dendermonde, Belgium
Enterprise number (KBO/BCE)
0804.360.325
VAT number
BE 0804.360.325
D-U-N-S number
401116182
Governing law
The law of Belgium, before the courts of Brussels, Belgium, unless a contract says otherwise.
Contact
One address for commercial questions, data protection requests and security reports: [email protected]. A small company answers one mailbox better than three.

A young company’s annual accounts cover the years it has existed, and a turnover statement covers the same. EU procurement rules provide for exactly that, and ask for proof of financial standing only above a threshold; where one is asked for, we provide what the call names.

2.What is supplied

A licence to run Stackbridge on your own Kubernetes or OpenShift, delivered as container images and a Helm chart that you pull and install, with support and maintenance under the policy below. The software runs entirely on your infrastructure and sends nothing to us: no telemetry, no licence check, no update check. Hosting by us, single-tenant in the EU, is available on request and is a separate conversation.

Subcontractors
None. We deliver and support the product ourselves.
Third parties on our side
GitHub holds the source code and runs our checks on a build runner we operate; GitHub Container Registry serves the images you pull; Cloudflare Pages serves this website. No customer data reaches any of them, because none leaves your installation.
Licence after the supplier
The installation does not depend on us to keep running. A contract can state that the licence to the delivered version is perpetual and survives our insolvency or dissolution; nothing in the product prevents it.

3.Support and maintenance

You operate the installation; we support you in doing so, and have no access to it unless you give it for a specific session. A request is classified by its effect when it is reported. These are the terms we offer unless a contract sets others.

S1
The product is unusable for the team: the API or web app is down and a restart does not bring it back, data loss is suspected, or a security vulnerability is being exploited. First response within 4 business hours; worked on continuously in business hours until there is a fix or a workaround.
S2
A main function is unusable with no workaround: search or answers fail, a connector stops syncing, sign-in fails for a role. First response within 1 business day; a daily update until there is a fix or a workaround.
S3
Something is wrong but the team can work around it. First response within 2 business days; fixed in a coming release, named when it is scheduled.
S4
A question, or a request for a change. Answered within 5 business days. A change is a product decision, answered either way.
Business hours
09:00 to 17:00 Central European Time on Belgian working days. Support outside them, or an availability commitment for the installation itself, is a contract term with its own price.
Security fixes
Shorter timelines than the above, whoever reports the problem: see the security page.
Releases
Versions follow semantic versioning, one number for the chart and the images. Every release is scanned for known vulnerabilities before it is published, signed, and shipped with a software bill of materials. Nothing updates itself; you decide when to upgrade, and the release notes say what an upgrade needs from an operator.
Supported versions
The latest minor release, and the one before it for security fixes, for at least twelve months after the next minor release. A customer on an older version gets help to upgrade.
Included
Diagnosing a reported problem, a fix or a workaround, questions about configuring and operating the product, upgrade notes, security notifications.
Not included unless agreed
Operating the installation, upgrades done by us, changes for one customer, training beyond the install session, and support for your own model servers, identity provider, Kubernetes platform or the systems the connectors read.

4.Accessibility

The application is built from controls that carry their keyboard behaviour and roles (menus, dialogs, tabs and the command palette work from the keyboard, with a visible focus ring), de-emphasised text meets the WCAG AA contrast ratio in both themes and a test keeps it there, colour never carries a meaning alone, animation follows the operating system’s reduced-motion setting, and every form field is labelled. The interface is in English.

Not in place: no audit against the WCAG 2.1 or 2.2 success criteria, by us or a third party, no screen-reader testing, and no conformance report. A buyer that needs one should say so in the tender; it is a bounded piece of work we would do before the contract starts. Content people write in the product is rendered as they wrote it.

5.Security and vulnerability handling

How the product is built, deployed and operated, and what we do not claim, is on the security page. The vulnerability disclosure contact is also published at /.well-known/security.txt. Under the EU Cyber Resilience Act, an actively exploited vulnerability or a severe incident affecting the product’s security is reported to ENISA and to Belgium’s CSIRT within 24 hours of our becoming aware of it, and customers running an affected version are told directly.

6.Data protection

On your own infrastructure we process no personal data of yours: there is no network path by which it could reach us, so there is no processor relationship for the product itself. Support that reaches your data, such as a shared screen or a database extract sent for a diagnosis, is covered by the data processing terms agreed in the contract, and anything sent is deleted when the case closes. This website’s own handling of personal data is in the privacy policy.

7.Continuity and exit

Your data stays in open formats in your hands: a PostgreSQL database, plain git repositories, files or your own object storage, with an export of the whole knowledge base and an export and erasure per person. Leaving is an export, a database dump and an uninstall; no step of it needs us. How to operate, back up, restore and rotate the secrets of an installation is documented, so a second person can do it.

8.The tender file

Provided on request, dated for the tender: an extract from the Belgian Crossroads Bank for Enterprises, the ownership and control information (the UBO register extract and the directors’ appointments), attestations of tax and social security compliance, a signed declaration on the exclusion grounds a public buyer checks (insolvency, fraud, taxes, conflicts of interest, past contracts), and a reference once its owner has agreed in writing to be named.

Not in place yet: a third-party penetration test, an ISO/IEC 27001 certificate or SOC 2 report, an accessibility conformance report, and a source code escrow agreement, which can be added for a contract that names one. We keep the full list of our own gaps in writing and send it with the file; ask at [email protected].

Who we are

Legal name
VersaMinds
Trading as
Stackbridge
Registered office
P.V. Bavegemstraat 17, 9200 Dendermonde, Belgium
Company number
0804.360.325
VAT number
BE 0804.360.325
Security reports
[email protected]