Ship customer-specific extensions and compliance workflows beside your product, without touching the roadmap

For B2B software vendors, IT service providers and system integrators, managed service providers, and fintech and insurtech companies: build customer extensions, onboarding, portals, security questionnaire responses, vulnerability reporting and contract evidence as production software with review points, traceability and code ownership.

Keep your product team on the roadmap. Everything a regulated customer asks for beside the product gets its own governed app, its own repo and its own release, and your customer can take the code with them.

Where it runs

Nuclicore-managed single tenant on Hetzner in Germany or Azure in the EU, or your own cloud (BYOC) and on-premise on Enterprise. Per-customer deployments through deployment labels.

What it connects to

Your product's APIs, ticketing and support (Jira, Zendesk, ServiceNow), CRM (HubSpot, Salesforce), Git and CI (GitHub, GitLab), scanner exports, identity (Entra ID, Okta), contract and document management via APIs, webhooks and exports.

What we do not touch

Your core product repository, your CI/CD pipeline, your SIEM and scanners, your licence metering. Apps run beside the product and consume what it exposes.

Who owns the code

You do, and you can hand it on. Each app is a standard React and Node repository with its own backend, running on a managed, encrypted Postgres database. A customer extension can be exported and given to that customer.

What software companies evaluate first

These are the questions the CTO, the head of professional services, the CISO and the customer's procurement ask before a pilot gets a budget line.

Hosting in Germany

Nuclicore-managed on Hetzner in Germany or Azure in the EU, with BYOC or on-premise on Enterprise. Matches what your regulated customers ask of you.

Beside the product, not a fork of it

Customer-specific extensions are separate apps against your product's API, not branches of your core. The roadmap stays clean and every extension has its own lifecycle.

One release per customer

Deployment labels let one codebase ship as separate releases per customer, tenant or legal entity, each with its own approval and its own redeploy history.

Evidence your customers' auditors accept

Who raised, who reviewed, who approved, when, with what evidence. Exportable per case for customer audits, DORA due diligence and your own ISO 27001 or SOC 2 audit.

Security controls you can cite

Dependency scanning, secrets handling, CVE patching and a nightly ZAP scan run on every app. Release gates and logs give you documented measures for every questionnaire you answer.

Customer and partner access with scope

Customers, partners and auditors get portal roles that see exactly their cases, documents and fields. Nothing else is visible, every access is logged.

Exit path built in

Standard code, standard database, documented interfaces. The exit clause your financial customers demand under DORA is true for what you build here.

Built for how software companies actually deliver

Align scope, workflow ownership and governance for the business you run.

B2B software vendors and SaaS

IT service providers and system integrators

Managed service and hosting providers

Fintech and insurtech

Why delivery models are changing for software companies

The vendors that grow fastest keep the core clean, give every customer request its own governed app and treat compliance as running software.

Common Reality

The roadmap is booked. Deals die in the professional services backlog.

Every regulated customer wants an extension, an integration or a portal that is not on the roadmap. It lands with the same senior engineers who build the product, as a fork or a branch, and stays there. The customer waits, and the next deal waits behind it.

Common Reality

Four regulations, one CTO inbox

CRA vulnerability reporting since September 2026 for delivered clients and agents. NIS2 since December 2025 for managed service and digital providers. DORA contract addenda for every financial customer. Software as a product under liability law from December 2026. Each one needs a process with a record.

Common Reality

Vendor due diligence is now the sales cycle

Questionnaires, SBOM, audit rights, exit plans and subprocessor lists come before signature, not after. Answering by mail once is fine. Answering for every prospect, every renewal and every audit is a workflow.

What you can build across delivery, security and contracts

Deliver governed software around your product and your customers, with review points, traceability and code ownership.

Customer delivery and professional services

The customer's extension as its own app against your product's API, with its own repo, its own data, its own environments and its own release cycle. No fork of the core, and the customer can take the code when the contract ends.

Onboarding and go-live sign-off

Implementation checklist per customer, data migration approvals, configuration decisions with an owner, and a go-live sign-off with the record of who accepted what.

Customer portal for tickets, releases and documents

Customers see their tickets, release notes, contract documents, SLA reports and open requests in one place, with the fields you decide to expose and nothing else.

Change requests and change advisory

Customer change requests with estimate, impact, approval before the hours are spent, and a link from the request to the task and the release that delivered it.

Security, vulnerabilities and product compliance

Vulnerability intake and CRA reporting

Coordinated disclosure intake, triage, severity, affected products and versions, the 24-hour, 72-hour and 14-day reporting steps, the fix and the customer notice, all with the responsible person on record.

Security questionnaire response library

Approved answers with evidence per control, versioned and owned by the CISO; new questionnaires are assembled from the library, gaps routed to an owner, and the sent version archived per prospect.

SBOM and dependency evidence register

SBOM exports from your build tools attached per product and release, review sign-off, and the evidence file that can be produced for a customer or a market surveillance authority on request.

Incident intake, classification, timeline, the NIS2 and DORA-driven notices your customers need from you, the post-mortem with actions and owners, and the archived communication.

Contracts, DORA and operations

DORA contract register and addenda

Per financial customer: the Article 30 clauses in place, audit rights, exit and transition plan, subcontractor chain and the data your customer needs for its register of information, with expiry and review dates.

Subprocessor change notifications

Planned subprocessor changes, the customers affected, the notice sent, the objection period tracked and the outcome recorded per customer.

SLA and service credit reporting

Availability and response data from your monitoring and ticketing, calculated against each customer's SLA, credits approved before they are issued, report per customer per period.

Audit evidence request handling

Requests from customer audits, ISO 27001, SOC 2 or C5 auditors in one queue with the owner, the evidence attached, the deadline and the record of what was shared with whom.

Fits your product and your tools

Most ROI comes from removing manual handoffs between sales, professional services, support, security and legal, and from connecting to your product and your tools with clear ownership of every interface.

We build governed apps around your product's API, ticketing, CRM, Git and CI, scanners, identity and document management. We read what these systems expose and write back through their supported interfaces. We do not touch your core repository, your pipeline or your SIEM.

What we need from you

Integration patterns supported

Governed releases, stable production

Security and data controls for software companies

Each application runs its own backend, with a managed, encrypted Postgres per environment. Single-tenant infrastructure, BYOC and on-premise on Enterprise. Hosting in Germany or the EU by default.

RBAC, audit logs and monitoring keep access controlled per customer, role and partner. Dependency scanning, secrets handling, CVE patching and a nightly ZAP scan run on every app, which gives you documented technical measures for your ISMS and for every customer questionnaire. Your workspace content is not used to train models.

Security controls in practice

What a first pilot at a software company looks like

We align on one workflow or one customer extension and deliver reviewable increments with clear governance.

Scope, acceptance criteria, architecture outline

Pick one workflow (for example the security questionnaire library, vulnerability reporting or one customer's extension). Define roles, approval matrix, the product API calls to make and the records to write back.

First working version in Preview

Forms, routing, approvals and the integration to your product API or tool exports. Professional services, support and security users click through and comment in the task.

Test environment with real roles and real data

Customer and partner roles, SSO, write-back to ticketing or DMS, audit trail export. Your engineering lead and your CISO review the interface and the access concept.

Production release and handover

Approval, release to Production, redeploy of an earlier version verified. Documentation for engineering, security and the customer where applicable. Decision on the next workflow or the next customer.

Success criteria examples

Technology & Software FAQ

Answers for CTOs, professional services, security and legal.

What does "governed" mean for a software company?

Work is organised into reviewable tasks with acceptance criteria. Releases move through Preview, Test and Production with approval, and any earlier release can be redeployed. Every case carries who raised, reviewed and approved it, with timestamps and evidence. That is the trail your customers' auditors, your DORA due diligence and your own certification ask for.

We already have Jira, Zendesk and a CRM. Why build beside them?

Because the workflow spans all three and none of them owns it: the questionnaire that needs answers from security and legal, the vulnerability that needs a customer notice, the change request that needs an estimate and an approval. Nuclicore builds the workflow around your tools and writes the result back, so the tools stay the systems of record.

Do you touch our core product repository or our CI/CD pipeline?

No. Apps live in their own repositories against your product's API. Your core repository, pipeline, scanners and SIEM stay untouched. What we build consumes what they expose.

Can we hand a customer extension over to the customer?

Yes. Each extension is a standard React and Node repository with its own backend, running on a managed, encrypted Postgres database. You can export it and give it to the customer, which is also what the exit clauses in your regulated customers' contracts expect.

We are pure SaaS. Does the Cyber Resilience Act apply to us?

Pure SaaS falls under NIS2 rather than the CRA, but any delivered client, mobile app, browser extension or agent is a product with digital elements and in scope, with vulnerability reporting duties since September 2026. Nuclicore covers the process side: intake, triage, the reporting steps, the fix record and the customer notice. The conformity of your product remains yours.

Our customers are banks and insurers. Does this help with DORA?

It covers what you owe them as an ICT third-party provider: the Article 30 clauses tracked per contract, audit and access rights, exit and transition plans, subcontractor chain, incident notices and the data they need for their register of information. The apps themselves are built with the exit path those clauses demand.

We are a managed service provider. What about NIS2?

Managed service and managed security providers are in scope from 50 employees. The apps run with dependency scanning, secrets handling, CVE patching, nightly ZAP scans and audit logs, which gives you documented technical measures, and the incident and reporting workflows are among the first things MSPs build.

Can it run on-premise or in our own tenant?

Yes. BYOC and on-premise deployment are available on Enterprise. The default is Nuclicore-managed single tenant on Hetzner in Germany or Azure in the EU.

We have forty customers with slightly different needs. Forty apps?

One app, one codebase, one release for the shared workflow. Customer-specific fields, approvers and thresholds are configuration, not code. Where a customer needs its own extension, it gets its own app. Deployment labels let you release per customer, tenant or legal entity.

Who maintains the apps after the pilot?

Your team, through the same platform: describe the change, review the task, approve the release. Security patches to dependencies are applied by the platform. If you want to take the code and maintain it in-house, you can.

What is not a fit?

Your core product's hot path, your CI/CD pipeline, SIEM and scanner replacement, licence metering and billing engines. Nuclicore builds the governed apps around your product, not the product.

Give every customer request its own governed app, and keep the roadmap.

Ship beside your product, with audit trail, customer portals and code your customer can keep.