The company, on tape.

Click the tube, or press 1 to 5.Tap the tube. Five channels, one just for the look. Sound on.

Two of us lead it. Designers and engineers we have worked with for a decade build with us. Nothing ships until one of us has checked it.

A letter from the two of usPalma · October 2026

We started Bolted in 2012 to design and build apps. For the last decade, much of that work has been the hardest kind: the alerts in regulated medical software, the ones that have to wake someone.

It taught us the only standard we trust: an app running on the real device, and a written account of why it works. We have held everything since to it, from an app in the first wave for Apple Vision Pro to the apps we make for ourselves.

Code is cheap now. Knowing when it is wrong is not. That is what we bring to a project, and why one of us still checks every change before it ships.

So we keep Bolted small on purpose: the two of us lead every project, with designers and engineers we have worked with for a decade and AI tools for the routine work. We work as one team, and we do not bill by the hour.

Next, we are making products of our own. The first, Reach, launches in November. Until something ships, this site says so.

When software has to work, someone has to answer for it. We would like that to be us.

Sebastian and AndresSan Francisco and Palma

Four rules since 2016. Press one.

Real hardware, or it did not happen.

Demos run on the device they will ship on. A simulator is where we start, never where we finish.

Supplier facts, for your quality team

Your agreements	We sign yours. NDA, MSA, quality agreement. Change and defect notification, right to audit, records retention and named subcontractors are all acceptable clauses.
Qualification	Questionnaire, then a remote audit of our software lifecycle against ISO 13485 7.4, IEC 62304 and your SOPs, with findings closed before work starts.
People	Both founders background-checked, on your managed devices or VDI, trained on your design-control and SCM procedures, with training records kept.
IP and data	Work for hire. No PHI. Everything written for you is assigned to you. No patient data in test environments. No client source goes to an external model without your written permission.
IEC 62304	SOUP records and safety class, known anomalies evaluated against your hazards, verification evidence, a change notice before every release.
Section 524B	SBOM in CycloneDX or SPDX, support status and end-of-support dates, a vulnerability notice inside thirty days.
IEC 60601-1-8	Applicability table. Which alarm-system clauses a phone can meet, which it cannot, and why. An argument your risk file can cite.
Continuity	Both founders on every engagement. Code in escrow with triggers you define. Work documented so a handover is a checklist.
ISO 13485	Your quality system, our audited lifecycle. Until we hold a certification of our own, the audit is the evidence.
Insurance, entity	Sent with the NDA. Certificates of professional indemnity and cyber cover, the legal entity, address and identifiers.
Coverage	San Francisco and Palma. A working day that overlaps the Americas in the morning and Europe in the afternoon. Windows written into the SOW.
Payment	Invoice against your purchase order, net 30 to 60. Fixed fees for scoped work, monthly for one of us in your team. No change orders on a fixed scope.