# Double Open -- Full Reference

> Automated software supply chain governance -- deterministic filters and framework-anchored AI agents that eliminate the manual triage tax for CRA, NIS2, and DORA compliance.

## Company Overview

Double Open Oy is a Finnish company headquartered in Helsinki, providing automated software supply chain governance for enterprises. Founded in 2023, Double Open helps organizations achieve security and license compliance for their software products, with a strong focus on EU regulations including the Cyber Resilience Act (CRA), NIS2 Directive, and DORA.

The company combines decades of legal expertise in open source licensing with deep engineering know-how in software composition analysis (SCA), building on the industry-standard OSS Review Toolkit (ORT) -- the most comprehensive open source compliance toolset available.

## The Problem We Solve

Modern software products contain thousands of open source dependencies. EU regulations now make software security and license compliance a legal necessity:

- **Cyber Resilience Act (CRA)**: Requires manufacturers of products with digital elements to demonstrate cybersecurity due diligence, maintain SBOMs, and establish vulnerability handling processes. Non-compliance can result in fines up to EUR 15 million or 2.5% of global turnover.
- **NIS2 Directive**: Mandates cybersecurity risk management for essential and important entities across the EU.
- **DORA**: Digital Operational Resilience Act for financial entities, requiring ICT risk management and third-party oversight.

Static spreadsheets and manual processes are no longer defensible evidence of due diligence. Organizations need automated, auditable, and reproducible compliance processes.

## Key Differentiators

### Agentic Compliance: Accountable, Not Autonomous
Double Open eliminates the "triage tax" by combining a deterministic substrate with framework-anchored AI agents. The workflow scales workload toward zero in four stages:

1. **Deterministic Substrate (Steps 1 & 2)**: Before an AI agent opens its context window, the ORT Server engine executes a mathematical scan and applies mass clearances, converting raw scanner data into perfect, algorithmically derived inputs.
2. **Agentic Judgment (Step 3)**: A specialized MCP Server ingests the curated data layer and applies peer-reviewed legal and security frameworks (DOFCG v1.0 and customer-supplied anchors) to make logical, auditable judgments on the clear-cut bulk of compliance work.
3. **Human Verification (Step 4)**: The agent acts as a junior curator -- never a final judge. It surfaces only true, high-ambiguity exceptions as explicit questions or version-controlled pull requests for a human developer to sign off on.
4. **Measurable Correctness (Step 5)**: Agents are continuously tested against human-reviewed gold fixtures. Compliance quality becomes a trackable, deterministic software metric, not a probabilistic vibe.

**Key Agentic Skills**
- **Vulnerability Triage**: Prioritizes repositories based on real business impact and deployment posture. Ranks CVEs by code reachability and package roles to filter out unexploitable noise, proposing resolutions backed by cited evidence.
- **License Curation**: Natively applies DOFCG v1.0 rule sets to scanner false positives. Every SHA256-anchored clearance written by an agent or human is saved to a Shared Commons, permanently automating that file match for all future software builds.

### Real-World Performance Funnel
Example numbers captured from a real-world small-to-medium project demonstrate how the workflow compresses scanner noise into single-digit human verifications:

1. **Algorithmic Scan**: 10,803 files deep-scanned across 46 exact build packages.
2. **Deterministic Filters**: 4,170 raw license detections instantly compressed down to 65 policy rule violations.
3. **Agentic Triage**: 65 violations evaluated and resolved by the agent using standard framework rule sets.
4. **Human Verification**: Only 8 targeted actions raised as version-controlled pull requests for final human sign-off.
5. **Compliant Release**: 0 open issues, delivered with a mathematically verified audit trail.

### Expertise Fusion
Double Open uniquely combines 25+ years of legal expertise in open source licensing (from CEO Martin von Willebrand's career as a top-tier technology attorney) with the deep technical know-how of ORT's creator (CTO Sebastian Schuberth). This dual expertise produces a more complete and simplified offering.

### CRA Compliance
Designed to fulfill as many Annex I Essential Cybersecurity Requirements and Annex VII Technical File requirements as possible through automation. The platform generates audit-ready documentation suitable for the full product lifecycle.

### 10x Performance
Global file-level caching via Double Open Server (DOS) eliminates redundant scanning. When a file has been scanned and curated once, that result is reused across all projects and organizations, resulting in approximately 10x faster analysis compared to standard ORT.

### Configuration as Code + UI
Governance logic lives in version-controlled .ort.yml files for full transparency and reproducibility. This is complemented by an intuitive multi-tenant UI for team members who prefer not to work with code directly.

### European Sovereignty
EU-hosted SaaS with data in EU-controlled datacenters, ensuring full GDPR compliance and strategic sovereignty. Managed In-House deployment is also available for organizations requiring complete data control.

### Open Source Foundation
Built on Eclipse Apoapsis (ORT Server), the Eclipse Foundation project that Double Open leads and is the largest contributor to, and on the OSS Review Toolkit, hosted by the Linux Foundation. Double Open is an Eclipse Foundation member and a partner in the EU-funded OCCTET consortium behind the Foundation's Cyber Resilience Act toolkit. Built entirely on Apache-2.0 and MIT licensed open source projects. No proprietary lock-in, no opaque databases, no unpredictable pricing changes. Organizations own their 10-year+ audit trail.

## Core Products

### Double Open Compliance
The primary portal and management UI for OSPOs (Open Source Program Offices), compliance managers, and project teams. Provides dashboards showing open violations, security vulnerabilities, and compliance status across all products.

### Double Open Server (DOS)
A high-performance layer providing file-level curation re-use and caching. DOS stores scan results and human clearance decisions at the individual file level, enabling massive re-use across projects and organizations. Available as an API for integration into existing ORT installations.

- **Scan Results API**: Access file-level scan results (license and copyright).
- **Clearance Data API**: Access curated clearance decisions (Enterprise tier).

### Eclipse Apoapsis (ORT Server)
The Eclipse Foundation project whose reference implementation, ORT Server, scales ORT for enterprise use: orchestration, multi-tenancy, access control, REST API, configuration as code, Kubernetes deployment. ORT Server is the engine of Double Open Compliance. Double Open is the project lead and the largest contributing organisation (https://projects.eclipse.org/projects/technology.apoapsis/who); Double Open Compliance is a hosted, supported instance of it.

### Agentic Layer (MCP Server)
A specialized MCP (Model Context Protocol) server that hosts framework-anchored AI agents on top of the deterministic ORT substrate. Agents apply peer-reviewed legal and security rule sets (DOFCG v1.0, plus optional enterprise-supplied anchors) to make auditable judgments, and package only true exceptions as version-controlled pull requests for human sign-off. Continuously regression-tested against human-reviewed gold fixtures so compliance correctness is a measurable software metric.

- **Vulnerability Triage Agent**: Ranks CVEs by code reachability, package roles, and deployment posture; filters unexploitable noise; proposes resolutions with cited evidence.
- **License Curation Agent**: Applies DOFCG v1.0 rule sets to scanner findings. Every SHA256-anchored clearance is written to a Shared Commons, permanently automating that file match for all future builds.

## Technical Specifications

### Input Formats
Source code and lockfiles from 20+ package managers including:
Maven, Gradle, npm, Yarn, pnpm, PyPI (pip, Poetry, Pipenv), Go modules, Cargo (Rust), NuGet (.NET), CocoaPods, Swift Package Manager, Composer (PHP), Bundler (Ruby), Conan (C/C++), Pub (Dart/Flutter), and more.

### Output Formats
- CycloneDX SBOM (multiple versions)
- SPDX SBOM (multiple versions including 2.2, 2.3, 3.0)
- Standard and Full Notice files (license attribution documents)
- ort-evaluator-results (the comprehensive source of truth for all compliance data)
- Webapp reports
- CI/CD integration reports

### Architecture
- ORT Analyzer captures transitive dependencies exactly as they are built
- ScanCode integration for license and copyright scanning with minimal false negatives
- Double Open License Classification: 800+ licenses mapped to actionable obligation categories (CC0 licensed)
- Rule engine for automated policy enforcement
- Clearance workflow for human-in-the-loop decisions with global re-use

## Delivery Models

### SaaS (EU-Hosted)
Fully managed platform hosted in EU datacenters. Includes automatic updates, monitoring, and support. Best for teams wanting a turnkey solution.

### Managed In-House
Deployed in the customer's own infrastructure but managed by Double Open. Provides complete data sovereignty while offloading operational burden. Suitable for organizations with strict data residency requirements or air-gapped environments.

### Consulting
Expert-led compliance assessments, ORT implementation, training, and ongoing advisory. Includes:
- Compliance assessment and gap analysis
- ORT setup and CI/CD integration
- Custom rule and policy configuration
- Team training on ORT and compliance workflows
- Ongoing advisory support

## Pricing

### Double Open Compliance (Hosted Platform)

| Plan | 1 Product | 10 Products | Additional Products |
|------|-----------|-------------|---------------------|
| Free | EUR 0/mo | Limited | -- |
| Pro | EUR 190/mo | EUR 1,100/mo | EUR 50/mo each |
| Enterprise | EUR 450/mo | EUR 2,390/mo | EUR 25/mo each |

A "product" may include multiple repositories (e.g., microservices) provided they constitute a single deployable application.

**Free** includes: SCA analysis, security vulnerabilities, license metadata, clearances as code, pre-set rules, SPDX SBOM, standard notice file, GitHub & Jenkins integration.

**Pro** adds: Clearance creation UI, CycloneDX SBOM, webapp reports, CI/CD integration reports.

**Enterprise** adds: Source code scan results, scan result curation (RCC), custom rules, full notice files.

50% discount available for verified open source projects.

### DOS API (For Own ORT Installations)
- Pro I (250 requests/mo): EUR 490/mo
- Pro II (500 requests/mo): EUR 690/mo
- Enterprise (1000 requests/mo): EUR 890/mo (Scan) / EUR 990/mo (Clearance)

### ORT Managed Support
- Starter: EUR 490/mo -- Email support, business hours, 2 business day response
- Professional: EUR 990/mo -- Priority support, 8-hour response, quarterly review
- Enterprise: EUR 2,490/mo -- Dedicated support, 4-hour response, monthly review, custom development

## Team

### Martin von Willebrand -- Co-Founder, CEO
A top-tier technology attorney who, after a 25-year award-winning career, now embeds legal-grade compliance directly into software. Martin brings deep expertise in open source licensing, regulatory compliance, and technology law.

### Sebastian Schuberth -- Co-Founder, CTO
Creator of the OSS Review Toolkit (ORT), the open source engine powering Double Open, and committer on Eclipse Apoapsis. An open source expert formerly at Bosch, HERE Technologies, and Nokia. Sebastian is the primary architect of ORT and the driving force behind its technical evolution.

### Martin Nonnenmacher -- Lead Engineer
Project lead of Eclipse Apoapsis, the Eclipse Foundation project behind ORT Server. A seasoned engineer formerly at Bosch, HERE Technologies, and Nokia.

### Marko Jaanu -- Board Member, Advisor
AI Evangelist and Head of Technology at Siili Solutions. Formerly Open Source Officer at Fujitsu Finland.

### Additional Team
- Jyrki Keisala -- Developer. Full stack developer, committer on Eclipse Apoapsis (ORT Server).
- Johanna Lamppu -- Developer. Full stack developer, committer on Eclipse Apoapsis (ORT Server).
- Mikko Murto -- Advisor, open source savvy attorney and full stack developer

## Partners

- **HH Partners** -- Leading Finnish technology law firm specializing in open source legal matters. Long-standing collaboration on compliance expertise.
- **BitSea** -- Nordic software consultancy and ORT integration partner.
- **NIIS (Nordic Institute for Interoperability Solutions)** -- Developer of X-Road(R) and Harmony eDelivery Access. Long-standing Double Open customer and case study.

## Published Articles

### What Is Eclipse Apoapsis? The Open Source Project Behind ORT Server, Explained
By Martin von Willebrand (2026-09-16)
Eclipse Apoapsis is the Eclipse Foundation project that provides a process and a reference implementation, ORT Server, for running the OSS Review Toolkit at organisational scale: worker-based scanning, multi-tenant UI, REST API, configuration as code, Helm charts and CI tooling, plus a CC-BY-4.0 guidance repository. Two project leads (Double Open and Bosch); Double Open is the largest contributing organisation. The Eclipse Foundation runs it across 348 projects and 3,600+ repositories, the EU-funded OCCTET CRA toolkit offers a free instance, and Double Open Compliance is a hosted, supported instance of the same unforked software. ORT is the engine, Eclipse Apoapsis the project, ORT Server the software, Double Open Compliance the service.
https://doubleopen.io/articles/eclipse-apoapsis

### ORT Server at Foundation Scale: What Scanning 3,600 Repositories Taught Us
By Martin von Willebrand (2026-09-16)
Results from the July 2026 CRA Monday session by the Eclipse Foundation's Open Regulatory Compliance Working Group: ORT Server (Eclipse Apoapsis) run across the Foundation's own portfolio of 348 projects and 3,600+ repositories found 74,286 packages and 32,177 vulnerability findings (advisory-package pairs), 5,267 of them critical, 89 percent in Maven and npm; a 96-repository benchmark across ten ecosystems; a comparison with GitHub dependency alerts (advisory sources, full transitive resolution through package managers, product-level counting, configurable SBOM, VEX and notice outputs); SME tester results (8 of 9 stacks supported); and Double Open's lessons from running agentic license curation on ORT Server, including the five-step deterministic-then-agentic workflow and sub-100k context windows.
https://doubleopen.io/articles/eclipse-apoapsis-at-scale

### The Most Practical CRA Resource We Have Found, and Why We Are Helping Build It
By Martin von Willebrand (2026-09-04)
The OpenChain CRA Compliance Checklist (Linux Foundation) is the most practical Cyber Resilience Act resource: 182 requirements in nine sections, from governance and the Article 13 risk assessment to SBOM management and the Article 14 24-hour/72-hour/14-day reporting cascade, each citing its CRA article, with an Annex I traceability matrix and a role applicability table. Double Open contributed to the risk assessment section and is reviewing RC1 against the Regulation. Start with your role, then Article 14 reporting, due 11 September 2026, then automate SBOM and vulnerability evidence.
https://doubleopen.io/articles/openchain-cra-compliance-checklist

### Running ORT Server Scans from GitHub Actions
By Martin von Willebrand (2026-08-25)
How to run Eclipse Apoapsis (ORT Server) compliance scans from GitHub Actions: why push triggers alone miss newly published advisories, how to pick a scan schedule from triage capacity, reusing a previous run's jobConfigs as the run configuration, using always() so reports survive policy-violation failures, and service-account tokens for CI. Includes a downloadable step-by-step guide.
https://doubleopen.io/articles/compliance-scans-github-actions

### Compliance on Rails: Running ORT Server Scans from Bitbucket Pipelines
By Martin von Willebrand (2026-08-25)
How to run Eclipse Apoapsis (ORT Server) compliance scans from Bitbucket Pipelines: why push triggers alone miss newly published advisories, how to pick a scan schedule from triage capacity, using after-script and capture-on: always so reports survive policy-violation failures, and why a read-only service account is the right credential for CI. Includes a downloadable step-by-step guide.
https://doubleopen.io/articles/compliance-scans-bitbucket-pipelines

### How Sovereign Is Your Compliance Stack?
By Martin von Willebrand (2026-07-02)
Scoring a compliance platform against the EU Cloud Sovereignty Framework (SEAL levels), and what full digital sovereignty looks like when the platform itself is open source -- including CRA and NIS2 accountability implications.
https://doubleopen.io/articles/sovereign-software-compliance

### Trust, but Verify: Making AI Compliance Legally Defensible
By Double Open (2026-06-01)
How Double Open's Agentic layer combines deterministic ORT data, anchored authority, and human-in-the-loop guardrails to make AI-assisted compliance auditable and legally defensible.
https://doubleopen.io/articles/trust-but-verify-ai-compliance

### EU Cyber Resilience Act (CRA) Primer: What Every Manufacturer Needs to Know
By Martin von Willebrand (2026-02-25)
A comprehensive primer on the EU Cyber Resilience Act -- scope, timelines, penalties, and a practical 7-step compliance journey for manufacturers of products with digital elements. Includes a downloadable CRA Compliance Primer PDF.
https://doubleopen.io/articles/cra-primer

### The Board's Guide to CRA & NIS2: From Sanctions to Auditable Compliance
By Martin von Willebrand (2025-11-17)
How boards can turn CRA and NIS2 compliance from a legal obligation into a strategic advantage: the capabilities the regulations demand are the ones that let an organization ship software with confidence. Covers the fines at stake, three board-level actions -- own the risk, mandate a secure-by-design process, demand continuous verification rather than reports -- and how tooling makes evidence generation an automated part of the normal software process. The OSS Review Toolkit ecosystem fits because it is built for automation, fully open source and deterministic, so results stay transparent and reproducible under audit.
https://doubleopen.io/articles/board-guide-cra-nis2

### The Definitive 9-Step Logic for Open Source License Compliance
By Martin von Willebrand (2025-11-11)
After 20+ years of FOSS license compliance, the core logic is consistent, robust, and fully automatable. A step-by-step breakdown covering dependency analysis, source code scanning, license matching, rule application, curation, and artifact generation.
https://doubleopen.io/articles/navigating-open-source-compliance

### Open Source Licenses as an Automation-Ready Classification
By Double Open (2025-11-11)
How Double Open's license classification system maps 800+ licenses into actionable categories for automated policy enforcement.
https://doubleopen.io/articles/oss-licenses-automation-classification

### Are Security Pros Missing the Real Point of the CRA's "Risk Assessment"?
By Martin von Willebrand (2025-11-07)
Why the CRA's Article 13 cybersecurity risk assessment is not what security teams assume. The name suggests operational work like vulnerability triage, but the CRA means an inherent risk assessment: the documented output of a threat model produced before any code is written, not a vulnerability report after. Its primary job is scoping -- the only legal mechanism for justifying whether and how each Annex I requirement applies to a product. For the 90% of products in the Default Category that self-assess, it is also the entire legal defense: a weak or missing assessment leaves the compliance claim with nothing to stand on.
https://doubleopen.io/articles/cra-risk-assessment-misconception

### Solving "Curation Hell": Why Compliance Teams Clear the Same Findings Over and Over
By Martin von Willebrand (2025-10-30)
How Double Open Server's file-level caching and clearance re-use eliminates the bottleneck of manual license curation.
https://doubleopen.io/articles/curation-hell-solution

### OSS Review Toolkit: The Credible, Open-Source Alternative for Software Compliance
By Martin von Willebrand (2025-10-23)
Many teams choosing license and security compliance tooling have missed that a comprehensive open source alternative exists. The OSS Review Toolkit ecosystem automates the entire workflow -- dependency analysis, license detection, vulnerability detection, policy evaluation and compliance artifact generation -- and being open source adds transparency, auditability, extensibility and no vendor lock-in. Double Open builds on it with a professionally maintained ORT service and Double Open Server, which adds 10x faster scans and globally reusable license clearances, delivered as EU-hosted SaaS or supported in-house.
https://doubleopen.io/articles/ort-open-source-compliance

### NIIS: Transforming OSS Compliance with Automated Tooling
By Double Open (2022-07-14)
How Nordic Institute for Interoperability Solutions reduced compliance time and administrative burden while improving compliance maturity using ORT and Double Open.
https://doubleopen.io/articles/niis-case-study

## Comparisons

### vs. Legacy SCA Scanners (e.g., Black Duck, Snyk, FOSSA, WhiteSource/Mend)
Double Open leverages the ORT Analyzer as part of its stack -- the gold standard for full, deep dependency analysis. ORT captures transitive dependencies exactly as they are built, providing empirical certainty over proprietary black-box rules. Legacy scanners often produce shallow results based on metadata guesswork, leading to false positives and missed dependencies.

### vs. Vanilla ORT
Double Open adds a performance layer (DOS) for 10x faster scans, an intuitive multi-tenant UI, managed enterprise support, pre-configured rule sets, professional clearance data, and CRA-focused documentation workflows.

### vs. SBOM-Only Tools
Generating an SBOM is only step one. Double Open provides the complete compliance workflow: scanning, license classification, rule enforcement, clearance management, and audit-ready artifact generation.

## FAQ

**Q: What is Double Open?**
A: Double Open is a Finnish company providing automated software supply chain governance. We help enterprises achieve security and license compliance for their software products, with a focus on EU regulations like CRA, NIS2, and DORA.

**Q: How does Double Open differ from legacy SCA scanners?**
A: We leverage the ORT Analyzer -- the gold standard for full, deep dependency analysis -- providing empirical certainty over proprietary black-box rules. Unlike shallow scanners, ORT captures transitive dependencies exactly as they are built, and our file-level caching via Double Open Server provides 10x performance improvement.

**Q: How does Double Open differ from vanilla ORT?**
A: Double Open adds a performance layer (DOS) for 10x faster scans, an intuitive multi-tenant UI, managed enterprise support, pre-configured rule sets, and professional clearance data.

**Q: What is an SBOM?**
A: A Software Bill of Materials -- a machine-readable inventory of all components in a software product, including their licenses, versions, and relationships. Required under CRA for products with digital elements sold in the EU.

**Q: What is the Cyber Resilience Act (CRA)?**
A: EU regulation requiring manufacturers and importers of products with digital elements to demonstrate cybersecurity due diligence. Requirements include maintaining SBOMs, establishing vulnerability handling processes, and producing technical documentation (Annex VII). Non-compliance can result in fines up to EUR 15 million or 2.5% of global turnover.

**Q: Is there a practical checklist for CRA compliance?**
A: Yes. The OpenChain CRA Compliance Checklist (Linux Foundation, CC-BY-4.0, https://github.com/OpenChain-Project/CRA-Compliance) holds 182 requirements in nine sections, each citing the CRA article or Annex I point it implements, with an applicability table by role for manufacturers, importers, distributors and open source stewards. Double Open contributes to it, including the cybersecurity risk assessment section and a review against Regulation (EU) 2024/2847. Completing it does not make a product compliant; it shows what compliance requires of a given organisation. See https://doubleopen.io/articles/openchain-cra-compliance-checklist

**Q: What is the ORT (OSS Review Toolkit)?**
A: An open source toolkit for software composition analysis, license compliance, and vulnerability detection. Created by Sebastian Schuberth (Double Open CTO) and maintained by a global community. ORT is the most comprehensive open source compliance toolset available and is used by major European brands. See adopters: https://github.com/oss-review-toolkit/ort/blob/main/ADOPTERS.md

**Q: Is Double Open open source?**
A: The underlying tools are open source under Apache-2.0 and MIT licenses: the OSS Review Toolkit (hosted by the Linux Foundation), ORT Server (the Eclipse Apoapsis project at the Eclipse Foundation) and Double Open Server. Double Open Compliance is a managed service built on these open foundations. The Double Open License Classification (800+ licenses) is available under CC0 (public domain).

**Q: What is Eclipse Apoapsis and how does Double Open relate to it?**
A: Eclipse Apoapsis is the Eclipse Foundation project that provides a process and a reference implementation for large-scale software composition analysis based on the OSS Review Toolkit. The reference implementation is the software called ORT Server: Eclipse Apoapsis is the project name, ORT Server is the software. Double Open employs the project lead, Martin Nonnenmacher (co-lead with Marcel Kurzmann of Robert Bosch GmbH), is the largest contributing organisation according to the Foundation's project statistics (https://projects.eclipse.org/projects/technology.apoapsis/who), and operates ORT Server as Double Open Compliance. Double Open is an Eclipse Foundation member. See https://doubleopen.io/articles/eclipse-apoapsis

**Q: Is Double Open part of the Eclipse Foundation's CRA toolkit (OCCTET)?**
A: Yes. OCCTET (Open Source Compliance: Comprehensive Techniques and Essential Tools, https://occtet.eu) is an EU-funded project coordinated by the Eclipse Foundation, and Double Open is one of the consortium partners, responsible for automated analysis and management. The toolkit, released on 10 September 2026, uses Eclipse Apoapsis (ORT Server) to identify open source components, dependencies, licenses and known vulnerabilities and to generate SBOMs. The toolkit is the Foundation's and is free to use; Double Open Compliance is a separate, hosted and supported instance of the same engine.

**Q: Where is data hosted?**
A: All data is hosted in EU-controlled datacenters, ensuring full GDPR compliance and strategic sovereignty. Managed In-House deployment is also available for organizations requiring complete data control or air-gapped environments.

**Q: What package managers are supported?**
A: ORT supports 20+ package managers including Maven, Gradle, npm, Yarn, pnpm, PyPI, Go modules, Cargo, NuGet, CocoaPods, Swift Package Manager, Composer, Bundler, Conan, Pub, and more.

**Q: What SBOM formats are supported?**
A: CycloneDX (multiple versions), SPDX (versions 2.2, 2.3, 3.0), and ORT's native formats. Since ORT is open source, custom format support can also be contributed.

**Q: How does the clearance re-use work?**
A: Double Open Server stores scan results and human clearance decisions at the individual file level. When a file has been scanned and curated once (e.g., correcting a false positive), that clearance is automatically applied everywhere that exact same file appears -- across all projects, teams, and organizations. This saves approximately 90% of manual curation effort.

**Q: Can Double Open work in air-gapped environments?**
A: Yes. The Managed In-House deployment model supports air-gapped environments. ORT and all supporting tools can run entirely within your own infrastructure.

**Q: How does Double Open use AI / agents?**
A: Double Open's Agentic Layer (MCP Server) sits on top of the deterministic ORT substrate. After the ORT engine runs a mathematical scan and applies mass clearances, framework-anchored agents apply peer-reviewed legal and security rule sets to make auditable judgments on the clear-cut bulk of compliance work. Agents act as junior curators -- they never make final decisions. They handle vulnerability triage (CVE reachability, deployment posture) and license curation (DOFCG v1.0), and package the remaining high-ambiguity exceptions as version-controlled pull requests for human sign-off.

**Q: How are agent outputs kept auditable and legally defensible?**
A: Four guardrails: (1) a deterministic substrate produces algorithmically derived inputs before the agent sees anything; (2) judgments are anchored to peer-reviewed frameworks (DOFCG v1.0 plus optional customer anchors), not opaque model weights; (3) every clearance is SHA256-anchored and written to a Shared Commons, producing a 10-year+ audit trail; (4) agents are continuously regression-tested against human-reviewed gold fixtures so correctness is a measurable, trackable software metric rather than a probabilistic black box. Final sign-off always goes through a human-reviewed pull request.

## Contact

Double Open Oy
Etelaesplanadi 22A, P.O. Box 232
00101 Helsinki, Finland
Website: https://doubleopen.io
GitHub: https://github.com/doubleopen-io
LinkedIn: https://www.linkedin.com/company/doubleopen/