Mynder is a European platform for compliance, risk and supplier management — Trust Center with Trust Profiles, Supplier Module, Mynder Core, and agent access over MCP.
Why Mynder
Mynder is a European platform for compliance, risk, and supplier management, built in Norway and launched in 2023. The platform is made up of three standalone products — Mynder Trust Center with Trust Profiles, the Supplier Module, and Mynder Core — and is also sold as agent access over MCP, so a customer's own AI agents can work directly against the platform.
Mynder Core competes directly with Vanta, Drata, and OneTrust as a compliance governance system. What sets Mynder apart isn't Core on its own, but the whole picture: a reusable trust profile that works both ways between organisations, real depth in European regulation such as NIS2, Normen, and the Cyber Resilience Act, an architecture built agent-first rather than bolted on afterwards, and a platform built for IT partners to deliver compliance as an ongoing service.
Mynder has customers and partners in Norway and Sweden, with Helse Vest IKT as a pilot and validation environment for the Supplier Module and Mynder Core. The company was named NORA.ai Startup of the Year 2025.
What Mynder is
Mynder Trust Center and Trust Profiles
An organisation documents its security, privacy, and compliance posture once, in a Trust Profile, which can then be shared with and reused by anyone who asks for documentation — customers, partners, auditors, regulators. The profile shows Trust Score, Coverage, and Confidence. Trust Center is the registry where profiles are created and maintained, and it works even if the organisation already uses another governance tool.
Supplier Module
Mapping, classification, assessment, and ongoing monitoring of suppliers and third parties. A customer can create a working profile for a supplier even if that supplier doesn't have a Trust Profile of its own. Where the supplier already has one, it's reused. Findings and risk can be passed on to Mynder Core or to the customer's existing tools.
Mynder Core
Mynder Core maps how the organisation actually fits together — processes, systems, personal-data processing, risk, and criticality — into one coherent, current picture instead of separate registers. Privacy is built into the mapping, not a bolt-on module. Ownership, controls, and documented evidence are all tied back to that picture.
Customers choose their own level of AI — from fully manual entry, through partial automation, to agent-driven work over MCP.
What sets Mynder apart
1. Agent first
Comparable platforms deliver value through an interface you log into. Mynder makes a capability available to agents first, with a user interface on top if you want a dashboard.
2. Not the system that holds your data
Mynder isn't competing to own your systems or your data. Established systems get stronger, not weaker, when agents can use them — Mynder's role is the governance work across them.
3. Verified evidence, not just verified answers
Other AI platforms verify by having multiple models triangulate the same claim — that's verification of insight. Mynder verifies evidence: an action tied to a source, a requirement, an approver, and a date.
4. The trust profile runs both ways
Vanta and Drata each offer a "Trust Center" — a public page where a company shows off its own security posture. That's one-directional. Kertos is working on a similar idea for cross-network reuse, and Whistic runs an established network where supplier profiles are published and reused by buyers — so Mynder isn't alone in this thinking. Mynder's Trust Profile is two-way: the same profile you use to document yourself is the profile your customer uses to assess you, and the profile you use to assess your own suppliers. That creates a network effect: the more organisations that have a profile, the less work for everyone else to assess them.
5. European regulation from the ground up, not bolted on
The American platforms are built around SOC 2 and ISO 27001, with European regulation added afterwards. Mynder is built the other way round — as is Kertos — and Mynder also covers Nordic-specific frameworks such as Normen. The platform covers a growing number of regulations and frameworks, with real depth today in NIS2, GDPR, DORA, the Cyber Resilience Act, the EU AI Act, and Normen.
6. Built for IT partners to deliver the service
Mynder is built as a sales and delivery platform for MSPs and MSSPs: the partner gets their own workspace, regulation mapped against the services they sell, and the ability to deliver ongoing compliance to many customers at once. The large platforms are sold primarily direct to the end customer.
7. You choose your level of AI
From no automation at all to fully agent-driven. For organisations in critical infrastructure this isn't a nice-to-have — it's often the only way they can adopt AI in their governance processes at all.
8. MCP is something we sell, not just something we have
Customers can connect their own agents directly to Mynder over MCP, so compliance work happens where the work already happens. It's part of what we sell, not just a technical mechanism. Mynder also runs training and workshops for organisations that want to set up MCP in-house.
9. It works alongside what you already have
Trust Profile and the Supplier Module don't require a customer to switch governance tools. Mynder is built to work alongside existing platforms rather than replace them outright.
10. Enterprise Canvas
For the largest customers, Mynder also offers a customer-specific Canvas — the customer's own value flows and governance model, built on the platform and operated by Mynder. A separate offering, separately priced, and clearly distinct from the standard product.
The market map: who does what
Compliance isn't one market — it's several that overlap. Compare Mynder to the wrong category and you get the wrong answer.
Where Mynder resembles other players
Kertos
Kertos (Munich/Berlin, founded 2021) is the closest comparable player — built for European regulation from the ground up, covering GDPR, ISO 27001, ISO 42001, NIS2, DORA, and TISAX. Over 70 employees, and raised a €14 million Series A led by Portage in autumn 2025. Kertos also has a concept for cross-organisation reuse of documentation (a "Peer-to-Peer Trust Graph").
The difference is in go-to-market: Kertos pairs its platform with its own certified experts and sells direct. Mynder runs three tracks: directly into critical infrastructure where requirements are strictest (Helse Vest IKT is testing the Supplier Module and Mynder Core in pilot), through MSPs/MSSPs who deliver Mynder on to their own customers, and as a connector — a customer finds and uses Mynder directly from Claude or ChatGPT without buying the platform first. That third track is a real difference today; it may become less distinctive over time.
Whistic and the TPRM platforms
Whistic (Utah, founded 2015) is closest to the Trust Profile idea in practice, not just in concept: a supplier publishes its security profile once, in what Whistic calls its Trust Catalog, and buyers can reuse it directly through what Whistic itself calls a "Zero-Touch Assessment" instead of sending a fresh questionnaire. Sources differ on how many profiles the catalogue holds, so we won't put a number on it here either. The difference: Whistic is built around American frameworks (SOC 2, CAIQ, the CSA STAR registry) and is, at its core, a supplier-risk assessment and questionnaire tool — not a full governance system with European regulation built in the way Trust Profile connects to Mynder Core. The rest of the category — Panorays, UpGuard, SecurityScorecard, Bitsight — mainly assess suppliers from the outside, through scanning and risk scores.
Regulatory intelligence, AI governance, and enterprise GRC
CUBE, Corlytics, Regology, and FinReg-e answer "what changed?" — Mynder answers "who complies with it, and can we prove it?" Credo AI, Holistic AI, Trustible, and Modulos go deeper at the model level (bias, drift, testing individual models) than Mynder does. ServiceNow, Archer, MetricStream, AuditBoard, and LogicGate are built for large organisations with dedicated GRC teams; Mynder doesn't replace an established enterprise platform, but Trust Profile and the Supplier Module can sit on top of one.
Organisations in critical infrastructure — healthcare, finance, energy, public sector — facing NIS2, DORA, or Normen
Suppliers repeatedly asked to document their security in tenders and customer relationships
MSPs and MSSPs who want to sell compliance as an ongoing service
Organisations adopting their own AI agents that need compliance work to be callable by them
Organisations that want a European supplier for regulatory reasons
US SaaS companies where SOC 2 is the whole need — Vanta or Drata are the better choice
Large enterprises with a mature privacy programme in OneTrust that just need more modules in the same stack
Fast-growing German/Central European companies that mainly need ISO 27001/TISAX with expert support — Kertos is a good fit there
Organisations mainly looking to monitor regulatory change across jurisdictions in financial services — CUBE, Corlytics, or FinReg-e are the better fit
Organisations that need deep technical governance of their own AI models — Credo AI, Holistic AI, or Modulos are the better choice
Frequently asked questions
About the company
Mynder AS — org. no. 831 377 372. Founded 2023 in Bergen, Norway. Edvard Griegs vei 3C, 5059 Bergen.
CEO and founder: Synnøve Olset. Co-founders: Sue Janne Alsaker, Borghild Marie Midttun.
Customers and partners in Norway and Sweden
Pilot and validation environment in healthcare: Helse Vest IKT (Supplier Module and Mynder Core)
Supported by Innovasjon Norge
Member of the research networks aiD (NTNU/SINTEF/SimulaMet), NORA.ai, and HAT-CI
Named NORA.ai Startup of the Year 2025
"Mynder" is a registered trademark with the Norwegian Industrial Property Office, reg. no. 342612