Runtime Application Self-Protection (RASP)

SprinD GmbH

The implementation of the revised eIDAS regulation (electronic Identification, Authentication and Trust Services) requires the creation of a secure and user-friendly ecosystem. As a milestone for Europe's digital sovereignty, its core element is the European Digital Identity Wallet (EUDI Wallet), which serves as the regulation's central instrument. By the start of 2027, all EU citizens and residents should have access to a trustworthy, interoperable, and non-discriminatory digital wallet for identification, attribute attestations, electronic signatures, and more. The EUDI Wallet aims to simplify users' daily lives while enabling companies and administrations to benefit from faster, more secure, and more efficient digital processes. In Germany, the rollout of the EUDI Wallet is a joint effort by the Federal Ministry for Digital and State Modernization (BMDS) and SPRIN-D - the Federal Agency for Breakthrough Innovation. Since June 2023, the initiative has followed an open architecture and consultation process involving business, civil society, and science, with a focus on security, privacy, user-friendliness, and innovation. Germany"s dual strategy supports both a national EUDI Wallet as well as alternative EUDI Wallets. The roadmap includes a sandbox rollout of the identity (PID) function by the end of 2025 and further enhancements and production rollout throughout 2026. In this tender, the client is seeking a Runtime Application Self-Protection (RASP) solution to provide an additional layer of runtime security for its wallet applications on iOS and Android. The objective is to enhance protection against runtime threats, obfuscate the code and support privacy provisioning and telemetry. The scope covers the procurement and integration of the RASP solution with the described functionality.

Deadline

Deadline 2026-06-05

Wer?

• SprinD GmbH

Wie?

• Softwarepaket und Informationssysteme › Branchenspezifisches Softwarepaket

Wo?

• Köln › Bonn, Kreisfreie Stadt
• Leipzig › Leipzig, Kreisfreie Stadt

Geschichte der Beschaffung

Datum	Dokument
2026-05-05	Auftragsbekanntmachung

Auftragsbekanntmachung (2026-05-05)
Objekt
Umfang der Beschaffung
Titel: Runtime Application Self-Protection (RASP)
Referenznummer: EIN-1380
Kurze Beschreibung:

Art des Vertrags: Lieferungen
Produkte/Dienstleistungen: Branchenspezifisches Softwarepaket 📦
Geschätzter Wert ohne MwSt: 2 500 000 EUR 💰
Beschreibung
Interne Kennung: EIN-1380
Zusätzliche Informationen:

The figure given for the estimated contract value relates to the contract term, including extension options, and thus covers a period of up to 54 months.

Zusätzliche Produkte/Dienstleistungen: Softwarepaket und Informationssysteme 📦
Postanschrift: Lagerhofstr. 4
Postleitzahl: 04103
Stadt: Leipzig
Land: Deutschland 🇩🇪
Ort der Leistung: Leipzig, Kreisfreie Stadt 🏙️
Dauer: 30 Monate
Maximale Verlängerungen: 2
Weitere Informationen zur Verlängerung:

SPRIND GmbH has the option to extend the contract two times, each time for one year.

Informationen über Optionen
Optionen ✅
Beschreibung der Optionen:

The scope of services may, by mutual agreement between the parties, be supplemented or specified in more detail to include comparable services related to the scope of services as set out in clause 1.4 and the service description, provided that such services do not materially alter the original scope of services. If a backend is required, the Licensor warrants that this component can be operated on the Client"s infrastructure or that of its designated subcontractors; at the same time, the Licensor warrants that the SDK supports standalone operation without a backend. Acceptance shall take place following successful integration and functional testing of the SDK and, where appli-cable, the backend against the specifications set out in this Agreement, and the Licensor un-dertakes to rectify any material deviations within the response and rectification periods agreed in this Agreement. For further details. please refer to the tender documents.

Titel
Los-Identifikationsnummer: LOT-0001

Verfahren
Art des Verfahrens
Offenes Verfahren ✅
Rechtsgrundlage: Richtlinie 2014/24/EU
Administrative Informationen
Frist für den Eingang von Angeboten oder Teilnahmeanträgen: 2026-06-05 10:00:00 📅
Bedingungen für die Öffnung der Angebote: 2026-06-05 10:01:00 📅
Bedingungen für die Öffnung der Angebote (Ort): Bidders are not permitted to attend the opening of bids.
Sprachen, in denen Angebote oder Teilnahmeanträge eingereicht werden können: Englisch 🗣️
Mindestzeitraum, in dem der Bieter das Angebot aufrechterhalten muss: 2 Monate
Bedingungen für die Einreichung eines Angebots
Die Bieter können mehrere Angebote einreichen
Eröffnungstermin: 2026-06-05 10:01:00 📅
Ort des Eröffnungstermins: Bidders are not permitted to attend the opening of bids.
Elektronische Rechnungsstellung: Erforderlich
Elektronische Zahlung wird verwendet ✅
Frist für die Anforderung zusätzlicher Informationen: 2026-05-26 23:59:59 📅
Zusätzliche Informationen:

SPRIND GmbH asks - within its discretion - the bidder to submit, complete or correct documents, within the framework laid down by law (Section 56 (2) VgV).

Der Vertrag enthält Bedingungen zur Vertragsausführung ✅

Rechtliche, wirtschaftliche, finanzielle und technische Informationen
Bedingungen für die Teilnahme
Eignungskriterium: Eintragung in das Handelsregister
Liste und kurze Beschreibung der Regeln und Kriterien:

If the company is registered in the commercial register or a comparable register in the country of origin, submiission of a copy of the extract from the commercial register or equivalent proof from the respective country of origin (not older than 90 days at the time of expiry of the tender deadline) at the request of the client after expiry of the tender deadline. For foreign documents that are not written in German or English, a simple translation into German or English must be enclosed

Eignungskriterium: Durchschnittlicher Jahresumsatz
Liste und kurze Beschreibung der Regeln und Kriterien:

Self-declaration regarding the company's total turnover in the last three completed financial years provided that the relevant information is available. (e.g., companies that have not yet been in existence for three years must include the information since their inception).. Minimum requirement Total Turnover - average annual turnover of at least EUR 3,000,000.00 (net) Please use the relevant form "Appendix 01_Self-declarations and evidence".

Eignungskriterium: Referenzen zu bestimmten Lieferungen
Liste und kurze Beschreibung der Regeln und Kriterien:

At least three references from reference provider (RP) for the performance of comparable services/supplies (Providing Runtime Application Self-Protection (RASP) solutions for critical infrastructures, public sector, finance/banking, healthcare, insurance or crypto & fintech) since January 1, 2023, (it is sufficient that the relevant services were also provided in the reference period in the specified reference project, e.g., a reference that began on January 1, 2022, and ended on February 1, 2023, would be sufficient). The number of devices secured today (ongoing reference) or on exit (completed reference) must be minimum 50,000. Only references for providing Runtime Application Self-Protection (RASP) solutions for critical infrastructures, public sector, finance/banking, healthcare, insurance or crypto & fintech are permitted. Each reference must be either completed or ongoing. In the case of an ongoing reference specifications of the planned/contractual project duration and information on the current status must be included. The reference provider may be a public or private company in the above-mentioned required sector. Minimum requirements for each reference: 1. Since January 1, 2023 2. Completed and ongoing reference; if ongoing, specifications of the planned/contractual project duration and information on the current status of the reference project must be included 3. The respective reference must include providing Runtime Application Self-Protection (RASP) solutions for critical infrastructures, public sector, finance/banking, healthcare, insurance or crypto & fintech 4. Number of devices secured today (ongoing reference) or on exit (completed reference): minimum 50,000 5. The description must clearly and unambiguously show that at least the following services were provided, otherwise the reference will not be accepted: a. Providing Runtime Application Self-Protection (RASP) solutions for critical infrastructures, public sector, finance/banking, healthcare, insurance or crypto & fintech b. Please describe RASP functionalities that have been used and ramp-up of device count. Please use the relevant form "Appendix 01_Self-declarations and evidence".

Eignungskriterium: Berufliche Risikohaftpflichtversicherung
Liste und kurze Beschreibung der Regeln und Kriterien:

Self declaration to undertake to take out and maintain business liability insurance with the coverage amounts specified below in the event of an award. Insurance coverage shall be provided without restriction and in full for the entire duration of the contact. The sum insured is available twice per annum. Financial loss: At least EUR 1,0 million. Please use the relevant form "Appendix 01_Self-declarations and evidence".

Eignungskriterium: Zertifikate von unabhängigen Stellen über Qualitätssicherungsstandards
Liste und kurze Beschreibung der Regeln und Kriterien:

Self-declaration on ISO 27001 certificate or comparable. Upon request by SPRIND GmbH following the submission of a tender, the bidder will provide the relevant documentation.

Bedingungen für den Vertrag
Bedingungen für die Vertragserfüllung: Reference is made to the tender documents.
Bedingungen für die Teilnahme
Ausschlussgrund:

Beteiligung an einer kriminellen Vereinigung

Betrug

Der Zahlungsunfähigkeit vergleichbare Lage gemäß nationaler Rechtsvorschriften

+ 19 weitere

Direkte oder indirekte Beteiligung an der Vorbereitung des Vergabeverfahrens

Einstellung der gewerblichen Tätigkeit

Geldwäsche oder Terrorismusfinanzierung

Interessenkonflikt aufgrund seiner Teilnahme an dem Vergabeverfahren

Kinderarbeit und andere Formen des Menschenhandels

Korruption

Schwerwiegendes berufliches Fehlverhalten

Terroristische Straftaten oder Straftaten im Zusammenhang mit terroristischen Aktivitäten

Täuschung, Zurückhaltung von Informationen, Unfähigkeit zur Vorlage erforderlicher Unterlagen oder Erlangung vertraulicher Informationen zu dem Verfahren

Vereinbarungen mit anderen Wirtschaftsteilnehmern zur Verzerrung des Wettbewerbs

Verstoß gegen arbeitsrechtliche Verpflichtungen

Verstoß gegen die in den rein innerstaatlichen Ausschlussgründen verankerten Verpflichtungen

Verstoß gegen die Verpflichtung zur Entrichtung von Sozialversicherungsbeiträgen

Verstoß gegen die Verpflichtung zur Entrichtung von Steuern

Verstoß gegen sozialrechtliche Verpflichtungen

Verstoß gegen umweltrechtliche Verpflichtungen

Verwaltung der Vermögenswerte durch einen Insolvenzverwalter

Vorzeitige Beendigung, Schadensersatz oder andere vergleichbare Sanktionen

Zahlungsunfähigkeit

Beschreibung der Ausschlussgründe:

In accordance with Sections 123,124 GWB (Act Against Restraints of Competition), Section 21 AEntG (Posted Workers Act), Section 98c AufenthG (Residence Act), Section 19 MiLoG (Minimum Wage Act), Section 21 SchwarzArbG ( Act to Combat Illegal Employment) and Section 22 LkSG (Supply Chain Due Diligence…

… Act)

… Act).

Öffentlicher Auftraggeber
Name und Adressen
Name: SPRIND GmbH
Nationale Registrierungsnummer: HRB 36977 (AG Leipzig)
Postanschrift: Lagerhofstr. 4
Postleitzahl: 04103
Postort: Leipzig
Region: Leipzig, Kreisfreie Stadt 🏙️
Land: Deutschland 🇩🇪
Kontaktperson: Friedrich Graf von Westphalen & Partner mbB Rechtsanwälte
E-Mail: sprind.ausschreibungen@fgvw.de 📧
Telefon: +49697191890-12 📞
Art des öffentlichen Auftraggebers
Einrichtung des öffentlichen Rechts
Haupttätigkeit
Wirtschaft und Finanzen
Kommunikation
Dokumente URL: https://www.dtvp.de/Satellite/notice/CXP4D9LMNX2/documents 🌏
Teilnahme-URL: https://www.dtvp.de/Satellite/notice/CXP4D9LMNX2 🌏
URL des Beschaffungsinstruments: https://www.dtvp.de/Satellite/notice/CXP4D9LMNX2 🌏
Name: Communication shall only take place via the electronic procurement platform DTVP.
Elektronische Einreichung: Erforderlich

Ergänzende Informationen
Zusätzliche Informationen

#Bekanntmachungs-ID: CXP4D9LMNX2# The tender documents will be available in English. However, German (public proucurment) law applies and for the legally binding version of the contract is German version decisive.

Körper überprüfen
Name: Vergabekammer des Bundes
Nationale Registrierungsnummer: 022894990
Postanschrift: Kaiser-Friedrich-Straße 16
Postleitzahl: 53113
Postort: Bonn
Region: Bonn, Kreisfreie Stadt 🏙️
Land: Deutschland 🇩🇪
E-Mail: vk@bundeskartellamt.bund.de 📧
Fax: +49 2289499-163 📠
Verfahren zur Überprüfung
Genaue Informationen über Fristen für Überprüfungsverfahren:

According to Article 160, Section 3 of the German Act Against Restraint of Competition (GWB), application for review is not permissible insofar as 1. the applicant has identified the claimed infringement of the procurement rules before submitting the application for review and has not submitted a complaint to the contracting authority within a period of 10 calendar days; the expiry of the period pursuant to Article 134, Section 2 remains unaffected, 2. complaints of infringements of procurement rules that are evident in the tender notice are not submitted to the contracting authority at the latest by the expiry of the deadline for the application or by the deadline for the submission of bids, specified in the tender notice. 3. complaints of infringements of procurement rules that first become evident in the tender documents are not submitted to the contracting authority at the latest by the expiry of the deadline for application or by the deadline for the submission of bids, 4. more than 15 calendar days have expired since receipt of notification from the contracting authority that it is unwilling to redress the complaint. Sentence 1 does not apply in the case of an application to determine the invalidity of the contract in accordance with Article 135, Section 1 (2) Article 134, Section 1, Sentence 2 remains unaffected.

Informationen über elektronische Arbeitsabläufe
Die elektronische Rechnungsstellung wird akzeptiert
Bekanntmachungsangaben
Bevorzugtes Datum der Veröffentlichung: 2026-05-05+02:00 📅
Quelle: OJS 2026/S 088-313059 (2026-05-05)

Neue Beschaffungen in verwandten Kategorien 🆕

Softwarepaket und Informationssysteme (>20 neue Beschaffungen)

Branchenspezifisches Softwarepaket (13)