Quality standards

MyWay is not a quality management system; it provides the controls you need to manage the documents of one. No software can be “ISO 9001 certified” - certification is granted to an organization, not to a tool. This page maps each capability to the clause it addresses, plainly enough to show your auditor.

ISO 9001:2015 · clause 7.5 Documented information

• 7.5.2 Creating and updating (identification and description, format, review and approval) · Document code and title, QMS version number, author and date; an approval chain or a formal review before publication, and the space’s publish rule makes one or both mandatory for every publication. Writing, publishing and deleting are separate permissions, so the author and the person who releases a document can be different people.
• 7.5.3.1 Being available and suitable for use, and adequately protected · Page-level permissions (user / role / group × view / comment / edit), self-hosting, a documented backup procedure.
• 7.5.3.2 Distribution and access, storage and preservation, change control, control of obsolete documents · Full version history, diff between a chosen version and the current content, rollback, every published version kept read-only with its content and attachments as published (access to earlier versions, PDF/Word export, the valid version marked with a "current" badge, an attachment used in a publication kept even if it is deleted later), draft / published states and a publication record that cannot be undone (a published document cannot be unpublished), publish lock while a review is open or an approval is pending, and an edit lock on an approved document until it is published; commenting is a separate "Comment on documents" permission.
• Who did what and when · Audit logs (actor, event, target, timestamp), the document’s History tab (creation, field changes, restores, publications, code, moves, review and approval steps) and the review’s PDF audit report.

ISO 10013:2021 · Guidance for documented information

ISO 9001 does not impose a numbering scheme; it only requires documents to be uniquely identifiable. The coding design therefore follows the guidance in ISO 10013: meaning is carried by the prefix (never by the number), numbers are not reused, gaps in a series are normal, and the code stays fixed for the life of the document in a field separate from the version.

IEEE 1028-2008 · Software reviews and audits

• Defined roles · The submitter (the owner of the process), participants whose approval is required, optional participants.
• Anomaly classification · Critical, major, minor, editorial - fixed, never per-board, otherwise comparison loses its meaning.
• Disposition · Accepted, accepted with conditions, rejected, duplicate, deferred; rejections and conditional decisions require a written reason.
• Entry and exit criteria · With the publishing rule on, a completed review is required before publishing, and when an approval is required too, their order (review first or approval first) can be fixed by the rule; the document freezes and the page cannot be published while a review is open; on exit approvals are complete, the document stays locked until it is published, and the published version is recorded. When an optional final approval deadline expires, a required participant who has not responded is either counted as approved or no longer awaited; the choice is recorded on the review and the completion is logged in the document history as due to the deadline.
• Records and reporting · Rounds, participants, who wrote how many comments, who raised and who decided each finding, decisions and their reasons; on screen and in the PDF report.

ISO/IEC 27001:2022 · supporting controls

On the information-security side MyWay does not deliver conformity by itself; it contributes to the controls of your installation: Annex A 5.15 access control (role and group based permissions), 5.33 protection of records (version history, published versions, publication record, a separate "Delete documents" permission), 8.15 logging (audit logs). Since where the data lives and who reaches it stays entirely within your infrastructure, data-sovereignty requirements remain in your hands.

Out of scope, deliberately

• 21 CFR Part 11 (electronic records and signatures) · MyWay has approvals, but not electronic signatures in the Part 11 sense: cryptographic binding of a signature to a record, signature manifestation and separate authentication components for signing are not implemented.
• ISO 13485 (medical devices) and GxP · The document-control clauses are similar, but these domains additionally require a validation file and electronic signatures; MyWay makes no claim to provide them.
• Maturity models such as Automotive SPICE or CMMI · An assessment looks at the maturity of your processes, not at the tool you use. MyWay helps you record those processes; it does not produce your conformity.