Quality standards

MyWay is not a quality management system; it provides the controls you need to manage the documents of one. No software can be “ISO 9001 certified” - certification is granted to an organization, not to a tool. This page maps each capability to the clause it addresses, plainly enough to show your auditor.

ISO 9001:2015 · clause 7.5 Documented information

• 7.5.2 Creating and updating (identification and description, format, review and approval) · Document code and title, QMS version number, author and date; an approval chain or a formal review before publication.
• 7.5.3.1 Being available and suitable for use, and adequately protected · Page-level permissions (user / role / group × view / comment / edit), self-hosting, a documented backup procedure.
• 7.5.3.2 Distribution and access, storage and preservation, change control, control of obsolete documents · Full version history, diff and rollback between versions, draft / published / archived states, publish lock while a review is open.
• Who did what and when · Audit logs (actor, event, target, timestamp) and the review’s PDF audit report.

ISO 10013:2021 · Guidance for documented information

ISO 9001 does not impose a numbering scheme; it only requires documents to be uniquely identifiable. The coding design therefore follows the guidance in ISO 10013: meaning is carried by the prefix (never by the number), numbers are not reused, gaps in a series are normal, and the code stays fixed for the life of the document in a field separate from the version.

IEEE 1028-2008 · Software reviews and audits

• Defined roles · The person running the review, participants whose approval is required, optional participants.
• Anomaly classification · Critical, major, minor, editorial - fixed, never per-board, otherwise comparison loses its meaning.
• Disposition · Accepted, accepted with conditions, rejected, duplicate, deferred; rejections and conditional decisions require a written reason.
• Entry and exit criteria · The document freezes and the page cannot be published while a review is open; on exit approvals are complete and the published version is recorded.
• Records and reporting · Rounds, who wrote how many comments, who never opened it, decisions and their reasons, all in a one-page PDF report.

ISO/IEC 27001:2022 · supporting controls

On the information-security side MyWay does not deliver conformity by itself; it contributes to the controls of your installation: Annex A 5.15 access control (role and group based permissions), 5.33 protection of records (version history, archiving, deletion constraints), 8.15 logging (audit logs). Since where the data lives and who reaches it stays entirely within your infrastructure, data-sovereignty requirements remain in your hands.

Out of scope, deliberately

• 21 CFR Part 11 (electronic records and signatures) · MyWay has approvals, but not electronic signatures in the Part 11 sense: cryptographic binding of a signature to a record, signature manifestation and separate authentication components for signing are not implemented.
• ISO 13485 (medical devices) and GxP · The document-control clauses are similar, but these domains additionally require a validation file and electronic signatures; MyWay makes no claim to provide them.
• Maturity models such as Automotive SPICE or CMMI · An assessment looks at the maturity of your processes, not at the tool you use. MyWay helps you record those processes; it does not produce your conformity.