Turn operational reality into reviewable compliance evidence.
Quality Runtime connects what a standard requires, the control your organization uses to address it, and the evidence that the control was operated — in one record with history and attribution built in.
- requirement
Access to information and other associated assets shall be restricted to authorized users.
STD-1 · 5.15 - mappingintended to address
- control
Quarterly review of privileged access
active · every 90 days - evidence
access-review-2026-q3.csv
uploaded 18 Sep 2026 - attestation
“Every privileged account in this export was reviewed; three were removed.”
Dana Okafor, Security Lead · 18 Sep 2026
Illustrative record · not current product UI
The problem
Conformity is usually demonstrated with documents: a spreadsheet of controls, a folder of screenshots, policies, shared drives, and what a few people remember.
The information exists, but the links between it do not. Before every review, the story has to be reconstructed by hand.
The model
One loop keeps the record connected: a requirement, the control intended to address it, and the evidence that the control was operated.
What a standard asks for.
The control used to address it.
What shows the control was operated.
mapped means intended to address — not that the requirement is met. Quality Runtime keeps the record; people and auditors still make that judgement.
That model is built to answer questions that otherwise require a person:
- Which requirements have no control mapped?requirement · no mapping
- What evidence supports this control?control → evidence
- Who attested this evidence, and when?evidence → attestation
- Apache-2.0
- PostgreSQL is the only required backing service
- Built in public
Why the record holds up
Enforced in PostgreSQL
Tenant isolation, the append-only audit log, and the finality of attested evidence are database rules, not application conventions.
Recorded, not overwritten
What was relied on is retired rather than silently replaced, and its history stays readable.
Attributed
Changes name who made them, and an attestation records who vouched for a piece of evidence.
One API, the same rules
People, scripts, integrations, and eventually agents operate through the same self-describing API, with no privileged bypass; domain changes are audited.
Where it stands
Quality Runtime is in early development and not ready for production. This is what exists today.
What works
- The schema for the whole loop, with tenancy and finality enforced by PostgreSQL.
- Standards can be imported through the API.
- Controls can be created, activated, retired, mapped to requirements, and discarded while still draft. Changes are audited and remain readable as history.
Not yet
- Evidence and files are not reachable through the API.
- There is no user interface and no deployment artifact.
- Audits, risks, findings and CAPAs do not exist yet.
- Pre-1.0: the API and schema may change.
If you have to produce this kind of record, we want to hear how you do it today.