Built for the journey
we're on ourselves.
CycleQA AS runs its own compliance programme in CycleQA. Not a demo. The real system — the same risks, NCRs, supplier relationships, and policy documents that any regulated company manages. This is what that looks like.
The situation every regulated company knows
You build a product. You find customers. You enter a regulated market — or your customer is already in one and asks about your security posture. Then someone hands you the ISO 27001 control list and the gap between where you are and where you need to be becomes very concrete, very fast.
CycleQA AS was incorporated on 8 May 2026. The compliance programme started the same week. That is exactly where CycleQA AS is today. A SaaS company serving precision manufacturers in regulated industries across DACH and Scandinavia — customers who hold their suppliers to the same standard they hold themselves. We are on the same journey. We manage it in the same system.
The tool doesn't assume you're already compliant. It helps you get there — by making open items visible, owned, and moving. We built that because we needed it ourselves.
Our own QMS, running our own compliance
CycleQA AS was created in May 2026 and immediately started a realistic ISO 27001 gap closure programme. Not as a sales demonstration — as an active compliance project that we are working through in production.
Every one of those items is live in the system right now, with due dates, assigned owners, and links connecting risks to NCRs to documents to the overarching situation. When we sit down with you for a pilot conversation, we open the app — not a slide deck.
How the system works in practice
ISO 27001 is not just a list of controls to tick. It requires you to identify risks, raise findings against your own procedures, track them to closure, and maintain evidence that you did. CycleQA structures that workflow across five interconnected modules — and we use all five of them for our own programme.
The closure programme — a real project, not a plan
Compliance programmes fail when they exist only in spreadsheets and meeting notes. Ours exists in CycleQA — with a situation number, phase milestones, and every open item linked to an owner and a due date. The system is the accountability mechanism.
NCR-002 (incident response) · NCR-003 (asset inventory) · NCR-004 (data classification) → 2026-06-15
What this means when you're evaluating us
Every QMS vendor will tell you their platform is secure, auditable, and built for regulated environments. We can show you ours — live, in the same production system your data would run on, with the same workflows your team would use.
More importantly: we understand where you are. If you are entering a regulated market, preparing for a supplier audit, or responding to a customer's ISO 27001 questionnaire — we have been in that exact position. The tool was built to solve it, because we needed to solve it ourselves.
Discipline fades. Good people leave. The companies that endure are where the workflow carries the standard — where doing it right is faster than not doing it right, because the system makes it easy. That applies to us too.
When we meet for a pilot conversation, we will open the app and walk you through our own risk register, our own open NCRs, our own policy documents. Not a curated demo database. The real system. The honest picture. You can judge the tool by how we use it.