Quinck is ISO 27001 and ISO 9001 certified

In short. Quinck is certified ISO/IEC 27001 for information security and ISO 9001:2015 for quality, with certification by Risk Control Advisory. ISO 27001 covers how we protect your data and your users' data, ISO 9001 how we make sure work always ships to the same standard. For anyone choosing a software house it means fewer unanswered questions in supplier questionnaires, tenders and security audits.

Which certifications does Quinck hold?

Two, both issued by Risk Control Advisory, an inspection and certification body:

ISO/IEC 27001, the international standard for information security management systems.
ISO 9001:2015, the international standard for quality management systems.

You can see both marks in the footer of every page on the site. To check the scope and validity of the certificate you can ask us for a copy: write to us from the contact page.

What is ISO 27001?

It is the standard that sets out how an organisation should manage information security. It does not certify a product or a single project: it certifies a management system, meaning the way the company works every day.

In practice it requires an organisation to:

identify the risks affecting its own data and systems and its clients';
choose and apply controls to reduce them, from system access to supplier management;
define clear responsibilities and incident procedures;
measure, review and improve all of it over time.

An independent third party checks that the system exists and really works, through periodic audits. Claiming to be secure is not enough.

What is ISO 9001?

It is the quality standard: how processes are planned, carried out and checked so results are repeatable. It rests on three things: the customer and their requirements, processes with defined responsibilities, and continual improvement based on data rather than impressions.

For a software house it means that the way requirements are gathered, software is built, tested and released does not depend on whoever happens to run the project.

What changes for people who work with us?

Three concrete things.

Less friction in questionnaires and audits. More and more companies ask software suppliers for security evidence before signing. A third-party certification answers most of those questions and shortens qualification time.
A reference in tenders and procurement. ISO certifications are often a requirement or a plus in tenders and supplier qualification.
Security and quality as a method, not a promise. The project starts from processes that are already defined and externally verified, not from good intentions.

An honest note: a certification does not replace legal obligations and does not make a project compliant by itself. For GDPR, NIS2 and sector rules, compliance is built into the project. ISO 27001 is still a solid base to start from, and for companies subject to NIS2, supply chain security is a real concern.

Why should a software house get certified?

Because software is where data travels. Whoever builds platforms, apps and integrations for other companies handles access, environments and information that are not theirs. Getting certified means accepting that someone checks, from the outside, how we protect them.

We have already worked with ISO 27001 requirements on real projects, such as the platform for diagnostic kits in clinical trials for Non Così Raro, built on a serverless AWS architecture with a complete audit trail and end-to-end encryption.

Want to know how we approach security?

You can read what we do on cloud, security and architecture in the Cloud and architectures page. If you need to qualify us as a supplier and want the certificate or a call with whoever runs security, get in touch.

Frequently asked questions

Is Quinck ISO 27001 certified?

Yes. Quinck is ISO/IEC 27001 certified, the standard for information security management systems, with certification by Risk Control Advisory.

Is Quinck ISO 9001 certified?

Yes. Quinck is ISO 9001:2015 certified, the standard for quality management systems, with certification by Risk Control Advisory.

What is the difference between ISO 27001 and ISO 9001?

ISO 27001 is about information security: risks, controls, access, incidents. ISO 9001 is about process quality and customer satisfaction. They complement each other: the first protects data, the second makes work repeatable and measurable.

Does ISO 27001 certification guarantee my project is GDPR compliant?

No. It certifies the company's management system, not the compliance of an individual project. It is a solid base, but GDPR and other obligations are built into the project from the start.