We hold none of your quality data
The apps run on Atlassian Forge. Documents, records, approvals, and audit trails stay in your Atlassian Cloud site, under your admin controls and your data residency setting.
TRUST AND SECURITY
Built by the people who do your audits
Qity works inside regulated quality systems every day, as a consultancy and as an app vendor. The same discipline applies to how we build and run the apps, and to how we handle personal data.
Audited continuously, not annually
Code, dependencies, and cloud configuration are scanned continuously through Aikido. The audit report is public, and you can request a current copy at any time.
Your data does not train models
Qity relies on Atlassian AI only, including Rovo and Forge LLM. Customer data is not used to train AI models unless a customer explicitly opts in where applicable.
Where your quality data lives
Qity apps run on Atlassian Forge. Your quality records stay in your own Atlassian Cloud site. Qity does not operate a separate backend that holds them.
Your Atlassian Cloud site
Documents, records, approvals, and audit trails are Jira and Confluence data in your tenant, under your admin controls and your data residency setting.
The Qity apps, on Forge
The apps run inside Atlassian's platform and read and write your data there. Qity has no separate copy of your quality records.
QITY, AS CONTROLLER
Website, support, and commercial data
Contact requests, support tickets, and commercial correspondence. Qity is the controller for this, and the privacy policy sets out the detail.
Which role Qity holds
Sub-processors
The full list of sub-processors used to deliver the apps and the services, with the purpose and processing location of each.
Qity notifies customers of changes to this list before a new sub-processor starts processing.
Documents
Aikido audit report
PUBLICGenerated on request, no NDA
Privacy policy
PUBLICVersion 1, effective 19 June 2026
Sub-processor list
PUBLICPublished on this page
Security whitepaper
ON REQUESTArchitecture, access control, and secure development
Data processing agreement
ON REQUESTTemplate for the services engagements
Incident and breach procedure
ON REQUESTSummarised below, full procedure on request
DATA PROTECTION CONTACT
Qity has a named data protection officer. Requests and questions go to dpo@qity.be, and the privacy policy sets out the full detail, including your rights.
If something goes wrong
Qity maintains an incident and breach procedure. Incidents are recorded, assessed for personal data impact, and escalated to the data protection officer. Where a personal data breach is confirmed and notification is required, the controller notifies the supervisory authority within 72 hours of becoming aware, and Qity notifies affected customers without undue delay where Qity acts as processor. The full procedure is available on request.
