# Quality Clouds

> AI code governance for enterprise platforms and for any repository written with an AI editor. The independent governance layer for all human and AI-generated code across Salesforce, ServiceNow, Microsoft Dynamics, and Git.

Quality Clouds is an enterprise SaaS company that provides continuous, real-time code governance across the places where enterprise logic is created. Founded in 2017 in London, Quality Clouds is trusted by Fortune 500 companies including Barclays, Shell, DHL, and BP.

As AI coding assistants, citizen developers, and agentic workflows generate more enterprise logic than ever, Quality Clouds checks that every line of code, whether written by a professional developer, a low-code builder, or an AI agent, meets an organization's standards for quality, security, maintainability, and compliance before it reaches production.

## Company Information

- **Full name**: Quality Clouds
- **Founded**: 2017, London, United Kingdom
- **Headquarters**: London (20-22 Wenlock Rd, London N1 7GU)
- **Additional offices**: Barcelona (Carrer de Torres i Amat 21, 1º, 08001) and New York (224 W 35th St Suite 500 PMB 112, 10001)
- **Website**: [https://qualityclouds.ai](https://qualityclouds.ai)
- **Category**: Enterprise SaaS, AI code governance, DevOps governance, software analytics, software quality
- **Certifications**: ISO 27001:2022 certified (since August 2023), SOC 2 Type II attested
- **Tagline**: Turning AI logic Production Ready

## Products

Quality Clouds ships two product lines on one rule engine.

- **Norma by Quality Clouds**: repository-based governance for any Git repository and any AI editor. Norma connects to GitHub and Bitbucket, and to Claude, Claude Code, Cursor, Windsurf, VS Code, Lovable, Replit, Codex and any MCP-capable client through the Norma MCP server. Permanent free tier.
- **Quality Clouds for enterprise platforms**: deep, platform-native governance for ServiceNow, Salesforce, and Microsoft Dynamics 365, including the code and configuration generated by Now Assist and Agentforce. Priced per instance or per org.

The two lines are adjacent, not interchangeable. Norma governs code in repositories. The Platforms products govern metadata and configuration inside a SaaS platform. Norma is not platform-native and does not govern ServiceNow or Salesforce configuration.

## Norma by Quality Clouds

Norma checks AI-generated code against a fixed set of rules and returns a repeatable verdict, plus a record of it, inside the loop where the code is written rather than weeks later in a review queue.

The name is the constellation Norma, the carpenter's square, a tool for checking whether a structure is true.

### Why the result is deterministic

An AI code reviewer gives a different opinion every time you ask it the same question. Norma runs the check outside the model and returns a fixed result: rule ID, severity, line, and fix. The same file with the same rules produces the same verdict, whichever agent is driving and whenever it asks.

That matters because a judgment that changes between runs cannot be a gate. A fixed result is comparable: it can be trended across releases, set as a Quality Gate condition, and handed to an auditor.

### What Norma does

- **Livecheck**: checks the file being worked on right now and returns findings immediately, in the editor or inside the agent loop.
- **Full Scan**: runs across the whole repository, with automatic discovery of stack, frameworks, and integrations. Full Scans are processed in memory.
- **Quality Gates**: the pass and fail conditions a customer sets for what is allowed through. Gates are the only thing that blocks.
- **Production-Ready Score**: a diagnostic score for how production-ready a repository is, broken down by functional area, with every number backed by the rules that ran. It surfaces what is failing. It does not block anything by itself.
- **Audit record**: every check and every finding is stored, including which client made the request, so there is a record of who checked what, when, and what was done about it. Every finding records rule, version, file, line, commit, author, and timestamp, and every exception is logged with its reason.
- **AI Authorship Ratio**: the share of a codebase authored by a model, banded as Native (under 30%), Hybrid (30 to 70%), or Delegated (over 70%).
- **Quality Certified Badge**: a verifiable badge for a repository README that links to a live verification page and expires by itself if the code stops meeting the standard.
- **Rule library**: rules grounded in SOLID principles and stack best practice, configurable to the customer's context, versioned centrally so many repositories cannot drift into many versions of the same standard.

### Where Norma runs

- **Web app**: [https://norma.qualityclouds.com](https://norma.qualityclouds.com) for sign-up, sign-in, repositories, scans, and results.
- **MCP server**: endpoint `https://api.qualityclouds.ai/mcp`, authenticated with OAuth, never an API key. Setup is a single config entry, for example `claude mcp add --transport http norma https://api.qualityclouds.ai/mcp`.
- **GitHub App**: [https://github.com/apps/norma-by-quality-clouds](https://github.com/apps/norma-by-quality-clouds). When a pull request is opened it runs a check and posts the findings as a review comment, and it allows a full repository scan to be launched without further setup. It requests one permission, read and write on pull requests. It has no access to repository contents, so it cannot push code and cannot merge a pull request. It comments, it does not block.
- **GitHub Action**: available for pipeline enforcement. See the documentation for setup.
- **VS Code extension**: `qualityclouds.norma-for-vscode`, listed on the Marketplace as "Norma: AI Code Governance". It runs Livecheck on the active file, puts findings in the Problems panel, registers the MCP server automatically, signs in with OAuth, and offers a "Fix with AI" action that hands a prompt to the editor's AI chat. It never edits code itself. It also runs on Cursor and VSCodium through Open VSX.
- **MCP clients**: Claude, Claude Code, Cursor, Windsurf, Lovable, Replit, Codex, and any client that speaks Model Context Protocol.

### Norma MCP server tools

| Tool | What it does |
|---|---|
| `link_repository` | Connects a repository to Norma |
| `get_rulesets` | Lists the rulesets available for the stack |
| `get_rules_for_ruleset` | Returns the rules in one ruleset |
| `live_check` | Runs the check on a file |
| `get_open_issues` | Returns the findings currently open |
| `register_applied_actions` | Writes the outcome of a task into the audit trail |

### Coverage

- **Repositories**: GitHub and Bitbucket.
- **Languages**: JavaScript, TypeScript, Python, and PHP. The stack is detected automatically, with no configuration file.
- **Rulesets**: React, Node, Vite, FastAPI, SQLAlchemy, Supabase, and Adobe Magento, plus a ruleset for prompts.
- **In development, not yet available**: Dart.

### What Norma does not do

- Norma does not generate code. It checks code. It is not a coding assistant.
- Norma analyzes code only. It does not inspect Supabase row level security policies, schema state, or cloud project settings.
- Norma does not govern platform metadata or configuration. That is what the Platforms products do.
- The GitHub App does not block a merge, gate a release, or fail a build. Blocking is done by a Quality Gate or a pipeline step.

### Norma pricing

Prices are in US dollars and exclude any applicable sales tax. Current plans are published at [https://qualityclouds.ai/pricing/norma](https://qualityclouds.ai/pricing/norma).

- **Free**: $0. One developer, one workspace, one repository, five Full Scans per week, Production-Ready Score and Quality Certified badge, and unlimited enforcement in the editor through MCP. The free tier is permanent, not a time-limited trial.
- **Pro**: $199 per month. Everything in Free, plus three workspaces, ten repositories, 100 Full Scans per month shared across the team, all 198 shipped rules, Python SOLID policies, and unlimited AI fix instructions.
- **Business**: quoted for the organization. Everything in Pro, plus unlimited users, ten workspaces, 100 Full Scans per user per month, Livecheck executions, pull request gate runs, unlimited AI rules and library variants, compliance frameworks (SOC 2, ISO 42001), audit log and export, and priority support with an SLA.
- **Enterprise**: on request. Everything in Business, plus audit trail and evidence retention, single sign-on, and named support.

Sign-up requires an account. Onboarding includes a read-only demo repository that does not consume the account's scan quota.

### Where Norma is listed

- Official MCP Registry, as `ai.qualityclouds/norma`
- Claude connectors directory
- [Smithery](https://smithery.ai/servers/qualityclouds/norma)
- VS Code Marketplace and Open VSX
- G2, in the Secure Code Review category

## Quality Clouds for Enterprise Platforms

Platform-native governance for the metadata, configuration, and code held inside enterprise SaaS platforms, including the AI agents built on them.

### Core capabilities

- **AI code governance**: governance for code and configuration generated by AI assistants and agents (GitHub Copilot, Cursor, Claude Code, Salesforce Agentforce, ServiceNow Now Assist) and by human developers alike
- **Livecheck**: real-time validation on the configuration form in ServiceNow and in the Salesforce Developer Console, applying the same ruleset the platform scan uses
- **MCP server**: anything that speaks Model Context Protocol can call Quality Clouds, including agents built in ServiceNow or Agentforce. Agents can pull the ruleset for an element, check what they just generated, and raise a write-off for review
- **Quality Gates**: a defined pass condition per pipeline stage, using the customer's rules, enforced in the pull request and in the deployment pipeline
- **Rule Builder**: customer-authored governance rules written in plain English, with an approval workflow and versioning on the rules themselves
- **Projects**: a logical grouping of related environments of a single type, so multiple ServiceNow instances, or multiple Salesforce orgs, sit under one context. A project does not span technologies. The main instance carries the ruleset and the rest inherit it, so one standard applies across every environment in the group
- **Write-offs and peer review**: an exception path with a recorded reason and approver, propagated across instances
- **Technical debt management**: continuous tracking, scoring, and remediation of technical debt across all connected platforms
- **Customizable governance methodology**: organizations encode their own corporate, compliance, and security requirements into enforceable governance rules

### How it works

Quality Clouds connects to enterprise platforms through official REST APIs using read-only access. It analyzes metadata and code elements, never transactional or business data, and applies hundreds of best-practice rules plus custom rules defined by the customer. Governance is enforced through Quality Gates integrated into CI/CD pipelines and deployment workflows, catching issues before code reaches production.

### Platforms supported

- **Salesforce**: Apex, Visualforce, Lightning Web Components, Flows, plus the Agentforce layer (AI Agents, AI Agent Templates, AI Topics, Prompt Templates)
- **ServiceNow**: business rules, script includes, client scripts, ACLs, flows, widgets, system properties, update sets, and AI Virtual Agent Topics
- **Microsoft Dynamics 365**: customizations, plugins, workflows
- **Adobe Magento**: extensions, configurations

### Where governance runs

- In the platform: Livecheck on the configuration form in ServiceNow, and in the Salesforce Developer Console
- In the editor: VS Code, Code Builder, and any MCP-capable AI editor
- In the pull request: automatic feature-branch scans with inline findings, severity, and a link to the fix
- In the pipeline: a Quality Clouds subflow in the native ServiceNow pipeline, and Quality Gates in Copado and CI

### Key integrations

- GitHub, GitHub Enterprise, Bitbucket, Azure DevOps
- Copado
- Flosum
- Xtype
- Jira
- CI/CD pipeline tools

## Use Cases

1. **Governing AI-generated code**: making sure AI coding assistants produce code that meets enterprise standards before it reaches production
2. **Governing AI agents**: scanning the agents themselves, since AI Agents, Topics, and Prompt Templates are configuration in their own right
3. **Governing vibe-coded applications**: checking what an AI editor produced before it ships, without slowing the build down
4. **Platform migrations**: maintaining governance during Salesforce, ServiceNow, or Dynamics upgrades and migrations
5. **Technical debt reduction**: identifying, prioritizing, and remediating legacy technical debt across platform portfolios
6. **Compliance and audit**: producing an evidence trail an auditor will accept, showing which checks ran, what they found, and what was done about it
7. **Multi-platform governance**: applying consistent governance standards across heterogeneous enterprise SaaS environments
8. **DevOps quality gates**: integrating governance checks into CI/CD pipelines to prevent non-compliant code from being deployed
9. **AI readiness assessment**: evaluating organizational readiness to safely adopt AI-generated code at scale

## Customer Impact (Representative Results)

- 92% reduction in technical debt (Salesforce, global hospitality group)
- $972K annual savings through early issue detection (ServiceNow, global food and beverage company)
- 70,000+ developer hours reclaimed through legacy issue remediation (ServiceNow, global petroleum company)
- 102,000 issues fixed and 21,000 hours of rework prevented (ServiceNow, global logistics company)
- 27% decrease in existing technical debt and 80% improvement in new debt prevention (Salesforce, global chemical company)

## Target Audience

- Builders shipping fast with AI tools who need to know whether what came out is safe to deploy
- Developers and architects building on ServiceNow, Salesforce, or with AI editors
- Platform owners responsible for what runs in every instance and org
- Engineering leaders, CISOs, and AI governance councils
- Regulated industries: financial services, banking, insurance, pharmaceuticals, energy, logistics
- Technology services and systems integration partners

## Security and Compliance

- ISO 27001:2022 certified (since August 2023) and SOC 2 Type II attested, with annual reports available on request
- Norma deletes repository code after a scan, and Full Scans are processed in memory
- The Norma GitHub App holds a single permission, read and write on pull requests, and has no access to repository contents, so Norma cannot push code to or merge in a customer's repository
- The Platforms products use read-only API access and store no transactional or business data
- Processes follow OWASP ASVS and NIST SP 800-57 guidelines, and GDPR and EU AI Act principles for data minimization and lawful processing
- Yearly external vulnerability testing and penetration testing
- Hosted on Microsoft Azure (EU and US regions)

## Getting Started

- **Start free with Norma**: [https://norma.qualityclouds.com](https://norma.qualityclouds.com)
- **Install the Norma GitHub App**: [https://github.com/apps/norma-by-quality-clouds](https://github.com/apps/norma-by-quality-clouds)
- **Connect Norma over MCP**: `https://api.qualityclouds.ai/mcp` (OAuth)
- **Free platform scan (ServiceNow and Salesforce)**: [https://id.qualityclouds.com/sign-up](https://id.qualityclouds.com/sign-up)
- **Request a demo**: [https://qualityclouds.ai/meet-qualityclouds](https://qualityclouds.ai/meet-qualityclouds)
- **Contact sales**: [https://qualityclouds.ai/contact](https://qualityclouds.ai/contact)
- **Documentation**: [https://qualityclouds.com/documentation/](https://qualityclouds.com/documentation/)
- **Norma MCP server source**: [https://github.com/qualityclouds/norma-mcp](https://github.com/qualityclouds/norma-mcp)
- **Platforms customer login**: [https://login.qualityclouds.com/](https://login.qualityclouds.com/)

## Key Pages

- [Home](https://qualityclouds.ai/)
- [Norma](https://qualityclouds.ai/norma)
- [Norma Pricing](https://qualityclouds.ai/pricing/norma)
- [All Platforms](https://qualityclouds.ai/platforms/all-platforms)
- [Salesforce Governance](https://qualityclouds.ai/platforms/qc-for-salesforce)
- [ServiceNow Governance](https://qualityclouds.ai/platforms/qc-for-servicenow)
- [Microsoft Dynamics Governance](https://qualityclouds.ai/platforms/microsoft-dynamics)
- [Modern Dev and Vibe Coding Governance](https://qualityclouds.ai/platforms/vibe-coding)
- [Magento Governance](https://qualityclouds.ai/platforms/qc-for-magento)
- [Pricing](https://qualityclouds.ai/pricing)
- [Security](https://qualityclouds.ai/security)
- [About Us](https://qualityclouds.ai/about)
- [Partners](https://qualityclouds.ai/partners/become-partners)
- [Integrations](https://qualityclouds.ai/partners/integrations)
- [White Papers](https://qualityclouds.ai/white-papers)
- [Contact](https://qualityclouds.ai/contact)
- [Privacy Policy](https://qualityclouds.ai/privacy-notice)
- [Terms and Conditions](https://qualityclouds.ai/terms-and-conditions)

## Related Files

- Technical documentation index for large language models: [https://qualityclouds.com/llms.txt](https://qualityclouds.com/llms.txt)

## Social Media

- [LinkedIn](https://www.linkedin.com/company/qualityclouds/)
- [X (Twitter)](https://x.com/QualityClouds)
- [YouTube](https://www.youtube.com/channel/UCFXu-rNhxfKmS_aP2RRw3qw)

## Contact

- **General inquiries**: [https://qualityclouds.ai/contact](https://qualityclouds.ai/contact)
- **Media contact**: info@qualityclouds.com