Qualimetry Qualimetry Enterprise
Compliance Center

Measure compliance, and gate the merge on it

Publishing standards is only half the job. The Compliance Center scores every reviewed file against the pillars that apply to it, rolls that up per project and across the estate, trends it, and gives you a merge gate that enforces the threshold you choose.

Book a Demo See the Standards Center
One number, honestly built

Compliance is the average of the pillars you actually measure

A file that contains no security-relevant code should not be marked down for it. Unmeasured pillars are excluded from the average rather than counted as zero, which is why the number stays meaningful as coverage grows.

  • Each reviewed file carries a score for every pillar that applies to it.
  • A pillar score is the average across the files where that pillar was measured.
  • The overall score averages the pillars that have something to say.
  • Branches are never collapsed together, so a feature branch cannot flatter main.

Review pillars converging into one compliance score

Each reviewed file is scored against the review pillars that apply to it. In this example 3 were measured and 1 had nothing to measure. The compliance score is the average of the measured pillars only; unmeasured pillars are excluded rather than counted as zero. The resulting score is what the merge gate compares against your minimum.

  • Policies POL Measured on this file
  • General Principles PRI Measured on this file
  • Secure Principles PRINot measured here, so excluded from the average This pillar is excluded from the average rather than counted as zero.
  • Language Standards STD Measured on this file
One compliance score The average of the pillars that were actually measured
The merge gate Below your minimum score, the merge is held
Measured, included in the average Not measured, excluded rather than zeroed
A pillar with nothing to measure is left out of the average, not scored zero. A file that contains no security-relevant code is not punished for it.
Scored by pillar

Policies, Principles and Standards, scored separately

The grid shows POL, PRI and STD alongside the overall score, so a project that is strong on language standards but weak on policy cannot hide behind a single average.

Policies

Organisation-level decisions, independent of language.

General Coding Principles

How code should be written anywhere in the estate.

Secure Coding Principles

The security posture every engineer and agent must hold.

Language Standards

Per-language rules, with rationale and worked examples.

Architecture Standards

How systems are structured and how they talk to each other.

Filter it the way you run the business

  • Group by your own taxonomy, including repository prefix.
  • Filter to baselined, awaiting baseline, or everything.
  • Narrow to projects with high-severity issues, or to a single pillar.
  • Create project groups so a portfolio owner sees only their own estate.
Baseline, then improve

Start from where you are, not from zero

Turning on standards across a mature estate produces a wall of findings that nobody acts on. Baselining records the current state so the score measures the direction you are travelling rather than the debt you inherited.

  • Baseline a project, a group of projects, or the estate in bulk.
  • New work is held to the standard immediately.
  • Automatic baselining on pull request keeps it current without manual effort.
  • The grid shows what is baselined and what is still awaiting it.
Gate the merge

A minimum compliance score, enforced where it matters

Compliance that nobody enforces is a report. Compliance wired into the merge is a control. Three independent checks can hold a merge, and you decide which of them your organisation runs.

Compliance merge check

Holds the merge when the change falls below the minimum compliance score you set. The default threshold is 80 out of 100.

AI review merge check

Holds the merge until the AI reviewer has run against your standards and its findings are visible on the pull request.

Human sign-off check

Holds the merge until a person has accepted the findings or marked them false positives. Keeps a human accountable for the decision.

Per project

From an estate number to the file that caused it

A score with no path to the cause is an argument waiting to happen. Every project opens into four views that end at a specific file and a specific finding, with the standards actually breached named on the way.

Overview

Pillar cards, top risk themes, impact areas and recommended actions.

Files

File health and an issues explorer, down to the individual finding.

Trends

Compliance, issue counts and files analysed over time, split by pillar.

Activity log

What was analysed, when, and what changed as a result.

The risk themes, impact areas and recommended actions on that overview are computed from the stored findings themselves, not generated by a model, so the same evidence produces the same answer every time it is asked.

Self-service for engineers

This is also where developers get connected

The two buttons that connect an engineer's agent or IDE to Qualimetry live on the page they already use to see their own compliance.

  • Get MCP Token issues their access token, without an administrator in the loop.
  • Get Agent App hands them the app for the agent they actually run.
See agent enablement
Per file
not per repository
Every pillar
scored separately
Three checks
at the merge
The chain

Where this sits in Continuous Analysis

None of this works as a separate product. Each stage exists because of the one before it and is only worth doing because of the one after it.

Comes from
Reviewed on the pull request

The same standards are checked again when the change is proposed, so review confirms rather than discovers.

Leads to
Reported across the estate

The per-file score rolls up into a governance report covering every project you have onboarded.

See the whole loop
Questions

Compliance, answered

How is the compliance score computed?
Every reviewed file carries a score from 0 to 100 for each pillar that applies to it: policies, general principles, secure principles and language standards. A pillar's score is the average across the files where it was measured, and the overall score is the average of the pillars that were measured at all.
What happens to a pillar that has nothing to measure?
It is excluded from the average, not counted as zero. A file with no security-relevant code is not marked down for having no secure-principle findings, which is what keeps the score honest as coverage changes.
What is baselining, and why does it matter?
Baselining records the current state of a project so that historic debt does not swamp the score on day one. New work is held to the standard immediately while the inherited backlog is visible but does not make the number meaningless. Baselining can happen in bulk, or automatically on pull request.
Can we change the threshold the merge gate uses?
Yes. The minimum compliance score is an organisation setting, defaulting to 80, and it applies to every project that has not deliberately overridden it. You can also choose which of the three merge checks run at all, so you can start with reporting only and tighten later without a per-repository rollout.

See your compliance, measured

Book a demo and see how your estate scores against the standards you would actually publish.

Book a Demo