Customer satisfaction evidence your ISO 9001 auditor can actually read
Clause 9.1.2 of ISO 9001, in both the 2015 and the 2026 edition, requires you to monitor how customers perceive whether their needs and expectations were met, and to have decided how you obtain and review that information. Most certified companies satisfy it with a form nobody fills in and a summary built by hand the week before the audit.
Collect it continuously instead. Filter by date and location, export, done.
No card required.
Does this sound like your last audit?
- The satisfaction summary was assembled in the days before the auditor arrived
- Responses came from whoever happened to be asked, not from a defined method
- The auditor asked about one branch or one quarter and it took another afternoon to answer
- Nobody could show what was done about the customers who were unhappy
- The same exercise starts again next year from nothing
If three or more of these are true, the cost is not the audit finding. It is the days your quality team spends every year producing evidence that could have produced itself.
What it is
Customer Feedback Simplified collects customer satisfaction data through a private single-use link sent to one named customer, a link you send after delivery, a button on your website, or a QR code where one fits. Customers answer a short set of questions in their own language. You get a dashboard showing satisfaction by location and period, a browser notification when a response matches a rule you wrote, somewhere to record what you did about it, and an export of every response for any date range.
It is not a quality management system and it does not replace one. It does one job inside yours.
The full list of what it collects sits on the features page, and NPS, CSAT and CES explained covers which metric suits which touchpoint.
Where it sits in your quality management system
Requirements paraphrased below. These clause numbers are the same in the 2015 and 2026 editions. Your certification body’s reading is the one that counts.
| Clause | What it asks of you | What you can show |
|---|---|---|
| 8.2.1 | A defined way to receive customer feedback and complaints | Private single-use links per named customer, shareable links sent after delivery, a button on your website, and QR codes where you have a counter |
| 9.1.2 | Monitor customer perception, with a defined method | NPS, CSAT or CES running continuously, per location, on questions you wrote |
| 9.1.3 | Analyse and evaluate the data | Dashboard with trend by date range, location and questionnaire |
| 9.3.2 | Satisfaction as a management review input | Period-filtered metrics and a full export for your review pack |
| 10.2 | React to complaints, act, retain evidence | A notification when a response matches a rule you set, the complaint in the customer’s own words, and a dated record of who did what about it on any response — closing one requires a note, and it exports beside the response |
| 7.5 | Retain documented information | Every response stored with date, location and questionnaire; CSV export |
Two related guidance standards your quality team will recognise: ISO 10002 on complaints handling and ISO 10004 on monitoring and measuring customer satisfaction. Neither is certifiable. Both describe the practice this automates.
What changed in 2026 for clause 9.1.2
Clause details are based on published summaries of ISO 9001:2026; verify against the standard before relying on them.
9.1.2 itself: same number, same core requirement
You still monitor how customers perceive whether their needs and expectations were met, by a method you have decided. Commentary on the draft edition pointed to online reviews and social media as sources of satisfaction information. Including them where your customers actually leave feedback is sensible practice, but check the published text before treating it as a requirement.
10.2: complaints as a source of nonconformities
Summaries of the 2026 edition report that clause 10.2 now makes explicit that a nonconformity can arise from a customer complaint, not only from your own checks. In practice, a complaint, or a low score with the customer’s reasons, can be what starts your nonconformity and corrective action process.
Here, the response in the customer’s own words and the dated note of what was done about it are the input to that process. Deciding whether it is a nonconformity, the root cause and the corrective action stay in your QMS. The audit checklist covers what to have ready, and the 9.1.2 procedure guide shows how to connect negative feedback to complaints and corrective action.
9.3.2: management review inputs
Customer satisfaction remains an input. Summaries report two additions around it: changes in the needs and expectations of relevant interested parties, and the effectiveness of actions on risks and on opportunities, now reported as separate inputs rather than one.
Clause 10 is renumbered
The 2015 edition’s 10.3 (continual improvement) is 10.1 in 2026, and the 2015 edition’s 10.1 (general) is merged into it. Nonconformity and corrective action is 10.2 in both. Every other clause number on this page is unchanged.
Transition
ISO 9001:2015 certificates are expected to remain valid until 30 September 2029 (subject to confirmation by the accreditation bodies). From around 31 March 2028, new certifications are issued to ISO 9001:2026 only. Confirm dates with your certification body.
How it works
- 1
Decide what to ask.
A short questionnaire per touchpoint. Most companies need two or three.
- 2
Put it where customers already are.
A link sent after delivery or after a service call, a private single-use link to one customer by name, or a button on your site. A QR code too, if you have a counter people stand at — but most certified companies do not.
- 3
Let it run.
Responses accumulate against the location and date they came from, in whichever of your languages the customer picked.
- 4
Decide what is worth interrupting you for.
Write the rule — below 3 on CSAT, 6 or under on NPS, whatever your threshold is — and tick the alert box on it. Matching responses raise a browser notification with the customer’s own words attached. Nothing notifies until you set that up, which is the point: you choose the threshold, not us.
- 5
Record what you did, and close it.
An alert opens a follow-up on its own, and you can start one on any response yourself — useful if you would rather read everything than be interrupted. Whoever handles it writes what was done — rang them, agreed a revisit, refunded the difference — and closes it. Closing without a note is not offered, because a status saying “dealt with” is not evidence that it was.
- 6
Export whatever the auditor asks for.
Any date range, any location, any questionnaire — with the follow-up record in the same file as the score that triggered it.
Your first form can be live this afternoon. What takes longer is agreeing what to ask and writing the method into your procedure — that is your quality team’s work, not setup, and responses accumulate from the day the first link goes out. You can try a live form before you sign up for anything.
What this does not do
Better you read this now than discover it later.
No software is ISO 9001 certified, including this one. Certification applies to your management system, not to a tool inside it.
It is not a corrective action system. It records what was done about one piece of feedback, by whom and when, and will not let you close it without saying what you did. Root cause analysis, corrective actions linked across processes, and verifying that a fix worked stay in your QMS.
It does not write your management review. It supplies the input.
Alerts are browser notifications, and they are opt-in per rule. Not email, not SMS. A questionnaire nobody has written a rule on notifies nothing at all — though you can still open any response and record what you did about it, so choosing to run no alerts does not cost you the evidence.
Recovery point is up to 24 hours. Nightly backups, no point-in-time recovery, no published uptime commitment.
No AI summaries or sentiment scoring. You read what your customers wrote.
We claim no improvement figure anywhere on this page, because we have not measured one.
Questions we get asked
Does using this make us ISO 9001 compliant?
No. Compliance is a property of your management system, assessed by your certification body. This gives you the customer satisfaction evidence that one part of that system needs.
Any vendor telling you their software makes you compliant is overselling.
What does clause 9.1.2 actually require?
In plain terms: you must monitor how customers perceive whether their needs and expectations were met, and you must have decided how you obtain, monitor and review that information.
It does not mandate a survey, a score, or any particular tool. A survey is simply the most defensible method for most companies, because it produces dated records.
What evidence do auditors expect for clause 9.1.2?
Evidence that you decided how you would monitor customer perception, and that you then did it. In practice that is a described method (who is asked, how, how often and with which questions), the dated records that method produced, and an analysis of them that fed your management review.
Auditors commonly sample as well: they pick a period or a branch, ask to see the responses behind the score, and ask what happened with a customer who was clearly unhappy. That last question is where 9.1.2 meets 10.2, and a satisfaction score with no record of what was done about it is where findings tend to come from.
Here, the method is your questionnaire and where you put it; the records are every response with its date, location and questionnaire; and the note of what was done sits beside the response in the same export. The written method statement and the management review itself stay in your QMS.
Will an auditor accept NPS or CSAT?
Auditors assess whether you defined a method and followed it, and whether you acted on what you found. A consistently collected score with the responses behind it is straightforward to present.
A score with no underlying responses, or a method you cannot describe, is where findings come from.
How many responses do we need?
The standard sets no number. What matters is that the method is defined, applied consistently, and produces enough data to evaluate.
Continuous collection solves this better than an annual push, because volume accumulates on its own.
We already send an annual satisfaction survey. Why change?
If it works and your team does not lose days to it, do not change.
The case for changing is the compiling time, the thin response rate an annual email usually gets, and the fact that an annual survey tells you about an unhappy customer months after you could have done anything about it.
Can we use it across multiple locations or branches?
Yes. Each location gets its own links and its own score on the same questions, and you can filter to one location or compare them. Your plan sets how many locations you can run.
Does it work for ISO 21001 or NABH?
The same data serves them. ISO 21001 for educational organisations centres on learner and other beneficiary satisfaction, and NABH accreditation requires patient feedback and its analysis.
The clause numbers differ; the evidence is the same shape.
Where is our data stored?
On a dedicated server in Falkenstein, Germany. The application, the database and the database backups are all in the European Union.
Two processors sit outside that server and we would rather name them than let your reviewer find them: transactional email is delivered through Amazon SES, and card payments run through Dodo Payments.
What does it cost?
Pricing depends on how many locations you run. Start a 30-day trial without a card, or ask us for a quote.
Running a school or college? The ISO 21001 mention above applies to you, and that page is written for your touchpoints rather than a factory’s.
The standard itself is ISO 9001:2026 on iso.org; the edition before it, still valid for certificates during the transition, is ISO 9001:2015. Requirements are paraphrased on this page, not reproduced. Last reviewed 2026-09-30.
Guides for clause 9.1.2
Useful whichever tool you use.
- Clause 9.1.2 customer satisfaction survey template
The questions to ask, on which scale, and why each one earns its place.
- Clause 9.1.2 audit checklist
What an auditor looks for, the questions they ask, and where findings come from.
- How to write your 9.1.2 procedure
A method statement you can adapt: who is asked, how, how often, and what happens next.
- NPS and CSAT for ISO 9001
Whether an auditor will accept either score, and which suits a certified company.
For your IT reviewer
Certified companies have to evaluate their suppliers under clause 8.4. Here is what you need, without asking.
- Hosting
- Dedicated virtual server in Falkenstein, Germany
- Data location
- Application, database and database backups in the European Union. Transactional email runs through Amazon SES and card payments through Dodo Payments.
- Backups
- Nightly encrypted dump to separate EU object storage, each one checked before it is stored and deleted after 30 days; recovery point up to 24 hours
- Availability
- A single server. We publish no uptime commitment and would rather say so than quote a number we do not measure.
- Access control
- Encrypted survey links, bot protection on public forms, user accounts scoped by location
- Privacy
- Built for GDPR and India’s DPDP — consent centre, the nine data rights and a data request console included. The data processing agreement is published, not held back for a call.
- Security certifications
- None held. No ISO 27001, no SOC 2, no third-party penetration test. Said plainly rather than left vague.
Want the full vendor pack for your supplier file? Ask for it and you will get a direct answer, including where the answer is no.
Start with one location
Thirty days, no card, no commitment. At the end you will have a real month of data and will know whether the evidence is worth paying for.