a1qa vs Software Secured
QA Rating is published independently, and its publisher owns no company listed in this catalog.
Field by field
| Field | a1qa | Software Secured |
|---|---|---|
| Headquarters | Decatur, the USA | Ottawa, Canada |
| Delivery locations | the USA, the UK, Poland, Georgia, Bangladesh, Mexico | Canada |
| Team size | 1000 or more people | 11-50 people |
| Founded | 2003 | 2010 |
| Ownership | Independent | Independent |
| Services | Manual testing, Test automation, Performance testing, Security testing, Accessibility testing, Compatibility testing, API testing, Localization testing, Usability testing, Acceptance testing, QA consulting | Penetration testing, Secure code review, Red teaming |
| Industries | Banking, Telecom, Media, Travel, Ecommerce, Insurance, Healthcare, Games, Education | Healthcare, Banking, SaaS |
| Frameworkspublished by one of the two | Selenium, Playwright, Cypress, WebdriverIO, Appium, Apache JMeter, Postman, Cucumber, k6, REST Assured, TestComplete, Katalon, SoapUI | Not published |
| Engagement models | Staff augmentation, Dedicated team, Managed testing service, Project work | Managed testing service |
| Client stages | Enterprises | Scaleups |
| Certificates | No certificate confirmed by a register entry | No certificate confirmed by a register entry |
| Signs a BAA / GDPR DPA | Not confirmed / Not confirmed | Not confirmed / Not confirmed |
| Published ratespublished by one of the two |
| Not published |
| Minimum project | $10,000clutch.co | $5,000clutch.co |
| Onboarding | Not published | Not published |
| Crowd tester pool | Not published | Not published |
| Device lab | Not published | Not published |
Who each one fits
A buyer choosing between these companies is weighing scope more than price. a1qa sells security testing as part of a general quality assurance practice that also covers the rest of the release. Software Secured sells offensive security work and nothing else. A team that needs security coverage layered onto QA it already runs elsewhere tends toward the wide catalog; a team buying a dedicated offensive-security engagement, and only that, tends toward the narrow one. The difference surfaces in staffing: a generalist practice assigns security people from a shared bench, while a specialist practice has no other bench to draw them from.
No published description exists for how either company runs onboarding at the start of an engagement, which matters when a narrow security practice has to plug into a release process it did not design. That question belongs on the first call: ask the vendor to describe onboarding in concrete terms, including who is assigned and what is delivered before testing starts. Check the delivery footprint named on that same call against what each profile publishes, since a security engagement run outside the country a buyer expects can raise its own compliance question.
A tag is attached when the company's published fields meet its condition, never by judgement. Both lists come from the same closed vocabulary, so a tag missing from one side means the condition was not met, not that nobody looked.
Software Secured
Software Secured meets no applicability condition in this catalog. That is a statement about what its published fields show, not about the company.
Both meet the conditions for Nearshore for the USA, so those conditions do not separate them.
Where the data runs out
Completeness against the 14 fields of the comparison checklist is 86% for a1qa and 71% for Software Secured. A field is counted as filled when a source confirms it, so a gap means nobody published it.
Neither company has a value recorded for these fields: Certificates, Signs a BAA / GDPR DPA, Onboarding, Crowd tester pool, Device lab. The table shows those rows empty rather than estimating them.
Field definitions and the completeness checklist are on the methodology page. The sources behind each field are listed on the a1qa profile and the Software Secured profile.
Questions
- What hourly rate does a1qa publish, and what does Software Secured show for the same field?
- a1qa publishes a blended hourly rate of $25 to $49, sourced from its Clutch profile. Software Secured has no rate listed in the catalog for any grade. A blended band covers every grade at the same figure, so it does not say what a senior security engineer costs on either side. A buyer sizing a security-only engagement has to request an hourly figure directly from Software Secured, since the catalog cannot supply one.
- Do a1qa and Software Secured publish whether they sign a BAA or a GDPR data processing addendum?
- Neither a1qa nor Software Secured publishes an answer on signing a BAA or a GDPR data processing addendum. That clause governs what a vendor may do with regulated data it touches while testing. A buyer moving PHI or EU personal data through either engagement therefore enters procurement without the document that normally gates it. The catalog cannot say which of the two already has such a clause on file, only that neither has put an answer on record.
Published by QA RatingUpdated on September 6, 2026
Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label. Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source.