How this catalog is built

QA Rating is published independently, and its publisher owns no company listed in this catalog.

Every page in this catalog is generated from one profile database. This page states what gets into that database, what each field means, how applicability tags are assigned and how the order inside rankings is decided.

What gets into the catalog

A company is listed when it sells software testing as a service, has a working website, and at least three independent sources describe it.

Profiles are built from those sources field by field. Every published field records which source it came from and when that source was read, and a field no source confirms is left empty rather than estimated. This is why profiles here have visible gaps: an empty field means nobody confirmed it, not that the answer is no. Certificates are held to a stricter rule still, described below. Applicability tags are not judgement calls either: each tag has a published condition expressed in the fields above, and a tag whose condition fails cannot be attached to a company.

What this catalog does not claim: that an editor has read every source behind every field. Collection and rebuilding are automated. A page that names no editor is published under the editorial responsibility of QA Rating. That means the publisher answers for what is published on it. It does not mean a person has checked every field against its source by hand. A page that names a person means that person checked it. Every named editor has a page of their own with an external profile, so the claim can be verified.

Where this catalog is thin: candidates came from public directories, and those directories are English-language and mostly serve buyers in North America and Europe. The coverage inherits that shape. Some large software-testing markets, East Asia and the Middle East among them, are represented barely or not at all, and in several regions a single country stands in for the whole. That is a limit of how the list was assembled rather than a finding about those markets: a vendor absent from the directories read here is absent from this catalog, however large its business. Rankings by geography describe the countries present and say nothing about the rest.

Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label.

This catalog collects no reviews of its own. Review counts and scores are aggregates from external platforms, shown with the date they were read.

Fields

Every profile carries the same fields, and every field is shown on the profile even when the company has not published it. 14 of them form the completeness checklist used to decide whether a comparison page can be published.

Headquarters: Country, and city where the company states one, of the registered head office. Delivery can happen elsewhere.
Delivery locations in the completeness checklist: Countries where the company states it has testing staff. This is what geography rankings and the geography filter use.
Team size in the completeness checklist: Band of total headcount, not testers only, taken from the company statement or a registry entry.
Founded in the completeness checklist: Year the company started operating under any of its names, including names it has since dropped.
Ownership: Whether the company is independent, part of a group, or a subsidiary of a larger firm. An ownership structure no open register discloses stays empty rather than being guessed.
Services in the completeness checklist: Kinds of testing work the company sells, from a closed list. A service is recorded when the company sells it, not when it mentions it.
Industries in the completeness checklist: Industries the company states it works in and can show work for. This is what industry rankings use.
Frameworks in the completeness checklist: Test automation frameworks and tools the company states it works with.
Engagement models in the completeness checklist: How the work is contracted: dedicated team, project, staff augmentation, and the like.
Client stages in the completeness checklist: Stage of the client the company works with, from early-stage product to enterprise.
Certificates in the completeness checklist: Certificates confirmed by a register entry, a certificate document or an auditor report. A statement on the company website is not enough for this field; it is published on the profile separately, marked as claimed.
Signs a BAA / GDPR DPA in the completeness checklist: Whether the company states it signs a BAA and a GDPR data processing agreement. An unconfirmed answer stays empty rather than becoming a no.
Published rates in the completeness checklist: Hourly rates the company publishes, by grade, in US dollars. Rates quoted only on request stay empty.
Minimum project: Smallest engagement the company states it takes, in US dollars.
Onboarding: Days from signature to the first working tester, as stated by the company.
Crowd tester pool: Size of the crowd tester pool the company states it can call on.
Device lab: Number of real devices in the company own lab. Emulators are not counted.
External reviews in the completeness checklist: Review counts and scores from external platforms, with the date they were read. This catalog collects no reviews of its own.
Named clients in the completeness checklist: Clients named in public, each with the source that names them. A logo wall without a source is not a source.
Case studies in the completeness checklist: Published case studies with their metrics recorded as stated, without recalculation.

Applicability tags

Every tag standing on a profile has to satisfy the condition printed with it below. The build reads every tag on every profile and fails where the condition is not met, so no tag on this site rests on opinion alone. Meeting a condition is what makes a tag possible, and it is not on its own what puts one on a profile: a profile carries at most 5 tags, and where more conditions than that pass, the choice of which to keep is editorial. A profile that meets no condition carries no tag, and its editorial note says which published fields are missing.

Early-stage startups: At least one published case study with a client size band of 11-50 or smaller, and a published minimum project size of 10,000 USD or less. Checked against: caseStudies.clientSizeBand, minProjectSizeUsd.
Scaleups: A published team size of 51-200 or larger, and at least one published case study with a client size band of 51-200 or 201-500. A company that publishes no team size does not carry this tag. Checked against: teamSize, caseStudies.clientSizeBand.
Enterprises: A verified ISO/IEC 27001 or SOC 2 certificate, a published team size of 201-500 or larger, and at least one named client that is a publicly traded company, each with a source. A company that publishes no team size does not carry this tag. Checked against: certifications, teamSize, namedClients.publiclyTraded.
Regulated industries: At least two verified certificates from ISO 13485, HITRUST CSF, PCI QSA and ISO/IEC 27001. Checked against: certifications.
Fast onboarding: A published onboarding time of 14 days or less, with a source. Checked against: onboardingDays.
Embedded team model: The dedicated team engagement model is offered, and at least one published case study. Checked against: engagementModels, caseStudies.
Crowdtesting at scale: The crowdtesting engagement model is offered, and a published tester pool of 10,000 people or more, with a source. Checked against: engagementModels, crowdTesterPool.
Device lab coverage: A published device lab of 100 real devices or more, with a source. Checked against: deviceLab.realDevices.
Automation first: Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric. Checked against: services, caseStudies.metrics.kind.
Performance engineering: Performance testing is offered as a service, and at least one published case study reports a throughput or latency metric. Checked against: services, caseStudies.metrics.kind.
Security focus: Security testing is offered, together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study. Checked against: services, certifications, caseStudies.
Accessibility specialists: Accessibility testing is offered as a service, and at least one published case study reports an accessibility conformance metric. Checked against: services, caseStudies.metrics.kind.
Nearshore for the EU: At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova. Checked against: deliveryLocations.
Nearshore for the USA: At least one delivery location in Canada, Mexico, Central America or South America. Checked against: deliveryLocations.
Budget sensitive: The median of the published senior hourly rates of this company is below the median of every published senior rate in the catalog. Rates without a stated grade do not count. Checked against: rates.

Rankings and their order

A ranking exists for a value of an axis when at least 7 companies match it and the page carries at least 300 words that are not the table. Below that threshold the value stays a filter facet and no page is generated.

Order inside each group is editorial. The basis for the order is stated on every ranking page, and every change to it is recorded in the changelog.

Position in a ranking cannot be bought. Paid options are limited to the extended profile, labelled sponsor slots and lead forms, and none of them affect tags or order.

Industry: 19 values. Companies appear on a value page when they list Fintech among the industries they work in. The same rule runs with each value of the axis substituted. Default order: Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.
Type of testing: 25 values. Companies appear on a value page when they list Manual testing among their services. The same rule runs with each value of the axis substituted. Default order: Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.
Framework and stack: 28 values. Companies appear on a value page when they list Playwright among the frameworks and tools they work with. The same rule runs with each value of the axis substituted. Default order: Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.
Engagement model: 9 values. Companies appear on a value page when they offer staff augmentation as an engagement model. The same rule runs with each value of the axis substituted. Default order: Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.
Client stage: 4 values. Companies appear on a value page when they name startups among the client stages they serve. The same rule runs with each value of the axis substituted. Default order: Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.
Delivery location: 14 values. Companies appear on a value page when they have a delivery location in one of the countries the USA covers. The same rule runs with each value of the axis substituted. Default order: Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.
Delivery proximity: 2 values. Companies appear on a value page when they list a delivery location counted as nearshore for a buyer in the EU. The same rule runs with each value of the axis substituted. Default order: Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.

Comparisons and alternatives

A pair of companies gets a comparison page when both profiles fill at least 57% of the comparison checklist. Pairs are named by an editor or built automatically: inside each applicability tag the companies with the most verified reviews are taken, up to 10, every combination of two among them becomes a candidate, and the total is capped at 60 pairs.

A page of alternatives exists for the 25 companies with the most verified reviews among those for which the list can be filled. It carries between 5 and 8 companies.

A company is listed here when it meets at least one of the same applicability conditions as the company at the top of the page. Those conditions are computed from published fields, so the list changes when the fields change and never because somebody paid for a place in it.

The order is by the number of applicability conditions a company shares with the company at the top of the page, then by the number of verified reviews it has on external review platforms, then alphabetically by name. No position here is paid for and none of it is an editorial score.

Certificates

A certificate is counted only with a link to the entry that confirms it. A statement on a vendor website is not enough for that, and it is not silently dropped either: a certificate a company names about itself is published on its profile under a separate heading, marked as claimed and linked to the page carrying the claim. Claimed certificates stay out of every count the catalog makes: ranking table columns, applicability tags, comparisons and the profile field above all read confirmed certificates only.

ISO/IEC 27001 Information security management system certified by an accredited body.
ISO 9001 Quality management system certified by an accredited body.
ISO 13485 Quality management system for medical device work certified by an accredited body.
ISO/IEC 20000-1 IT service management system certified by an accredited body.
ISO/IEC 29119 alignment Documented alignment of the test process with the ISO/IEC 29119 series, attested in an audit report.
SOC 2 SOC 2 examination report issued by a CPA firm. Type is recorded in the source note.
HITRUST CSF HITRUST CSF certification listed in the HITRUST directory.
PCI QSA Qualified Security Assessor company listed by the PCI Security Standards Council.
PCI DSS compliance Attestation of Compliance for the vendor own environment, not for a client.
CMMI level 3 Maturity level 3 appraisal published in the CMMI appraisal directory.
CMMI level 5 Maturity level 5 appraisal published in the CMMI appraisal directory.
TMMi Test maturity level assessed against the TMMi model and listed by the foundation.
CREST Penetration testing or SOC service accredited by CREST and listed in its member marketplace.
Cyber Essentials UK government-backed baseline security scheme, listed in the NCSC register of certified organisations.
ISO/IEC 17025 Test laboratory competence accredited by a national accreditation body, required for formal conformance testing.
FedRAMP US federal cloud authorisation listed in the FedRAMP Marketplace.
CSA STAR Cloud security self-assessment or certification listed in the Cloud Security Alliance STAR registry.

Updates

Profiles are rechecked quarterly. A recheck that finds no change does not move the date on the profile: the date moves only when the content does. Changes to the composition or the order of a ranking are recorded in the changelog, and every source with the date it was read is listed on the sources page.

Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source.

Ownership

QA Rating is published independently, and its publisher owns no company listed in this catalog.

The publisher owns no company listed in this catalog. If that changes, the profile will carry a line saying so and will follow the same rules as every other profile.

About the publisher For vendors