Which fields on a profile here carry a value for every company listed?

Four of them. Founding year, headquarters country, the list of services sold and the recorded delivery locations are present on all ten profiles; every other tracked field has at least one gap, and several have many. Two of those four describe where a company is registered and where it delivers, which is what put it on this page to begin with, so the comparison available across the whole group comes down to a founding year and a list of service names. Everything about how the work is run has to be requested profile by profile.

For a company delivering from Portugal, is that its whole delivery footprint or one site among many?

Both cases sit on this page under the same entry test. Five of the ten record Portugal as their only delivery location, two record a second country alongside it, and the remaining three record four, seven and eight countries. Choosing one of the five means choosing a company whose recorded delivery sits in one country; choosing the company with eight means choosing one address from a longer list. The entry condition reads the same field in both cases and treats the two the same way.

Some fields on these profiles are filled in for a single company only. Is there anything to do with those?

Very little, and there are four of them. A published rate, a minimum project size, a named testing framework and a client stage each appear on exactly one profile out of the ten. A field holding one value cannot rank or group anything; it points at the single company that published it and gives no way to place the other nine above or below that figure. Comparing candidates on price, on the smallest engagement they take, or on the kind of client they usually serve is not something this page supports.

How far apart in size are the companies gathered under one delivery country?

As far apart as the recorded bands reach. The team-size field on this page holds one company in the one-to-ten band and three above a thousand people, with two in eleven to fifty, two in fifty-one to two hundred, one in two hundred to five hundred, and one profile leaving the field unrecorded. A delivery country is the single condition these companies have in common, and it carries no scale requirement, so a shortlist drawn from this page can put a ten-person firm and a multinational next to each other with nothing on the page marking the difference as relevant or not.

Best QA companies in Portugal, 2026

QA Rating is published independently, and its publisher owns no company listed in this catalog.

10 testing companies in this catalog have a delivery location in one of the countries Portugal covers. They are grouped below by what each is best suited for, in 4 groups. 3 of them hold a certificate confirmed by a register entry and 1 publishes a rate card. Composition and order last changed on September 4, 2026.

10 companies. Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.

The companies

Portugal: 10 companies, grouped by what they are best suited for.
#	Company	Delivery locations	Published rates	Team size	Reviews
Nearshore for the EU At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova.
1	Blaze Information Security	Portugal	Not published	11-50 people	0
2	Char49	Portugal	Not published	1-10 people	0
3	Critical Software	Portugal, the UK, Germany, the USA	Not published	1000 or more people	0
4	Devoteam Cyber Trust	Portugal	Not published	Not published	0
5	Ethiack	Portugal	Not published	51-200 people	0
6	GlobalStep	the USA, Canada, the UK, Romania, Spain, France, Portugal, India	Not published	1000 or more people	0
7	QAValue	Portugal, the Netherlands	Blended $100-149/hclutch.co	11-50 people	0
8	S21sec	Spain, Portugal	Not published	201-500 people	0
9	Side	the UK, the USA, Canada, India, Japan, Portugal, Brazil	Not published	1000 or more people	0
10	VisionWare	Portugal	Not published	51-200 people	0
Nearshore for the USA At least one delivery location in Canada, Mexico, Central America or South America.
6	GlobalStep	the USA, Canada, the UK, Romania, Spain, France, Portugal, India	Not published	1000 or more people	0
9	Side	the UK, the USA, Canada, India, Japan, Portugal, Brazil	Not published	1000 or more people	0
Automation first Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric.
3	Critical Software	Portugal, the UK, Germany, the USA	Not published	1000 or more people	0
Enterprises A verified ISO/IEC 27001 or SOC 2 certificate, a published team size of 201-500 or larger, and at least one named client that is a publicly traded company, each with a source. A company that publishes no team size does not carry this tag.
9	Side	the UK, the USA, Canada, India, Japan, Portugal, Brazil	Not published	1000 or more people	0

All ten companies share one tag

Every company in this composition carries the Nearshore for the EU tag, since a Portuguese delivery location is itself a location inside the EU. Six of the ten companies list Portugal as their headquarters country: Blaze Information Security, Char49, Critical Software, Devoteam Cyber Trust, Ethiack and VisionWare. The other four companies are headquartered outside Portugal, one each in the United States, the Netherlands, Spain and the United Kingdom, and each reaches this composition through a delivery location recorded separately from its headquarters country.

Two companies also reach the US market

GlobalStep and Side are the only two companies in this composition tagged Nearshore for the USA. Both also carry the Nearshore for the EU tag. Side was founded in 1994, the earliest founding year recorded in this composition. GlobalStep was founded in 2006.

Side carries a third tag

Side also carries the Enterprises tag, the only company in this composition to combine three tags at once. No other company here carries more than two tags. Automation first and Enterprises are tied for the smallest groups on this page, with one company each.

Critical Software: the only Automation first tag on this page

Critical Software is the only company in this composition tagged Automation first. It combines that tag with the Nearshore for the EU tag, the only other tag it carries. Critical Software was founded in 1998, four years after Side.

Three companies hold a verified certificate

Beyond Side's ISO/IEC 27001 certificate noted above, two more companies in this composition hold a verified certificate: Blaze Information Security and Devoteam Cyber Trust each hold a verified CREST certificate. That brings the number of companies in this composition with a verified certificate to three out of ten. The other seven have no verified certificate on file.

Seven companies carry only the Nearshore for the EU tag

Seven companies in this composition carry the Nearshore for the EU tag and no other tag tracked on this page: Blaze Information Security, Char49, Devoteam Cyber Trust, Ethiack, QAValue, S21sec and VisionWare. None of them appears in the Nearshore for the USA, Automation first or Enterprises groups on this page. Ethiack, founded in 2022, is the most recently founded company in this composition.

An order basis with nothing to sort on

No company in this composition carries a verified review count from an external platform, so the ordering basis printed above the table, which reads the review count highest first, has no value to sort on here, and the tie-break by name decides the whole order. None of the ten companies has a published answer for signing a BAA or a GDPR data processing agreement either. Case studies are published for two of the ten companies, which leaves the tie-break by name deciding the order of a group where nothing published separates the members. Industries are recorded for nine of the ten, the smallest gap among the fields tracked in this composition. An empty field records that no source published the value.

How this ranking was put together

Membership is computed from the profile, not chosen: companies appear here when they have a delivery location in one of the countries Portugal covers, as their own profile states. Position in a ranking cannot be bought. Paid options are limited to the extended profile, labelled sponsor slots and lead forms, and none of them affect tags or order.

The table compares the fields that decide this axis: delivery locations, published rates, team size, plus the number of verified reviews on external platforms. Rates, minimum project size and onboarding time carry the source they came from next to the value.

Nearshore for the EU: At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova.
Nearshore for the USA: At least one delivery location in Canada, Mexico, Central America or South America.
Automation first: Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric.
Enterprises: A verified ISO/IEC 27001 or SOC 2 certificate, a published team size of 201-500 or larger, and at least one named client that is a publicly traded company, each with a source. A company that publishes no team size does not carry this tag.

The criteria for this axis are on the methodology page, together with field definitions and the rule for editorial order. Changes of order are recorded in the changelog.

Questions

Which fields on a profile here carry a value for every company listed?: Four of them. Founding year, headquarters country, the list of services sold and the recorded delivery locations are present on all ten profiles; every other tracked field has at least one gap, and several have many. Two of those four describe where a company is registered and where it delivers, which is what put it on this page to begin with, so the comparison available across the whole group comes down to a founding year and a list of service names. Everything about how the work is run has to be requested profile by profile.
For a company delivering from Portugal, is that its whole delivery footprint or one site among many?: Both cases sit on this page under the same entry test. Five of the ten record Portugal as their only delivery location, two record a second country alongside it, and the remaining three record four, seven and eight countries. Choosing one of the five means choosing a company whose recorded delivery sits in one country; choosing the company with eight means choosing one address from a longer list. The entry condition reads the same field in both cases and treats the two the same way.
Some fields on these profiles are filled in for a single company only. Is there anything to do with those?: Very little, and there are four of them. A published rate, a minimum project size, a named testing framework and a client stage each appear on exactly one profile out of the ten. A field holding one value cannot rank or group anything; it points at the single company that published it and gives no way to place the other nine above or below that figure. Comparing candidates on price, on the smallest engagement they take, or on the kind of client they usually serve is not something this page supports.
How far apart in size are the companies gathered under one delivery country?: As far apart as the recorded bands reach. The team-size field on this page holds one company in the one-to-ten band and three above a thousand people, with two in eleven to fifty, two in fifty-one to two hundred, one in two hundred to five hundred, and one profile leaving the field unrecorded. A delivery country is the single condition these companies have in common, and it carries no scale requirement, so a shortlist drawn from this page can put a ten-person firm and a multinational next to each other with nothing on the page marking the difference as relevant or not.

Other axes these companies appear on

Delivery proximity: nearshore for a buyer in the EU 10 of these 10 companies also stand there
Industry: Healthcare 7 of these 10 companies also stand there
Industry: Banking 5 of these 10 companies also stand there
Type of testing: Penetration testing 5 of these 10 companies also stand there

How to choose a vendor on this axis

Published by QA RatingPublished on September 3, 2026Updated on September 5, 2026

Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label. Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source.