Among the companies here that publish an hourly rate, how are the published bands distributed?

11 of the 28 companies with a UK delivery location publish a blended hourly rate band. 3 of the 11 publish a band under $25 per hour, 4 publish a band from $25 to $49, and 4 publish a band from $50 to $99. None of the 11 publishes a band at $100 per hour or above.

What does a UK delivery location mean for moving personal data to and from an EU-based client?

A UK delivery location sits outside the European Union following the UK's departure from the bloc, so personal data moving between that location and an EU-based client relies on a transfer mechanism separate from the EU's own internal transfer rules. 12 of the 28 companies with a UK delivery location are themselves headquartered in the United States and 3 in India, jurisdictions that raise the same cross-border question on their own account, independently of the UK link. The delivery-location field records where the testing work happens; the agreement that governs a specific data transfer between that location and an EU-based client is a separate document the field does not capture.

What does a recorded CREST certification suggest for a company bidding into UK public-sector security testing work?

CREST is administered from the UK and is commonly named as a supplier qualification in UK public-sector penetration-testing tenders, so a recorded CREST certification signals that a company has already cleared a scheme that market may require directly. 5 of the 28 companies with a UK delivery location carry a recorded CREST certification, each checked against a source before publication. UK public-sector contracts sometimes name a specific accreditation scheme as a tender requirement, and CREST is only one of several a buyer may encounter. A buyer bidding into a tender that names a specific scheme should confirm which one the contract requires before assuming a CREST record satisfies it.

How does a UK delivery team's working day line up with a buyer's morning in the United States compared with one in continental Europe?

A UK working day runs on GMT or British Summer Time, roughly five hours ahead of the US East Coast and no more than one or two hours behind Western Europe, so a UK team's afternoon overlaps with a US East Coast morning while its whole day overlaps with a Berlin or Madrid office. 12 of the 28 companies with a UK delivery location report a team size of 501 people or more, and a team at that size is more likely to staff a shift spanning both windows than a team in the smallest size band. Time zone overlap and legal jurisdiction are two separate questions, and a favorable overlap on one says nothing about the other.

Best QA companies in the UK, 2026

QA Rating is published independently, and its publisher owns no company listed in this catalog.

28 testing companies in this catalog have a delivery location in one of the countries the UK covers. They are grouped below by what each is best suited for, in 10 groups. 9 of them hold a certificate confirmed by a register entry and 11 publish a rate card. Composition and order last changed on September 6, 2026.

28 companies. Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.

The companies

the UK: 28 companies, grouped by what they are best suited for.
#	Company	Delivery locations	Published rates	Team size	Reviews
Nearshore for the EU At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova.
1	Global App Testing	the UK, Romania	Not published	51-200 people	66
2	BreachLock	the USA, the UK, the Netherlands, India	Not published	51-200 people	40
3	TestFort	the UK, the USA, Ukraine	Blended $25-49/hclutch.co	51-200 people	32
4	UNGUESS	Italy, France, Germany, the Netherlands, the UK	Not published	51-200 people	27
5	a1qa	the USA, the UK, Poland, Georgia, Bangladesh, Mexico	Blended $25-49/hclutch.co	1000 or more people	20
6	QATestLab	Cyprus, France, Poland, Ukraine, the UK	Blended $25-49/hclutch.co	501-1000 people	17
7	QA Mentor	the USA, the UK, France, Ukraine, Israel, Thailand, Romania, Tunisia, India	Blended up to $25/hclutch.co	201-500 people	7
8	Cobalt	the USA, Germany, the UK	Not published	201-500 people	0
9	Cossack Labs	Ukraine, the UK	Not published	11-50 people	0
10	Critical Software	Portugal, the UK, Germany, the USA	Not published	1000 or more people	0
11	GlobalStep	the USA, Canada, the UK, Romania, Spain, France, Portugal, India	Not published	1000 or more people	0
12	Side	the UK, the USA, Canada, India, Japan, Portugal, Brazil	Not published	1000 or more people	0
13	Testronic	the UK, Poland, the USA, the Philippines, Romania, Serbia	Not published	1000 or more people	0
Automation first Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric.
14	BugRaptors	India, the USA, the UK, Australia, the UAE	Blended up to $25/hclutch.co	501-1000 people	26
15	Abstracta	the USA, Uruguay, Chile, Colombia, Canada, the UK	Blended $50-99/hclutch.co	51-200 people	24
5	a1qa	the USA, the UK, Poland, Georgia, Bangladesh, Mexico	Blended $25-49/hclutch.co	1000 or more people	20
16	2i	the UK, India	Not published	51-200 people	0
10	Critical Software	Portugal, the UK, Germany, the USA	Not published	1000 or more people	0
17	ImpactQA	the USA, the UK, India	Not published	201-500 people	0
18	QualityAI	the UK	Not published	1000 or more people	0
19	Testhouse	the UK, the USA, Australia, the UAE, Saudi Arabia, India	Blended $50-99/hclutch.co	501-1000 people	0
Embedded team model The dedicated team engagement model is offered, and at least one published case study.
3	TestFort	the UK, the USA, Ukraine	Blended $25-49/hclutch.co	51-200 people	32
5	a1qa	the USA, the UK, Poland, Georgia, Bangladesh, Mexico	Blended $25-49/hclutch.co	1000 or more people	20
16	2i	the UK, India	Not published	51-200 people	0
17	ImpactQA	the USA, the UK, India	Not published	201-500 people	0
18	QualityAI	the UK	Not published	1000 or more people	0
Nearshore for the USA At least one delivery location in Canada, Mexico, Central America or South America.
15	Abstracta	the USA, Uruguay, Chile, Colombia, Canada, the UK	Blended $50-99/hclutch.co	51-200 people	24
5	a1qa	the USA, the UK, Poland, Georgia, Bangladesh, Mexico	Blended $25-49/hclutch.co	1000 or more people	20
20	NetSPI	the USA, Canada, the UK, India	Not published	501-1000 people	11
11	GlobalStep	the USA, Canada, the UK, Romania, Spain, France, Portugal, India	Not published	1000 or more people	0
12	Side	the UK, the USA, Canada, India, Japan, Portugal, Brazil	Not published	1000 or more people	0
Performance engineering Performance testing is offered as a service, and at least one published case study reports a throughput or latency metric.
3	TestFort	the UK, the USA, Ukraine	Blended $25-49/hclutch.co	51-200 people	32
14	BugRaptors	India, the USA, the UK, Australia, the UAE	Blended up to $25/hclutch.co	501-1000 people	26
15	Abstracta	the USA, Uruguay, Chile, Colombia, Canada, the UK	Blended $50-99/hclutch.co	51-200 people	24
6	QATestLab	Cyprus, France, Poland, Ukraine, the UK	Blended $25-49/hclutch.co	501-1000 people	17
21	PFLB	the USA, the UK	Blended $50-99/hclutch.co	51-200 people	6
Security focus Security testing is offered, together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study.
6	QATestLab	Cyprus, France, Poland, Ukraine, the UK	Blended $25-49/hclutch.co	501-1000 people	17
20	NetSPI	the USA, Canada, the UK, India	Not published	501-1000 people	11
22	Bishop Fox	the USA, the UK	Not published	201-500 people	0
8	Cobalt	the USA, Germany, the UK	Not published	201-500 people	0
Crowdtesting at scale The crowdtesting engagement model is offered, and a published tester pool of 10,000 people or more, with a source.
1	Global App Testing	the UK, Romania	Not published	51-200 people	66
4	UNGUESS	Italy, France, Germany, the Netherlands, the UK	Not published	51-200 people	27
23	Digivante	the UK	Not published	11-50 people	0
Device lab coverage A published device lab of 100 real devices or more, with a source.
6	QATestLab	Cyprus, France, Poland, Ukraine, the UK	Blended $25-49/hclutch.co	501-1000 people	17
24	iXie Gaming	the USA, India, the UK, Singapore	Blended $50-99/hclutch.co	501-1000 people	3
Enterprises A verified ISO/IEC 27001 or SOC 2 certificate, a published team size of 201-500 or larger, and at least one named client that is a publicly traded company, each with a source. A company that publishes no team size does not carry this tag.
12	Side	the UK, the USA, Canada, India, Japan, Portugal, Brazil	Not published	1000 or more people	0
Fast onboarding A published onboarding time of 14 days or less, with a source.
6	QATestLab	Cyprus, France, Poland, Ukraine, the UK	Blended $25-49/hclutch.co	501-1000 people	17
Other companies in this axis No applicability tag met its criterion for these profiles.
25	Indium Software	India, the USA, the UK, Singapore, Australia, Japan	Not published	1000 or more people	21
26	Kualitatem	the USA, the UK, Pakistan, the UAE	Blended $25-49/hclutch.co	51-200 people	9
27	Testrig Technologies	India, the UK, the USA	Blended up to $25/hclutch.co	51-200 people	7
28	Zoonou	the UK	Not published	11-50 people	0

What places a company on the UK page

The geography axis is built on the Delivery locations field, the list of countries where a company runs testing work, and this field is separate from headquarters, which records where a company is registered. A confirmed UK entry in Delivery locations is what puts a company on this page, and headquarters is free to sit anywhere. Ten of the 28 companies here keep a headquarters inside the United Kingdom. The other 18 are headquartered elsewhere, spread across five further countries, and none of the 18 is excluded from this page for that reason: the qualifying fact is the delivery location entry itself, checked against a source, and the registration address plays no part in it.

How the applicability tags overlap in this composition

Embedded team model holds five companies: TestFort, a1qa, 2i, ImpactQA and QualityAI. Four of the five, a1qa, 2i, ImpactQA and QualityAI, also carry Automation first. The fifth, TestFort, does not carry Automation first.

Security focus also holds four companies: QATestLab, NetSPI, Bishop Fox and Cobalt. Two of the four, QATestLab and Cobalt, also carry Nearshore for the EU. One, NetSPI, carries Nearshore for the USA instead. Bishop Fox carries no other tag on this page.

Crowdtesting at scale holds three companies: Global App Testing, UNGUESS and Digivante. Two of the three, Global App Testing and UNGUESS, also carry Nearshore for the EU. The third, Digivante, does not carry Nearshore for the EU.

Device lab coverage holds two companies, QATestLab and iXie Gaming. QATestLab is the one company on this page carrying five applicability tags at once: Fast onboarding, Device lab coverage, Performance engineering, Security focus and Nearshore for the EU. iXie Gaming carries no other tag on this page.

Enterprises and Fast onboarding each hold a single company. Side carries Enterprises, alongside Nearshore for the EU and Nearshore for the USA. QATestLab, already named above, carries Fast onboarding.

Four companies on this page carry no applicability tag at all: Indium Software, Kualitatem, Testrig Technologies and Zoonou. No recorded criteria for any group on this page are met by any of the four.

Automation first and Performance engineering

Performance engineering holds five companies: TestFort, BugRaptors, Abstracta, QATestLab and PFLB. Two of the five, BugRaptors and Abstracta, also carry Automation first. Two others, TestFort and QATestLab, also carry Nearshore for the EU. The fifth, PFLB, carries no other tag on this page.

Automation first holds eight companies in total. Two of them, BugRaptors and Abstracta, are the same two named above under Performance engineering. Four more, a1qa, 2i, ImpactQA and QualityAI, are the same four named above under Embedded team model. One, Critical Software, also carries Nearshore for the EU. The remaining one, Testhouse, carries no other tag on this page.

Nearshore for the USA and Nearshore for the EU

Nearshore for the USA holds five companies: Abstracta, a1qa, NetSPI, GlobalStep and Side. A UK delivery location does not by itself satisfy this tag: its condition names a delivery location in the region that tag covers, a different region from the one that puts a company on this page, so each of the five earns Nearshore for the USA through a separate, second delivery location.

Nearshore for the EU is the largest group on this page, with 13 companies. Four of the 13 carry no other tag: BreachLock, QA Mentor, Cossack Labs and Testronic. The other nine combine Nearshore for the EU with at least one further tag, and each of those nine has already been named above in the group that further tag belongs to.

Field coverage beyond the applicability tags

Nine fields recorded for this composition show a gap between companies with a published, sourced answer and companies with none. A confirmed certificate is recorded for 9 of the 28 companies, leaving 19 with no certificate confirmed by a source. At least one published case study is recorded for 20 of the 28, leaving 8 with none. Named clients are unfilled for 5 of the 28, a smaller gap than any other field in this list. Engagement models are unfilled for 7 of the 28. Frameworks are unfilled for 15 of the 28, and client stages for 18 of the 28. Signs a BAA / GDPR DPA carries a wider gap than any other field in this list, unfilled for 26 of the 28. An unfilled field records the absence of a published, sourced answer, not a negative claim that the company declined to provide one.

How this ranking was put together

Membership is computed from the profile, not chosen: companies appear here when they have a delivery location in one of the countries the UK covers, as their own profile states. Position in a ranking cannot be bought. Paid options are limited to the extended profile, labelled sponsor slots and lead forms, and none of them affect tags or order.

The table compares the fields that decide this axis: delivery locations, published rates, team size, plus the number of verified reviews on external platforms. Rates, minimum project size and onboarding time carry the source they came from next to the value.

Nearshore for the EU: At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova.
Automation first: Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric.
Embedded team model: The dedicated team engagement model is offered, and at least one published case study.
Nearshore for the USA: At least one delivery location in Canada, Mexico, Central America or South America.
Performance engineering: Performance testing is offered as a service, and at least one published case study reports a throughput or latency metric.
Security focus: Security testing is offered, together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study.
Crowdtesting at scale: The crowdtesting engagement model is offered, and a published tester pool of 10,000 people or more, with a source.
Device lab coverage: A published device lab of 100 real devices or more, with a source.
Enterprises: A verified ISO/IEC 27001 or SOC 2 certificate, a published team size of 201-500 or larger, and at least one named client that is a publicly traded company, each with a source. A company that publishes no team size does not carry this tag.
Fast onboarding: A published onboarding time of 14 days or less, with a source.

The criteria for this axis are on the methodology page, together with field definitions and the rule for editorial order. Changes of order are recorded in the changelog.

Questions

Among the companies here that publish an hourly rate, how are the published bands distributed?: 11 of the 28 companies with a UK delivery location publish a blended hourly rate band. 3 of the 11 publish a band under $25 per hour, 4 publish a band from $25 to $49, and 4 publish a band from $50 to $99. None of the 11 publishes a band at $100 per hour or above.
What does a UK delivery location mean for moving personal data to and from an EU-based client?: A UK delivery location sits outside the European Union following the UK's departure from the bloc, so personal data moving between that location and an EU-based client relies on a transfer mechanism separate from the EU's own internal transfer rules. 12 of the 28 companies with a UK delivery location are themselves headquartered in the United States and 3 in India, jurisdictions that raise the same cross-border question on their own account, independently of the UK link. The delivery-location field records where the testing work happens; the agreement that governs a specific data transfer between that location and an EU-based client is a separate document the field does not capture.
What does a recorded CREST certification suggest for a company bidding into UK public-sector security testing work?: CREST is administered from the UK and is commonly named as a supplier qualification in UK public-sector penetration-testing tenders, so a recorded CREST certification signals that a company has already cleared a scheme that market may require directly. 5 of the 28 companies with a UK delivery location carry a recorded CREST certification, each checked against a source before publication. UK public-sector contracts sometimes name a specific accreditation scheme as a tender requirement, and CREST is only one of several a buyer may encounter. A buyer bidding into a tender that names a specific scheme should confirm which one the contract requires before assuming a CREST record satisfies it.
How does a UK delivery team's working day line up with a buyer's morning in the United States compared with one in continental Europe?: A UK working day runs on GMT or British Summer Time, roughly five hours ahead of the US East Coast and no more than one or two hours behind Western Europe, so a UK team's afternoon overlaps with a US East Coast morning while its whole day overlaps with a Berlin or Madrid office. 12 of the 28 companies with a UK delivery location report a team size of 501 people or more, and a team at that size is more likely to staff a shift spanning both windows than a team in the smallest size band. Time zone overlap and legal jurisdiction are two separate questions, and a favorable overlap on one says nothing about the other.

Previous versions

Each year is frozen as it stood when the snapshot was taken, with the field values recorded at that date. This page always shows the current version.

The 2026 list: 25 companies, taken 2026-09-03. 3 entered and 0 left since.

Other axes these companies appear on

Industry: Healthcare 21 of these 28 companies also stand there
Industry: Banking 20 of these 28 companies also stand there
Industry: Ecommerce 19 of these 28 companies also stand there
Type of testing: Manual testing 16 of these 28 companies also stand there

How to choose a vendor on this axis

Published by QA RatingPublished on September 3, 2026Updated on September 5, 2026

Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label. Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source.