Is it possible to confirm a game QA vendor's security certification and data-handling commitments before a call?

A studio confirms either commitment by requesting the certificate number or the signed agreement directly from a shortlisted vendor, since neither field on this page stands in for a platform holder's own certification checklist ahead of a console submission. A verified security certificate is recorded for 4 of the 33 companies in this composition: three hold ISO/IEC 27001 and one holds a CREST certificate. A signed BAA or a GDPR data processing agreement is recorded for another 4 of the 33, with the remaining 29 carrying no entry for either commitment. Security clearance for a first-party build or a day-one patch still comes from that separate document, requested before the platform holder's review window opens.

Does a review count on a game-testing vendor's profile indicate which titles or platforms that vendor has tested?

A review count on this page reflects activity recorded on an external review platform rather than a log of which titles or platforms a vendor tested, so a producer matching a specific title or console generation needs a different field entirely. An external-reviews field carries no entry at all for 9 of the 33 companies on this page, so a check built on that field alone leaves part of the list unread. Where the field is filled, it records a platform name and a count, without naming the titles or platforms behind those reviews. A producer instead reads a vendor's published case list for a title match, or asks directly before a multiplayer stress test or a platform certification pass is scoped.

How many profiles in this ranking leave out a list of test frameworks or tools, and do the applicability tags here depend on it?

A framework list is absent from the profile for 15 of the 33 companies that make up this ranking, and that gap says nothing about whether a vendor runs an engine-specific suite or a console verification pass, only that the field itself was left blank. None of the eleven applicability tags on this page reads the framework field, so a blank entry does not move a company into or out of any group here. The gap only narrows what a buyer can match against an existing engine toolchain or a target platform's verification requirements ahead of a scoping call.

Best Games QA companies in 2026

QA Rating is published independently, and its publisher owns no company listed in this catalog.

33 testing companies in this catalog list Games among the industries they work in. They are grouped below by what each is best suited for, in 11 groups. 4 of them hold a certificate confirmed by a register entry and 16 publish a rate card. Composition and order last changed on September 6, 2026.

33 companies. Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.

The companies

Games: 33 companies, grouped by what they are best suited for.
#	Company	Certificates	Case studies	Team size	Reviews
Nearshore for the EU At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova.
1	Global App Testing	ISO/IEC 27001register entry	4	51-200 people	66
2	QA Madness	None confirmed	2	51-200 people	44
3	Berezha Security Group	None confirmed	Not published	11-50 people	40
4	Applause	None confirmed	3	201-500 people	39
5	TestFort	None confirmed	5	51-200 people	32
6	UNGUESS	ISO/IEC 27001register entryISO 9001register entry	1	51-200 people	27
7	a1qa	None confirmed	3	1000 or more people	20
8	QATestLab	None confirmed	2	501-1000 people	17
9	QAwerk	None confirmed	3	51-200 people	13
10	SnoopGame	None confirmed	3	51-200 people	9
11	QA Mentor	None confirmed	Not published	201-500 people	7
12	Codoid	None confirmed	2	51-200 people	5
13	PlaytestCloud	None confirmed	3	201-500 people	2
14	GlobalStep	None confirmed	Not published	1000 or more people	0
15	Side	ISO/IEC 27001register entry	Not published	1000 or more people	0
16	Testronic	None confirmed	Not published	1000 or more people	0
Automation first Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric.
17	QA Wolf	None confirmed	3	51-200 people	65
2	QA Madness	None confirmed	2	51-200 people	44
18	BugRaptors	None confirmed	2	501-1000 people	26
7	a1qa	None confirmed	3	1000 or more people	20
9	QAwerk	None confirmed	3	51-200 people	13
19	QAble	None confirmed	4	51-200 people	8
20	Moolya	None confirmed	4	501-1000 people	7
12	Codoid	None confirmed	2	51-200 people	5
Embedded team model The dedicated team engagement model is offered, and at least one published case study.
17	QA Wolf	None confirmed	3	51-200 people	65
2	QA Madness	None confirmed	2	51-200 people	44
5	TestFort	None confirmed	5	51-200 people	32
7	a1qa	None confirmed	3	1000 or more people	20
9	QAwerk	None confirmed	3	51-200 people	13
10	SnoopGame	None confirmed	3	51-200 people	9
19	QAble	None confirmed	4	51-200 people	8
21	Ubertesters	None confirmed	1	51-200 people	7
Nearshore for the USA At least one delivery location in Canada, Mexico, Central America or South America.
22	Packetlabs	CRESTregister entry	Not published	51-200 people	72
7	a1qa	None confirmed	3	1000 or more people	20
10	SnoopGame	None confirmed	3	51-200 people	9
14	GlobalStep	None confirmed	Not published	1000 or more people	0
23	PLATO	None confirmed	1	501-1000 people	0
15	Side	ISO/IEC 27001register entry	Not published	1000 or more people	0
24	TestLauncher	None confirmed	1	51-200 people	0
Crowdtesting at scale The crowdtesting engagement model is offered, and a published tester pool of 10,000 people or more, with a source.
1	Global App Testing	ISO/IEC 27001register entry	4	51-200 people	66
4	Applause	None confirmed	3	201-500 people	39
6	UNGUESS	ISO/IEC 27001register entryISO 9001register entry	1	51-200 people	27
21	Ubertesters	None confirmed	1	51-200 people	7
25	Digivante	None confirmed	4	11-50 people	0
Device lab coverage A published device lab of 100 real devices or more, with a source.
8	QATestLab	None confirmed	2	501-1000 people	17
10	SnoopGame	None confirmed	3	51-200 people	9
21	Ubertesters	None confirmed	1	51-200 people	7
26	iXie Gaming	None confirmed	3	501-1000 people	3
27	Latis Global	None confirmed	Not published	51-200 people	0
Performance engineering Performance testing is offered as a service, and at least one published case study reports a throughput or latency metric.
5	TestFort	None confirmed	5	51-200 people	32
18	BugRaptors	None confirmed	2	501-1000 people	26
8	QATestLab	None confirmed	2	501-1000 people	17
Security focus Security testing is offered, together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study.
2	QA Madness	None confirmed	2	51-200 people	44
8	QATestLab	None confirmed	2	501-1000 people	17
9	QAwerk	None confirmed	3	51-200 people	13
Fast onboarding A published onboarding time of 14 days or less, with a source.
8	QATestLab	None confirmed	2	501-1000 people	17
28	CHEQ Systems	None confirmed	Not published	201-500 people	0
Accessibility specialists Accessibility testing is offered as a service, and at least one published case study reports an accessibility conformance metric.
23	PLATO	None confirmed	1	501-1000 people	0
Enterprises A verified ISO/IEC 27001 or SOC 2 certificate, a published team size of 201-500 or larger, and at least one named client that is a publicly traded company, each with a source. A company that publishes no team size does not carry this tag.
15	Side	ISO/IEC 27001register entry	Not published	1000 or more people	0
Other companies in this axis No applicability tag met its criterion for these profiles.
29	Indium Software	None confirmed	1	1000 or more people	21
30	Lotus Quality Assurance	None confirmed	Not published	201-500 people	9
31	Testriq QA Lab	None confirmed	Not published	51-200 people	6
32	RTTS	None confirmed	Not published	51-200 people	0
33	Testbytes	None confirmed	Not published	51-200 people	0

Nearshore for the EU: headquarters undercounts the group

The 16 companies carrying Nearshore for the EU make it the largest applicability group on this page, and the tag's criterion runs on delivery locations, not on where a company is headquartered. Counting headquarters alone tells a smaller story: seven of the 16 are headquartered inside a country the tag's own list treats as qualifying (the EU, the EEA, Ukraine, Georgia, Serbia or Moldova), spread across six countries, with two of the seven based in Ukraine. The other nine, more than half of the group, are headquartered elsewhere, mostly in the United States or the United Kingdom, and carry the tag only because their profile lists at least one additional delivery location inside the region. A company's country field on its own understates this group by more than half.

Two metric gates, one shared shape

The 8 companies carrying Automation first and the 3 companies carrying Performance engineering each clear a requirement stacked on top of a plain service listing: at least one published case study that reports a specific metric. Twenty-one of the 33 companies on this page publish at least one case study of any kind. Automation first needs one of those case studies to report a coverage or a regression-time metric, which narrows the pool to eight, fewer than half of the 21 that publish any case study at all. Performance engineering applies the same kind of gate to a different pair of metrics, throughput or latency, and clears only three of the 33. A company can sell either service and still fall outside both groups if none of its public case studies quantifies the metric the tag is built around.

Where Nearshore for the USA overlaps Nearshore for the EU

The 7 companies carrying Nearshore for the USA qualify through a delivery location in Canada, Mexico, Central America or South America. Four of those seven also carry Nearshore for the EU, so their delivery footprint reaches both regions at once. The other three qualify for the USA-facing tag only, with no delivery location placing them inside the EU-facing group as well. Neither group's membership sits entirely inside the other's; the two tags share less than a third of their combined companies.

Device lab coverage and crowdtesting at scale share one company

The 5 companies carrying Device lab coverage and the 5 companies carrying Crowdtesting at scale are not the same five. One company on this page carries both tags at once, built on two different published counts: a real device lab and a crowd tester pool. The other four members of each group carry only that one tag between the two. Two same-size groups built on different criteria can sit next to each other in a table without lining up company for company.

Where the published fields run out

Published hourly rates appear on 16 of the 33 profiles, so a rate comparison across the full page reaches fewer than half the companies listed. Named clients are missing from 9 of the 33 profiles entirely. Neither gap is checked by any applicability tag on this page: a blank field only limits what a buyer can confirm before contacting a vendor.

How this ranking was put together

Membership is computed from the profile, not chosen: companies appear here when they list Games among the industries they work in, as their own profile states. Position in a ranking cannot be bought. Paid options are limited to the extended profile, labelled sponsor slots and lead forms, and none of them affect tags or order.

The table compares the fields that decide this axis: certificates, case studies, team size, plus the number of verified reviews on external platforms. Rates, minimum project size and onboarding time carry the source they came from next to the value.

Nearshore for the EU: At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova.
Automation first: Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric.
Embedded team model: The dedicated team engagement model is offered, and at least one published case study.
Nearshore for the USA: At least one delivery location in Canada, Mexico, Central America or South America.
Crowdtesting at scale: The crowdtesting engagement model is offered, and a published tester pool of 10,000 people or more, with a source.
Device lab coverage: A published device lab of 100 real devices or more, with a source.
Performance engineering: Performance testing is offered as a service, and at least one published case study reports a throughput or latency metric.
Security focus: Security testing is offered, together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study.
Fast onboarding: A published onboarding time of 14 days or less, with a source.
Accessibility specialists: Accessibility testing is offered as a service, and at least one published case study reports an accessibility conformance metric.
Enterprises: A verified ISO/IEC 27001 or SOC 2 certificate, a published team size of 201-500 or larger, and at least one named client that is a publicly traded company, each with a source. A company that publishes no team size does not carry this tag.

The criteria for this axis are on the methodology page, together with field definitions and the rule for editorial order. Changes of order are recorded in the changelog.

Questions

Is it possible to confirm a game QA vendor's security certification and data-handling commitments before a call?: A studio confirms either commitment by requesting the certificate number or the signed agreement directly from a shortlisted vendor, since neither field on this page stands in for a platform holder's own certification checklist ahead of a console submission. A verified security certificate is recorded for 4 of the 33 companies in this composition: three hold ISO/IEC 27001 and one holds a CREST certificate. A signed BAA or a GDPR data processing agreement is recorded for another 4 of the 33, with the remaining 29 carrying no entry for either commitment. Security clearance for a first-party build or a day-one patch still comes from that separate document, requested before the platform holder's review window opens.
Does a review count on a game-testing vendor's profile indicate which titles or platforms that vendor has tested?: A review count on this page reflects activity recorded on an external review platform rather than a log of which titles or platforms a vendor tested, so a producer matching a specific title or console generation needs a different field entirely. An external-reviews field carries no entry at all for 9 of the 33 companies on this page, so a check built on that field alone leaves part of the list unread. Where the field is filled, it records a platform name and a count, without naming the titles or platforms behind those reviews. A producer instead reads a vendor's published case list for a title match, or asks directly before a multiplayer stress test or a platform certification pass is scoped.
How many profiles in this ranking leave out a list of test frameworks or tools, and do the applicability tags here depend on it?: A framework list is absent from the profile for 15 of the 33 companies that make up this ranking, and that gap says nothing about whether a vendor runs an engine-specific suite or a console verification pass, only that the field itself was left blank. None of the eleven applicability tags on this page reads the framework field, so a blank entry does not move a company into or out of any group here. The gap only narrows what a buyer can match against an existing engine toolchain or a target platform's verification requirements ahead of a scoping call.

Previous versions

Each year is frozen as it stood when the snapshot was taken, with the field values recorded at that date. This page always shows the current version.

The 2026 list: 26 companies, taken 2026-09-03. 7 entered and 0 left since.

Other axes these companies appear on

Type of testing: Manual testing 26 of these 33 companies also stand there
Delivery location: Europe 20 of these 33 companies also stand there
Type of testing: Test automation 20 of these 33 companies also stand there
Type of testing: Accessibility testing 19 of these 33 companies also stand there

How to choose a vendor on this axis

Published by QA RatingPublished on September 3, 2026Updated on September 6, 2026

Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label. Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source.