Ranking / Vendor profile

QASource

Overall score: 43.1 / 100, rank 2 of 12
Headquarters: Pleasanton, US [e-0014]
Headcount range: Not confirmed by two sources
QA-only company: Yes, QA and testing only [e-0015]
Evidence verified on: 2026-11-11

Not ideal for

Situations where the published evidence does not support this vendor. Each line links to its source.

Buyers who need performance or load testing of a security product: no published case or review covers it. [e-0010][e-0011]
Buyers who need an engagement history beyond 12 months with a security vendor: the longest evidenced engagement is 6 months. [e-0012]
Buyers whose product is a SIEM, email security or data protection tool: no case or review covers those classes. [e-0010][e-0011][e-0012]

Security-product QA evidence

Case studies and reviews that describe QA work on a product whose primary purpose is security. Penetration testing for other clients is excluded under the methodology.

e-0010
case-studyCase study, endpoint protection and EDR
casestudies.com · undated · C indirect · verified 2026-11-11
Endpoint protection and EDR; tests: functional, compatibility, api, automation; client not named; vendor-reported metric: 300% increase in regression testing coverage
e-0011
reviewClutch review, endpoint protection and EDR
clutch.co · 2018-04-26 · B single source · verified 2026-11-11
Endpoint protection and EDR; tests: api; team: 7; client not named
e-0012
reviewClutch review, network security
clutch.co · 2023-04-11 · C indirect · verified 2026-11-11
Network security; tests: functional, api; team: 2 to 5; duration: 6 months; client not named

Score breakdown

Eight dimensions, each scored 0 to 10 by the frozen rules and multiplied by its weight. Bars are drawn from data/scores.json.

1 Security-product evidence depth weight 204.0 / 10
Three verified security-product QA items, one of them older than 60 months and counted at half. Of these, zero name the client, two state team size or duration and one states a metric. [e-0010][e-0011][e-0012]
2 Product-class coverage weight 124.0 / 10
Two product classes evidenced: Endpoint protection and EDR; Network security. [e-0010][e-0011][e-0012]
3 Test-type depth weight 158.0 / 10
Four test types evidenced on security products: functional, automation, api, compatibility. [e-0010][e-0011][e-0012]
4 Engagement longevity weight 102.0 / 10
Longest evidenced engagement with a security vendor: 6 months. [e-0012]
5 Third-party review signal weight 123.0 / 10
One verified platform review of security-product QA work within 60 months; newest dated 2023-04-11. [e-0012]
6 Vendor's own security posture weight 107.0 / 10
Evidenced: ISO 27001 with reference IS 791318; a published test-data handling statement; a security page or named security officer. [e-0016]
7 Team scale and specialisation weight 93.0 / 10
Headcount not confirmed by two consistent sources, 0 points; QA-only company, 3 points; no dedicated security-product QA page, 0 points. [e-0015]
8 Transparency weight 122.5 / 10
One of four items present: team locations; missing: public rate, named leadership with profiles, published QA process page. [e-0014][e-0015]

Product classes covered

Verified security-product QA items per class. A class counts only when the source names the product type, for example EDR¹ for endpoint or SIEM² for detection platforms.

Product class	Evidence items
Endpoint protection and EDR	2
SIEM, XDR and detection platforms	0, no evidence
Identity and access management	0, no evidence
Network security	1
Email and web security	0, no evidence
Data protection and backup	0, no evidence
Vulnerability and exposure management	0, no evidence
SOAR and incident response	0, no evidence
Cryptography and key management	0, no evidence
Mobile and application security products	0, no evidence

Test types evidenced on security products: functional, OS, browser or agent compatibility, API and automation. [e-0010][e-0012][e-0011]

1 EDR: Software that watches laptops, servers and phones for suspicious behavior, records what it sees, and alerts administrators so they can investigate and respond. Source
2 SIEM: A system that collects log data from many sources into one place so security teams can search it, correlate events and spot attacks. Source

Vendor's own security posture

Controls a security vendor usually asks of a QA partner that will handle builds and test data.

ISO 27001: Certificate reference IS 791318, held by bebo Technologies as named on the vendor's page [e-0016]
SOC 2: Not published
Test-data handling: Published statement [e-0016]
Security page or officer: Security page [e-0016]

Transparency

The four items scored in dimension 8 of the methodology.

Public rate: Not published
Leadership: Rajeev Rai, Founder and Chief Executive Officer [e-0015]
QA process page: Not published
Team locations: Pleasanton, US; Chandigarh, India; Bhubaneswar, India; Aguascalientes, Mexico [e-0014][e-0015]

Compare and browse

The two vendors nearest by overall score, and the facet pages that list this vendor.

DeviQA vs QASource DeviQA overall 44.8
QA Mentor vs QASource QA Mentor overall 32.4
Endpoint protection and EDR facet page
Test automation facet page
Compatibility testing facet page
North America facet page
RFP questions to send this vendor
How to shortlist a QA vendor for a security product
Full ranking of 12 vendors

Logged corrections: changelog. Raw evidence: data download.

Scores are computed from publicly available evidence as of the verifiedOn date on each item. They describe published evidence, not service quality. Re-verify with the vendor before contracting.