Your delivery date can't absorb a full open tender. We keep your test data on your own network.
BetterQA holds a NATO NCIA Basic Ordering Agreement, NCAGE 1JGAL, so NCIA can buy from us through a competition among BOA holders instead of a full open tender. We test inside your controlled environment.
Start a two-week pilotThe screen hides it, the API still serves it
A viewer role has no Export button, so the menu looks correct. The export endpoint checks that the caller is logged in, not what the role may read. Anyone who calls the URL directly gets the file. Access rules written once in the interface and not at the data are the commonest gap.
tested as each role, against the API, not through the menufor (const role of roles) for (const ep of endpoints) { const hidden = !ui.shows(role, ep.action) const res = await api.as(role).call(ep) if (hidden) expect(res.status).toBe(403) // got 200 }
The log says an export happened, not what left
A bulk action writes one line with a count and no list of documents, so nobody can say which records were disclosed. A log that an administrator can edit, or whose rows are not chained, cannot show that it was left alone. Completeness and tamper evidence are testable properties.
who, what, which record, when, and from whereconst ids = await bulkExport(user, 240) const entries = audit.forUser(user.id, 'EXPORT') expect(entries.map(e => e.docId).sort()).toEqual(ids.sort()) audit.rewriteRow(entries[100].id, { actor: 'u99' }) expect(audit.verifyChain()).toBe(false) // got true
The app assumes the internet is there
Software delivered into a closed network meets its hidden calls at start-up. A licence check to the vendor, fonts from a CDN, a telemetry beacon, a dependency fetched on first run. Each either fails the launch or hangs until a timeout, and none of it appears in a test on a connected laptop.
found on the first day inside the customer's networkconst env = await sandbox.start(build, { network: 'none' }) await env.waitReady({ timeout: '60s' }) expect(env.egressAttempts()).toEqual([]) // got 4 hosts expect(await env.smoke('login', 'search')).toPass()
A failed test copies real data out of the network
Screenshots, traces, video and error reports capture whatever was on screen: names, case references, API bodies. If the runner uploads them to a hosted service, the data left the network through the test tooling, not through the application.
the artifacts of a run are data tooawait suite.run({ failAt: 9, artifacts: 'on-site' }) expect(network.outbound()).toEqual([]) // got 1 upload expect(artifactStore.location()).toBe('approved-share') expect(scan(artifacts, realDataPatterns)).toEqual([])
Illustrative examples built from defect patterns we test for. Not client data.
Your code is written in hours. Our pipeline keeps up.
| regime | where it actually breaks | what we run |
|---|---|---|
| NATO NCIA Basic Ordering Agreement | A purchasing route with terms agreed in advance. It obligates neither party to order or supply, and it is not a certification, an approval or a clearance. | NCIA competitions among BOA holders, not a full open tender; other buyers use their own procurement route |
| ISO/IEC 27001:2022 | Our certificate covers how we handle client data, credentials and test environments, not your system's accreditation | testing inside your network under our ISO 27001 controls |
| NIS2 | Applies to central-government bodies and reaches their suppliers through supply-chain requirements; bodies working mainly in defence, national security or law enforcement are excluded | we built NIS2 Manager; security evidence per control |
What we can show
- Holder of a NATO NCIA Basic Ordering Agreement, NCAGE code 1JGAL.
- Four ISO certificates: 9001, 27001, 14001 and 13485.
- We built NIS2 Manager, a compliance tool for the EU NIS2 directive.
A Basic Ordering Agreement is a purchasing route: NCIA can order from us under terms that are already agreed.
Read-only users can download documents the screen hides
- Sign in as a viewer; the document page shows no Export button
- Call GET /docs/88/export with the viewer's session
- The file downloads, and the audit log has no entry
Fix: Check the role on the export endpoint and write an audit entry for every export.
Send your supplier questionnaire. We answer it line by line.
Start a pilotMore industries: see how we test for each one.
The agreement is a purchasing route
A Basic Ordering Agreement registers a supplier with the agency and fixes the commercial terms in advance. Once it is in place, an order can be raised against those terms instead of starting a procurement from scratch. That is the entire value of it, and it is a real one.
That is the practical value: a procurement officer can raise an order against terms that are already agreed, and the project starts without a contract negotiation.
What the agreement takes off your schedule
Vendor registration
Already done. The NCAGE code exists, the entity is on file, and nobody has to sponsor us through registration before work can begin.
Commercial terms
Already agreed. The clauses that normally take a legal review cycle are settled and sitting in the signed agreement.
The open tender
Replaced, for NCIA buyers, by a competition among BOA holders. That shorter route is the step that saves weeks, and it is the reason a BOA is worth holding.
Information security evidence
Our ISO 27001:2022 certificate covers the management system behind how we handle client data, credentials and test environments. Read the scope note on our certifications page before you rely on it for a specific engagement.
What we take on
We can
- Be engaged through NATO procurement frameworks under the Basic Ordering Agreement.
- Take defence and government work that does not involve classified material.
- Work inside client-controlled environments, so test data stays on approved networks.
- Bring functional, automation, performance and security testing, with the information security controls our ISO 27001 certification requires.
- Support medical device programmes under ISO 13485:2016, which is unusual for a QA supplier.
- Put in front of you four ISO certificates - 9001, 27001, 14001 and 13485 - audited by an accredited body, with our control documentation available under NDA.
How a supplier describes itself predicts how it will describe your defects
You are buying an opinion about whether software is ready to ship. The whole service is a claim about evidence, so the supplier's own relationship with evidence is the thing you are actually procuring.
We would rather show you the evidence than a badge: the agreement, the certificates with their scope statements, and example findings.
How we got the agreement
The case study walks through what the Basic Ordering Agreement covers and how we got it. Read the NATO NCIA case study.
Bring us your procurement requirements
Send the supplier questionnaire. We will answer it line by line.
Need help with software testing?
BetterQA provides independent QA services across manual testing, automation, security audits, and performance testing. ISO 27001, 9001, 14001 and 13485 certified.