Find the bugs, bottlenecks and breaking points before your customers do.
Assertwise runs QA, test automation, performance, load, stress and API testing for SaaS and fintech teams of 10–200 people. Findings come with evidence your engineers can reproduce.
20 minutes, no slides. You leave with the three highest-risk areas to test first.
- GDPR-aligned data handling
- Mutual NDA before you share specs
- Test data under a DPA, deleted at the end
- English & German
- Irish-registered Ltd · CRO no.
API & load test report
Fictional fintech API · abridged sample
| Severity | Category | Finding | Recommendation |
|---|---|---|---|
| High | API1:2023 BOLA | GET /v1/accounts/{id} returns other tenants’ accounts when the ID is changed. | Enforce tenant ownership check; add negative contract test. |
| High | Load | Connection pool exhausted at ~600 VUs; p95 exceeds SLO. | Raise pool, add pgbouncer; re-test. |
| Medium | API4:2023 | No rate limit on POST /v1/webhooks. | Add per-key rate limit and 429 with Retry-After. |
Focused packs for releases, pipelines, migration, a11y and MCP
Pre-launch go / no-go with evidence
Critical journeys, API smoke, focused load check, written decision.
See Release Gate CI flake triageMake the pipeline trustworthy again
Root-cause the worst flakes, quarantine safely, leave a green path.
See flake triage Import ConciergeMigrate into TestHub cleanly
TestLink / TestRail import with structure cleanup and a verified sample run.
See Import Concierge Accessibility sprintEAA-oriented evidence for critical journeys
Time-boxed WCAG-oriented audit, ranked backlog, one re-test round.
See accessibility sprint MCP PilotWire AI assistants to real QA tools
Scoped MCP setup, a few high-value tools, safe-use playbook for your team.
See MCP Pilot Assertwise MCPProduct waitlist for TestHub & a11y MCP
Early access — not a public production server yet.
See Assertwise MCPAssertwise TestHub — test management, EU-hosted by default
Online suites, runs and evidence for SaaS and fintech QA teams. Early access open; no public dashboard yet.
For teams without a dedicated QA function.
At 10–200 people, testing usually sits between developers and the release deadline. You get hands-on testing help without hiring a team, and suites that stay in your repo.
Senior hands-on
The person who scopes the work writes the tests and the report. No account managers, no junior handoff.
Evidence, not opinions
Every finding has reproduction steps, a request/response or trace, severity and a suggested fix.
You keep the code
k6, Playwright and API test suites are committed to your repo and documented for your team.
EU data handling
Test data and credentials are handled under a DPA and deleted at the end of the engagement.
Six testing services, one accountable engineer.
Pick one service or combine them. Every engagement ends with a written report, reproducible scripts, and a debrief with your team.
QA & Software Testing
Manual, exploratory and regression testing of web apps and APIs, with automation where it pays back.
See scope and deliverablesPerformance Testing
Baseline latency and throughput per endpoint, profile bottlenecks, and set budgets your CI can enforce.
See scope and deliverablesLoad & Stress Testing
Load, stress, spike and soak tests with k6 against production-like environments. Find the breaking point before your users do.
See scope and deliverablesAPI Testing
Functional, contract and security testing mapped to the OWASP API Security Top 10.
See scope and deliverablesTest Automation & CI
Playwright, k6 and API suites wired into GitHub Actions or GitLab CI — owned by your team after handover.
See scope and deliverablesQA Consulting & Audit
A written audit of your test strategy, coverage and release process, with a prioritised 90-day plan.
See scope and deliverablesSee what you get before you book.
Case studies are published only with client approval. Until then, here is the real format of our work: the sample report, the deliverables, and free tools you can run today.
API & load test report
Fictional fintech API · abridged sample
| Severity | Category | Finding | Recommendation |
|---|---|---|---|
| High | API1:2023 BOLA | GET /v1/accounts/{id} returns other tenants’ accounts when the ID is changed. | Enforce tenant ownership check; add negative contract test. |
| High | Load | Connection pool exhausted at ~600 VUs; p95 exceeds SLO. | Raise pool, add pgbouncer; re-test. |
| Medium | API4:2023 | No rate limit on POST /v1/webhooks. | Add per-key rate limit and 429 with Retry-After. |
The sample report
An abridged 8-page sample from a fictional fintech API. Every number in it is example data — not a client result.
- Executive summary for leadership
- Findings with severity and evidence
- Capacity and latency analysis
- Prioritised fix plan
- Scripts and how to re-run them
What every engagement delivers
Written test plan
Test plan, environments, timeline and a fixed scope — within 2 business days of the first call.
Tests in your repo
k6, Playwright and API suites committed to your repository, documented, and wired into your CI.
Findings report
Prioritised findings, each with reproduction steps, a request/response or trace, severity and a suggested fix.
Debrief with your team
A 60-min walkthrough of the results. Critical findings are reported the same day, not at the end.
Assertwise Lab — try our work on your own API
All free toolsAPI response time check
Up to 10 sequential GETs with DNS, TCP, TLS, TTFB and total time, p50/p95 and status codes.
Open tool Runs on our serverSecurity headers & CORS check
Grades HSTS, CSP, X-Content-Type-Options, frame options, Referrer- and Permissions-Policy, cookies and CORS.
Open tool Runs in your browserOpenAPI validator & linter
Validates OpenAPI 3.x (YAML/JSON): schema errors, unresolved $refs, docs, naming, auth and OWASP API Top 10 hints.
Open tool Runs in your browserk6 script generator
Turns an OpenAPI spec or a curl command into a k6 script with scenarios, thresholds and checks.
Open toolFrom first call to report in four steps.
20-min audit call
We look at your stack, release process and the risk you want reduced.
Written scope
Within 2 business days: test plan, environments, timeline and a fixed scope.
Testing
Daily async updates. Critical findings reported the same day, not at the end.
Report & debrief
Prioritised findings, scripts in your repo, and a 60-min walkthrough.
How engagements are priced
Every engagement is quoted after the 20-min call and agreed in writing before work starts — scope, timeline and deliverables included. Pick the model that fits the problem.
- Project · fixed scopeA defined question answered with a written report by an agreed date. Best for launches, audits, migrations.
- Monthly retainerAgreed days per month for regression, pre-release performance checks and suite maintenance. Best for teams releasing weekly.
- Embedded QAInside your sprints, tracker and stand-ups for a set period. Best before hiring your first QA engineer.
For regulated, high-traffic products.
Questions teams ask before booking
What happens in the 20-min call?
We look at your stack, release process and the risk you want reduced. You leave with a list of the three highest-risk areas to test first.
Do you sign an NDA and a DPA?
Yes. A mutual NDA before you share specs, and test data and credentials are handled under a DPA and deleted at the end of the engagement.
Who owns the test code?
You do. k6, Playwright and API suites are committed to your repository and documented for your team.
Are you a compliance consultancy?
No. We produce test evidence; legal interpretation stays with your counsel.
Releasing something risky soon?
Book a 20-minute call. You leave with a list of the three highest-risk areas to test first.