Industries
Software quality in Startups
Early-stage teams do not need a QA department. They need the two or three pieces of quality work that would actually change an outcome — and an honest answer about which of the rest can wait another two quarters.
What shapes Startups software
What tends to go wrong
There is no QA function, so testing is whatever the engineer who wrote the feature remembered to check.
Hiring a first QA or security engineer is a long lead time and a permanent cost, for work that is not yet full-time.
The site is the credibility signal for fundraising and first customers, and it is usually the thing with the least attention on it.
Shortcuts taken to reach a demo become the architecture, because there is never an obvious moment to go back.
What binds you
GDPR
Applies from your first EU user, with no grace period for company size. The parts that bite early are the ones that are expensive to retrofit: a lawful basis you can articulate, deletion that genuinely deletes, and a test environment that is not an uncontrolled second copy of production.
European Accessibility Act
In force since 28 June 2025 for consumer-facing services including e-commerce and banking. Microenterprises providing services — under 10 people and no more than €2m turnover — are exempt from the service obligations, which is a real exemption you may grow out of faster than you rebuild the interface.
Cyber Resilience Act
Only if you place a product with digital elements on the EU market; pure SaaS is generally outside it. Worth checking once, early, because the answer determines whether a whole vulnerability-handling and SBOM obligation applies to you from 11 December 2027.
Engineering practice, not legal advice.
How we work on it
What that means in practice
We do the work that does not yet justify a hire: the regression coverage on the flows that matter, a security assessment before the first enterprise conversation rather than during it, and a marketing site that reads as credible. Scope is set against the runway you have, and we say plainly when something is not worth doing yet — the point is to spend the budget where the risk actually is.
Related reading
- Accessibility
The European Accessibility Act and your website: what it actually requires
The Act has applied since June 2025. What it covers, which technical standard sets the bar today, and the accessibility failures no automated checker will ever find for you.
- EU regulation
The Cyber Resilience Act’s first deadline: what changes on 11 September 2026
From 11 September 2026, manufacturers must report an actively exploited vulnerability within 24 hours. Who that binds, what the clock actually demands, and what to have in place before it starts.
- Test automation
CI test gating: deciding what a red build is allowed to stop
Wiring a suite into a pipeline takes a day. Deciding what it may block is the real project, and it is a social agreement with a configuration file attached.
FAQ
Startups questions we hear often
We have no QA at all. What is the first thing worth doing?
Automated coverage of the two or three journeys that would embarrass you if they broke — usually sign-up, the core action the product exists for, and payment. That is a small enough scope to finish, and it converts the most common failure mode, shipping a regression nobody checked for, into a build that goes red.
Is it too early for a security assessment?
It is too early if you have no users and no data. It stops being too early the moment you are storing anything you would not want published, or the moment an enterprise conversation starts — and the second one always arrives faster than planned. Doing it before the deal is a project; doing it during the deal is a fire.
How do you scope work against a runway?
By naming what we are not doing and why. A fixed scope against a fixed budget, with the reasoning for the boundary written down, so you can see which risks are being accepted rather than discovering them later. If something on your list is not worth doing yet, we would rather say so than bill for it.
Can you work with our existing developers rather than replacing them?
That is the usual arrangement. The frameworks we build are meant to be extended by your team — page objects, isolated fixtures and CI wiring that a product engineer can add to — and security findings come with remediation sessions, so the reasoning stays with the people who will maintain the code rather than leaving with us.
Contact
Building for startups?
Tell us what you are shipping and where it worries you. You will get a considered reply from an engineer, not an autoresponder.