Quality assurance for releases that can't break

We build QA into the development team: dedicated QA engineers from the project kickoff, a test plan agreed before testing starts, and releases small enough to verify one at a time. It is how we handle legacy migrations, takeovers of code another team wrote, and software that runs inside someone else's production.
CodigoDelSur has been building and shipping software since 2007. On this kind of work, quality is defined before the first line of code changes, not checked after the last one.

When QA has to live inside the build

When a bad release costs more than the testing does. In practice, that means one of three situations.

Yes, if:

  • You are replacing a legacy codebase, and every screen has to behave exactly as it did, for every user, including the ones on assistive technology. Parity is the requirement, and it has to be tested, not assumed.
  • You inherited code another team wrote, and nobody on your side knows what is safe to touch. Before any new feature, someone has to find out what the product actually does and put tests around it.
  • Your software runs inside someone else's production: an SDK, an integration, a component your customers embed. A bug there does not break your app, it breaks theirs, and they find it before you do.

No, if:

  • What you need is a lab of physical devices or a certification audit, with no code changes attached.
  • You want a one-off test pass on a product nobody is going to touch afterwards.

How it works, in five steps

We study the product, write a test plan, design the test cases, run them and report every defect, then re-test the fixes and close each iteration with a summary report.
Kickoff and system study. We read the documentation, learn the business and agree on the scope, the test environment, and the browsers and devices that matter: the most used, OS versions, device models.
Test plan. What gets tested and what does not, which types of tests, how often each iteration runs, and the infrastructure and tools it needs. You see it before testing starts.
Test case design. Test data, priorities and dependencies between cases. Every case has a precondition, steps and an expected result, so anyone can run it and get the same answer.
Run the tests and report every defect. Cases run by hand or with automation. Each defect is logged with steps to reproduce, a priority based on the impact on your business, and evidence: a screenshot or a video.
Regression and summary report. Fixed features are tested again, and each iteration closes with a report: test cases created, run, passed and failed by severity, and the defects still open.

What each round of testing gives you

Four written artefacts, and you get all four. Nothing about the state of your product lives only in someone's head.

ArtefactWhat it contains
Test planGoals, scope, what will and will not be tested, the types of tests, how often each iteration runs, and the tools and infrastructure it needs
Test casesFor each case: id, suite, preconditions, steps, expected result, actual result, priority, the defect it is linked to, whether it passed or failed, and whether it is automated
Defect reportsDescription, the test case that found it, product version, steps to reproduce, priority based on business impact, status, and evidence as an image or a video
Summary reportTest cases created, run, passed and failed, in number and percentage, the failures by severity, and the defects found and still open in the release

The browsers and devices we test against are agreed at kickoff: the ones your users actually have, with their OS versions and device models, along with the environment the tests run in.

Who does the testing, and what they cover

Dedicated QA engineers, part of the team from the project kickoff, not a department the build gets handed to at the end.

Test levelWhat it checks
UnitIndividual modules, classes and functions, on their own
IntegrationHow the different components behave when they talk to each other
SystemThe behaviour of the whole product, from your point of view as the client
User acceptanceThe behaviour of the whole product, from the point of view of the person who will use it

They combine black box testing of what the software does, white box testing of how the code does it, exploratory testing for the cases no script would think of, and regression testing of everything that was already fixed.

The tools follow the project. For example: Mocha and Chai for unit tests on Node.js, and Selenium WebDriver with TestNG and Maven for automated tests. Defects are tracked in a tool such as Jira, each one linked to the test case that found it.

On a dedicated team, QA is an optional role and one we recommend. It is not included by default, so you decide whether the team carries it. The project manager on our side is included at no extra cost and coordinates each release with your team.

What it costs and how billing works

QA is billed like any other role on the team: per sprint, for hours worked, in dollars, Net 14.

What it costs depends on seniority and on what the role covers, and you get the number in writing before you commit to anything. The minimum project size is $10,000, roughly one engineer for one month, and the shortest engagement we sign is two weeks, one sprint. There is no recruiting fee, no placement fee and no management fee, and the project manager on our side is included at no additional cost. Billing is per sprint, Net 14, or monthly if your finance team prefers, with volume discounts of 5 percent from five people and 10 percent from seven.

If you are about to migrate, or you have inherited an app nobody trusts, one QA engineer for one sprint is a real engagement and a cheap way to find out how bad it is.

Three releases that couldn't break

A frontend migration inside a live customer service platform, an identity SDK that ships inside other companies' apps, and an MVP rescued after another team could not ship it.

Help Scout runs a customer service platform its clients work in all day. Our engineers, working inside the Help Scout team, migrated roughly five legacy sidebar applications from jQuery and Backbone to React. Feature parity and accessibility were explicit acceptance criteria rather than a follow-up, and the test coverage was built first, because it is what made an incremental rollout safe.

Acuant verifies identities for other companies. We built and maintained its iOS and JavaScript SDKs, including reading the NFC chip in a passport. That code runs inside other companies' production systems, so it ships through an automated release pipeline built for exactly that.

HeyConnect came to us after a third party MVP had failed. We reworked the database schema and the AWS infrastructure first, because everything above them depended on getting that right, and shipped the app in five months on the App Store and Google Play, at a 0.95 Apdex score. Anything above 0.94 is rated excellent.

Staff augmentation, dedicated team or full-cycle product development

Three different products get sold under the same word, "outsourcing". They are not interchangeable and picking the wrong one is the most expensive mistake in this category. QA is not a fourth model: it rides on one of these three.

Staff augmentationDedicated teamFull-cycle product development
Who owns the roadmapYouYouShared, we run discovery
Who manages day to dayYour engineering managerYou, with a CodigoDelSur project manager coordinating on our side at no extra costOur project manager
What you getIndividual engineers inside your teamA team shaped around your product, staffed and coordinated by usA product, from discovery to store release
You need to haveTechnical leadership with spare capacityA product owner and a clear roadmapA budget and a problem worth solving
Where QA fits bestA QA engineer inside your team, testing what your own developers shipA team that builds and tests its own releases, with QA as part of itWe own the product and its quality, from discovery to store release
Typical size1 to 4 people4 to 12 peopleScoped per project
Minimum commitmentTwo weeks, one sprintTwo weeks, one sprintQuoted per project
Best whenThe work is defined and you are short on handsYou own a product area and want it staffed and coordinated as one teamYou need the thing to exist and you do not have an engineering org

When a testing-only firm is the better fit

When what you need is testing capacity with no code changes attached. If you need a lab full of physical devices, a certification audit or a one-off test pass on a product nobody will touch afterwards, a firm that only does testing is built for that. We are the right call when the risk is in the code, and the same team has to find the problem, fix it and prove the fix holds.

Where "taking over an app somebody else built" fits

It is the same work seen from the other end. We review what the app does, put tests around the flows that matter, and fix from there. Cohorts, a community app that had launched with numerous bugs, got its defects fixed and an updated version published. SINES, a meditation app built by another team, is back to reliable operation and still maintained by us. If what you need is engineers inside your own team rather than a team of ours, that is staff augmentation.

Frequently asked questions

Do you write automated tests or test by hand?

Both. Test cases run by hand or with automation, depending on what the test plan calls for, and exploratory testing covers what a script would not think to try.

What do you report after each round of testing?

A summary report per iteration: test cases created, run, passed and failed by severity, and the defects still open in the release.

What time zone do your engineers work in, and how much overlap will I get?

Our engineers work 10:00 to 19:00 Uruguay time, which is UTC minus 3. That covers the entire US East Coast working day, five to six hours of live overlap with the West Coast, and an afternoon overlap with Europe. The schedule is set that way deliberately: shifting the day an hour later widens the Pacific overlap without asking anyone to work nights, and it is the reason this arrangement is still working in month twelve rather than quietly falling apart in month three.

How fast can you actually start?

Five business days from signed agreement to first day is the standard, and if the engineer is already on our bench and your side is ready to receive them, they can start as soon as the next business day. What varies is finding the right person, not starting them: if the profile is on our bench you get CVs one business day after you sign off the role brief, and if the role has to be recruited, first CVs take about five business days. We tell you which of the two you are in on the first call, before you have signed anything, because that is what actually moves your start date.

What happens if the engineer is not working out?

You tell your account manager and we replace the person at our cost. There is no charge for the search and no penalty for asking. The outgoing and incoming engineers overlap for ten business days so that context, access and work in progress transfer inside the engagement instead of landing back on your team, and those ten days are not billed: during the handover you keep paying exactly what you were paying for one engineer. We would rather absorb that than have you carry a bad fit for a quarter, and a company that will not put a replacement policy in writing is telling you something.

Who owns the code and the intellectual property?

You do, exclusively. Everything created for you as part of the work is assigned to you with full title guarantee: source code, application logic, APIs, integrations, data models, configurations, UI and UX designs, documentation and any derivative works. The assignment covers the deliverables as they are created, it is not conditional on final payment, and it is not a licence back to you, it is ownership. We also warrant that what we deliver does not infringe any third party's intellectual property, and where third party material is involved we secure the consents for both sides first. For our own pre existing components that were not written specifically for you, you get a non exclusive, irrevocable, royalty free licence to use, copy and modify them, so nothing we bring with us can be used to lock you in later. Every CodigoDelSur employee signs a non disclosure agreement and an intellectual property assignment as a condition of employment. In practice we also work inside your repositories and your cloud accounts, so in most engagements the code never lives anywhere else to begin with.

Will the engineer work only for us?

A full time engineer works for one client only. If you take someone full time they are on your product and nothing else: your standups, your sprint planning, your Slack, and for practical purposes they are part of your team, with the difference that their employment, payroll and career are our responsibility. If you only need part of a person we do offer part time engineers, and a part time engineer is assigned to a maximum of two projects, never more. We tell you which of the two you are getting before you sign, because "dedicated" is a word this industry uses loosely.

Tell us what you are about to ship

Tell us what you are about to ship, what breaks if it goes wrong and what you have tested so far, and we will tell you on the same call what a first test cycle would cover and what it would take to run it.