Clear line from rule to test
Every requirement linked to tests and results you can show.
[ Why regulatory compliance testing ]
Policies say what should happen. Testing proves it does.
Most compliance requirements end up as software behaviour: a consent choice that must stop tracking, a record that must never be edited without a trace, a card number that must never appear in a log. If nobody tests those behaviours, a policy document is all you have. Compliance testing checks them one by one, on every release, and keeps the evidence your auditors, regulators and customers will ask for.
Security controls in depth: security compliance testing →
Fewer audit surprises
Gaps found and fixed before an auditor or customer finds them.
Evidence ready when asked
Organised, traceable proof instead of a last-minute scramble.
Compliance that survives releases
Regression keeps controls working as the product changes.
Regulations and standards we test against
We test against the requirements; certification and legal opinions stay with your auditors and advisers.
Privacy
GDPR · CCPA / CPRA · PIPEDA · DPDP Act
Healthcare
HIPAA
Payments
PCI DSS
Security frameworks
SOC 2 · ISO 27001
Life sciences
FDA 21 CFR Part 11 · GxP / CSV · ISO 13485 · IEC 62304
Accessibility
WCAG · ADA · AODA
Accessibility laws in depth: accessibility testing →
[ What we test ]
Ten ways we test compliance and prove it
From turning rules into tests to handing your auditor a clean evidence pack. Each one lists what we do, when you need it and the problem it prevents.
Compliance requirements mapping
Rules into testsWe turn the regulations and standards that apply to you into clear, testable requirements, and link each one to test cases.
What we test
- Applicable clauses identified with your compliance team
- Each requirement written as something testable
- Test cases linked to every requirement
- Gaps where nothing is tested yet flagged
When you need it
At the start of a regulated project, and when rules change.
The problem it preventsNot knowing which parts of a regulation your testing actually covers
Privacy & data protection testing
GDPR, CCPA, PIPEDA, DPDPWe test how your product collects, uses, stores and shares personal data against the privacy laws in your markets.
What we test
- Personal data collected only where it is needed
- Data masked, encrypted or hidden where expected
- Data shared only with the services it should be
- Data stored and transferred to the right regions
When you need it
For any product handling personal data, before launch and on major changes.
The problem it preventsPersonal data exposed, over-collected or sent where it shouldn’t go
Consent, cookies & data subject rights
User choices respectedWe check that users’ privacy choices really work, and that they can see, export and delete their data when they ask.
What we test
- Cookie banners and consent choices honoured
- Tracking blocked until consent is given
- Access, export, correction and deletion requests
- Withdrawal of consent and account deletion
When you need it
For websites, apps and SaaS products in privacy-regulated markets.
The problem it preventsA consent banner that looks right but changes nothing
Audit trail & e-signature testing
21 CFR Part 11 and similarRegulated systems must record who did what, when and why. We test that records are complete, secure and can’t be changed.
What we test
- Every create, change and delete recorded with user and time
- Audit records protected from editing or deletion
- Electronic signatures linked to the record and reason
- Records readable and exportable for inspectors
When you need it
For life sciences, healthcare, quality and finance systems.
The problem it preventsAn audit trail that can’t stand up to an inspector’s questions
Role-based access & data retention
Right people, right timeWe test that each role can see and do only what it should, and that data is kept and deleted according to your policies.
What we test
- Every role and permission tested against your access matrix
- Segregation of duties for approvals and changes
- Retention periods and automatic deletion
- Archiving, legal hold and restore
When you need it
For multi-role, regulated and enterprise products.
The problem it preventsUsers seeing data they shouldn’t, or records kept far too long
Computer system validation
IQ, OQ, PQFor GxP-regulated systems, we help plan and run validation so you can show the system works as intended in your environment.
What we test
- Validation plan aligned with GAMP 5 principles
- Installation, operational and performance qualification scripts
- Executed scripts with evidence and deviations
- Traceability from requirements to results
When you need it
For life sciences systems before go-live and after significant changes.
The problem it preventsA system in use without the validation evidence inspectors expect
Payment data handling checks
PCI DSS focusedWe test how your product handles card data, so sensitive details never end up where they shouldn’t.
What we test
- Card data never shown, logged or stored in full
- Tokenisation and hosted payment fields working
- Masking in screens, emails, logs and exports
- Access to payment data limited by role
When you need it
For any product taking or storing payments. For deeper testing, see security testing.
The problem it preventsCard numbers turning up in logs, emails or support tools
Compliance regression on every release
Stay compliantEvery release can break a control that was working. We re-test your compliance-critical features on each release.
What we test
- Compliance test suite linked to requirements
- Run on every release, manually and automated
- Changes to regulated features flagged early
- Results kept as evidence over time
When you need it
For any product with ongoing compliance obligations.
The problem it preventsA release that quietly breaks a control you were audited on
Evidence packs & traceability
Audit-readyWe prepare clear, organised evidence that shows what was tested, against which requirement, with what result.
What we test
- Traceability matrix from requirement to result
- Test results, screenshots and logs
- Defects, fixes and retests recorded
- Organised for your auditors and assessors
When you need it
Before audits, assessments and customer security reviews. See also audit & documentation.
The problem it preventsScrambling for evidence the week before an audit
Gap assessments before audits
Know before they doA focused review of where your product and testing stand against a regulation, so you can fix gaps before an auditor finds them.
What we test
- Requirements compared with current behaviour
- Missing controls, tests and evidence listed
- Gaps ranked by risk and effort
- Practical plan to close them
When you need it
Two to three months before an audit or assessment.
The problem it preventsSurprise findings in a formal audit
[ Compliance testing vs security testing vs audit ]
Three different jobs that support each other
Here is who answers which question, and how a single requirement is traced from rule to evidence.
| Question it answers | How | |
|---|---|---|
| Compliance testing | Does the product behave as the rules require? | Tests mapped to requirements, with evidence |
| Security testing | Can it be attacked or misused? | Vulnerability scans, penetration tests, code review |
| Audit & certification | Does the organisation meet the standard? | Independent auditors and assessors |
Sample traced requirementPass
- Requirement
- 21 CFR Part 11 · 11.10(e) Audit trails
- Test
- Edit an approved record, then try to change its audit entry
- Expected
- Change logged with user, time, old and new value; audit entry cannot be edited
- Result
- Pass · entry locked, 4 fields recorded
- Evidence
- Screenshots, exported audit log, test run ID
- Traced to
- Requirement REQ-AT-03 · test case TC-118
Example only. Real requirements come from the rules that apply to you.
[ How we work ]
Six steps from regulation to audit-ready evidence
Your compliance team decides what applies. We make sure it is tested, proven and kept that way.
-
Step 1 of 6
Identify what applies
Regulations, standards and contracts that apply to your product and markets, agreed with your compliance team.
You getApplicable requirements list -
Step 2 of 6
Map to tests
Each requirement written as testable criteria and linked to test cases.
You getRequirements-to-test map -
Step 3 of 6
Assess the gaps
Current behaviour and evidence compared with what is required.
You getGap assessment -
Step 4 of 6
Test and record
Compliance tests run with evidence captured as we go.
You getResults with evidence -
Step 5 of 6
Fix and retest
Gaps fixed by your team; we retest and record the outcome.
You getRetest results -
Step 6 of 6
Hand over evidence
Organised, traceable evidence for auditors, plus a regression suite.
You getEvidence packCompliance regression suite
- Free one-week POCWe map one regulation to your key features and test the most important requirements.
- Honest about our roleWe test and provide evidence; certification and legal advice stay with the right experts.
- Careful with dataNDA first, test data by default and no real personal data unless agreed.
[ Tools ]
The tools behind our compliance testing
10 tools across three jobs. Traceability matters more than any single tool, so we work in the systems your auditors already know.
Test management & traceability
Requirements, tests and evidence.
- JiraRequirements and defects
- TestRailCompliance test runs
- XrayTraceability in Jira
- ConfluenceEvidence and validation docs
Privacy & data checks
What data goes where.
- Chrome DevToolsCookies, storage and requests
- Charles ProxyTraffic inspection
- PostmanData access requests via API
Security & accessibility checks
Supporting controls.
- OWASP ZAPBaseline security scans
- SonarQubeCode quality checks
- axe DevToolsAccessibility checks
See every tool we use on our technology stack page →
[ Case Studies ]
Products our QA engineers have worked on
Each one links to the full write-up by the engineers who ran it. Kintavo and Drop Delivery are regulated or compliance-heavy products; the others show our wider QA work.
[ Ways to work ]
Six ways to get compliance testing done
A gap assessment before an audit, compliance regression every release, or validation for a new system.
01Dedicated QA teamChoose it when you release every sprint and want testers who know your product.02Managed testingChoose it when you want compliance testing and evidence handled for you.03Fixed-price projectChoose it for a launch or a test cycle with a clear scope and date.04On-demand testingChoose it for a release, a launch week or a device sweep.05Staff augmentationChoose it when your team needs extra manual testers for a while.06QA consultingChoose it for a review of your test process, cases and documentation.
Not sure which fits? Find your model in four questions or compare all six.
[ FAQ ]
Regulatory compliance testing questions, answered
{{ f.a }}
[ Contact us ]
Get a compliance testing plan before your next audit
✓ Free one-week POC✓ NDA before access✓ A QA lead replies the same day