Software testing and QA

Functional, load and usability work mostly happens from the user's side of the screen, so a test environment and a few test accounts are enough. Automated tests are healthiest when they live in your repository alongside the code, which is why automation needs limited repository access. For penetration tests it depends on whether you choose a black-box or white-box approach in the contract.

No. A scan uses automated tools to look for known weaknesses: broad coverage, little depth. In a penetration test a specialist studies your business logic and spends hours trying things by hand. Can a dealer login open another dealer's orders? Can a refund be fired twice? Scanners miss that sort of flaw. Your hosting company's terms may require advance notice of a pen test, and we settle that with you before any work begins.

A week or two usually covers functional checks on a smaller application. For load testing ahead of a major campaign allow a month at least, since the first round of measurements prompts tuning and a second round. Penetration test timing is driven chiefly by approvals and by correspondence with your hosting company.

Single assignments are invoiced at €55 an hour plus VAT and never exceed the cap in your approved quote. Where every release needs regular testing, the work can sit inside a Start, Business or Premium monthly plan. Invoices come as PDF by email, payable within 30 days. Since the service is bought from abroad, check with your mali müşavir how KDV should be declared at your end.

Ideally no genuine records should be there, so we suggest invented data or a masked copy. If real data truly cannot be avoided, a data processor agreement under KVKK is signed first, access is kept as narrow as possible, logged throughout and revoked at the end. Special categories of personal data, such as health information, get no exceptions to that rule.