Does Wavesteam provide software testing, and what does it include?

Yes. A production development engagement normally includes developer checks, functional and negative testing by QA, defect tracking and repair, pre-release regression, and client user acceptance testing. Performance, security, device, payment, cross-platform, accessibility, and penetration testing are specialist scopes; the applicable environment, targets, and deliverables are agreed from project risk.

Testing does not prove that software has no defects. It creates reproducible evidence of risk before release and confirms that severe findings are addressed. The client can inspect the test plan, critical cases, defect states, and release results. The depth must still match scope, budget, and risk; a vague promise of “complete testing” creates unlimited and untestable responsibility.

When turning a business goal into an executable scope, also compare Should a small project hire a specialist team or a large software company?; the linked guidance adds context that should be considered in the same decision.

Four testing layers

Layer	Performed by	Main checks	Evidence
Developer and automated checks	Developers and CI	Units, types, static rules, critical components and APIs	Pipeline and test output
System testing	QA	Normal, exceptional, boundary, permission, compatibility, and data-consistency behaviour	Cases, defects, and regression record
Specialist testing	QA, operations, or qualified third party	Performance, security, payment, devices, accessibility, and recovery	Specialist report and retest
User acceptance	Client business users	Real workflows, rules, data, and practical usability	UAT findings and written confirmation

Functional testing workflow

Requirements or user stories receive testable acceptance conditions. After implementation, QA checks the main flow, input boundaries, network failure, duplicate submission, permissions, state transitions, messaging, and third-party failures. Multi-role products are tested for data each role may and may not see. Write APIs are tested for idempotency, timeouts, retries, and rollback. Each defect records environment, version, steps, expected and actual result, supporting image or log, and severity.

After repair, QA retests the original defect and affected functions. A release candidate receives core smoke and high-risk regression checks plus review of database migration, configuration, monitoring, backup, and rollback. An emergency production fix still creates a record and a regression case after service is restored.

Specialist tests depend on the system

Payments require tests for orders, duplicate callbacks, timeout, refund, reconciliation, and amount boundaries. IoT adds reconnect, out-of-order and duplicate messages, offline commands, firmware, and concurrent devices. Multi-platform products need an agreed browser, operating-system, screen, and cross-device state matrix. AI uses a fixed evaluation set for task correctness, citations, refusal, tool calls, cost, and security failures. High-volume systems test target concurrency and data under representative network conditions, reporting P95/P99 latency, errors, and recovery.

Security testing at minimum covers identity, sessions, access control, input, upload, APIs, logs, and sensitive data. Code audit, automated scanning, and independent penetration testing must be named explicitly. Public web and mobile products also need a device and accessibility target; “all devices” is not an actionable test scope.

UAT is not outsourced QA

Wavesteam completes internal testing first and supplies a stable build, accounts, instructions, scope, and known issues. Client users then exercise core work with real roles and sanitized or test data to confirm business rules. Findings enter one defect system and are classified as defect, interpretation difference, or new requirement. UAT confirms that the agreed scope is acceptable; it cannot guarantee every future environment.

Severity	Example	Release treatment
Blocker / critical	Core flow unavailable, data loss, unauthorized access, wrong payment amount	Repair and regress before release
Medium	Secondary flow fails but has a clear workaround	Assess and document the treatment plan
Minor	Copy, styling, or infrequent experience defect	May enter a later release but stays recorded

Testing and acceptance are formal stages in Wavesteam's software development service process. The contract should name supported platforms and devices, environment, performance goals, specialist scopes, UAT period, and post-release cover. Default testing does not make every expensive specialist service automatically included.

References

• OWASP ASVS provides Web identity, access-control, input, API, and data-security verification items.
• OpenAI's evaluation best practices supports task-based, stratified, continuing tests for AI features.
• WCAG 2.2 provides a basis for an agreed Web accessibility scope, not an automatic compliance claim for every project.

The contract, test plan, and acceptance record define coverage and responsibility.