Choose a testing vendor with your own documents, not theirs.

Request for proposal: software testing services for Example Product Ltd

ChooseQAVendor framework v1.0. Situation: First vendor for a startup. Nothing you enter in the toolkit is sent anywhere.

1. Background

Example Product Ltd is inviting proposals for software testing services. Product: B2B web application for scheduling field service work, with a companion mobile app.

Technology: TypeScript front end, Node.js services, PostgreSQL, React Native mobile app, CI on every pull request.

Current state of testing: Developers write unit tests. No dedicated testers. Releases every two weeks with manual checks by the product manager. No end-to-end automation.

2. Scope

The service covers the following surfaces:

• Web application
• iOS app
• Android app
• Public API

Goals: Regression testing of each release within two working days; an end-to-end automated suite for the ten most important user journeys, in our repository and running in our pipeline; exploratory testing of new features.

Compliance context: GDPR or UK GDPR.

Engagement model: Dedicated team (monthly fee per person). Vendors may propose an alternative model in addition, priced separately.

3. Deliverables

• A test strategy for the product covering scope, risks, approach, environments, entry and exit criteria, following the content described in ISO/IEC/IEEE 29119-3.
• Test plans and test cases maintained in our tools.
• Automated tests, where in scope, committed to our repository and running in our pipeline from the first week.
• A weekly status report stating what was tested, what was not, open risks and a release recommendation.
• A completion report at each release and at the end of the engagement.
• Documentation sufficient for our team or a successor to continue the work without the vendor.

1 / 3

4. Evaluation criteria and weights

Proposals will be scored against these criteria. Weights are shown so you can focus your response. Price is evaluated as total cost over 12 and 24 months, including onboarding and exit.

A proposal that does not name the delivery team, or that requires test code to remain in the vendor's systems, will score zero on the related criteria.

5. Required responses

Answer each question in the response template in Appendix A. Answer with specifics: names, documents, examples. Attach evidence where asked.

1. Who, by name and role, will work on our account in the first three months? Please share their CVs and confirm these are the people who will start, not examples.
2. Who is the single accountable lead on your side, how much of their time is allocated to us, and what decisions can they make without escalating?
3. How will your testers work inside our team day to day: which of our meetings do they attend, whose backlog do they work from, and who on our side assigns their work?
4. Please share an anonymised test strategy or test plan you have written for another client. What sections does it contain?
5. How do you fit testing into an agile, iterative delivery cycle? At what point in a sprint or release does your team start testing a change?
6. In your first 30 days on our account, what will you produce and how will we know onboarding has worked?
7. Which tools will you use for test management, defect tracking and reporting, and will they be our accounts or yours?
8. Which devices, browsers and operating systems will you test on, and are they real devices, emulators or a cloud device service? Who pays for that service?
9. How is test progress shown to us during a cycle? Can we see a live dashboard in our own tools, and which measures does it show?
10. If you process personal data for us, will you sign a data processing agreement that covers every point in GDPR Article 28(3), including acting only on our documented instructions, confidentiality, security, assistance, deletion or return, and audits?
11. How do you control access to our environments: named accounts, multi-factor authentication, least privilege, managed devices, and removal when someone leaves the team? How quickly is access removed?
12. How exactly do you define and count your defect metrics, such as severity, priority, defect leakage, reopen rate and fix verification time? Where are those definitions written down?
13. Who is our day-to-day contact, who is their escalation point, and how fast do they respond to a blocking issue during our working hours?
14. How will you tell us about risks you see in our product or process, such as untestable requirements or unstable environments, and how quickly?
15. Is your price based on time and materials, fixed price or outcomes, and exactly which activities are inside the price and which are billed separately?
16. If we pay for time, how are hours recorded, approved and evidenced on invoices, and can we see timesheets by person and activity?
17. Can you lock your rates for the initial term, and what is the mechanism and cap for any increase after that?
18. What notice period applies to termination for convenience and for cause, and will service levels continue to apply during the notice period?

6. Timeline

7. Submission format

• Appendix A completed in the order given, one answer per question.
• CVs of every proposed team member, with the allocation of each person.
• A sample test strategy and a sample status report from a comparable engagement, anonymised.
• Commercial response: rates by role, what is included and excluded, onboarding and exit costs, rate review terms.
• Security evidence: certificates with scope, or a current SOC 2 Type II report under NDA.
• Three references from comparable engagements, at least one of them a former client.
• Budget: Stated in the commercial response; we will compare total cost over 12 months.

8. Contract terms vendors must accept or mark up

State for each term whether you accept it, or propose alternative wording.

• Ownership of test code and test assets
• Repository and tool accounts held by the buyer
• Exit plan and exit assistance period
• Staff replacement terms
• Service levels with measurable targets
• Data processing agreement
• Security obligations and incident notification
• Confidentiality
• Rate lock and price review
• Change control
• Termination for convenience and for cause

2 / 3