B2B multi-tenant SaaS
Products many companies share, each in its own workspace.
Top 3 risks we test first
- One tenant seeing another tenant’s data
- Workspace roles and admin permissions
- SSO and user provisioning
[ Cloud & SaaS product types ]
Eleven kinds of cloud product, eleven different risks
A marketplace loses money on a wrong payout. A migration loses records. A shared platform shows one customer another’s data. We start with the risks that belong to your kind of product, and test those first.
B2C subscription apps
Consumer products paid for monthly or yearly.
Top 3 risks we test first
- Sign-up, free trials and renewals
- Failed payments and cancellations
- Speed at peak sign-up times
Vertical SaaS (health, fintech, HR)
Products built for one regulated industry.
Top 3 risks we test first
- Industry rules and calculations
- Audit trails and who can see records
- Compliance evidence for buyers
Marketplace / platform SaaS
Products that connect buyers, sellers or partners.
Top 3 risks we test first
- Payouts, fees and split payments
- Each party seeing only their own data
- Partner onboarding and listings
Cloud-native / microservices
Products built from many small services on containers.
Top 3 risks we test first
- One failing service taking others down
- Config and secrets in each environment
- Scaling under real load
Serverless apps
Products running on cloud functions and managed services.
Top 3 risks we test first
- Cold starts and timeouts
- Event triggers, retries and duplicates
- Permissions on each function
Cloud migrations (on-prem → cloud)
Existing systems moving to AWS, Azure or Google Cloud.
Top 3 risks we test first
- Every record arriving complete and correct
- Features working the same after the move
- A rollback that works if cut-over fails
Data / analytics platforms
Products that collect data and turn it into reports.
Top 3 risks we test first
- Numbers matching the source data
- Pipelines finishing on time at volume
- Dashboards and exports per role
AI-powered SaaS
SaaS products with AI features built in.
Top 3 risks we test first
- AI answers that are accurate and safe
- One customer’s data kept out of another’s answers
- Usage limits and cost per plan
PaaS / developer platforms
Platforms other developers build on.
Top 3 risks we test first
- Breaking changes in the public API and SDKs
- API keys, quotas and rate limits
- Console and docs matching real behaviour
White-label SaaS
One product resold under many brands.
Top 3 risks we test first
- Each brand’s logo, domain and emails
- Settings per reseller and per customer
- Upgrades reaching every brand safely
Looking at SaaS as a business, from churn to enterprise deals? See SaaS industry testing →
[ What we test ]
Twenty testing types, sorted by the layer they protect
A cloud product is more than its screens. We group our testing into five layers, from what customers click to the cloud underneath, so you can see exactly which part of your product each test covers.
Layer 01
Product
What customers use
Functional testing
Every feature, workflow and business rule checked against your requirements, for each plan and role.
More on this service →Cross-browser & responsive testing
The app checked in the browsers and screen sizes your customers use, on real devices.
More on this platform →Usability testing
Sign-up, setup and first use tried the way a new customer would, to find where people stall.
More on this service →Accessibility testing (WCAG 2.2)
Keyboard use, screen readers, colour contrast and forms checked against WCAG 2.2 AA.
More on this service →Localization testing
Languages, time zones, currencies and date formats checked for each region you sell in.
Layer 02
Tenancy
Who sees and pays for what
Multi-tenancy & data isolation testing
Each customer’s data, files and settings kept apart in the screens, the API and exports.
Role & permission (RBAC) testing
Every role checked for what it can and can’t see or do, inside each workspace.
Subscription & billing testing
Trials, upgrades, downgrades, proration, renewals, refunds and failed payments, in your billing sandbox.
Layer 03
Connections
What it plugs into
Integration testing (SSO, webhooks, third-party)
SSO, user provisioning, webhooks and partner apps checked, including retries and failures.
API testing
Public and internal APIs checked for correct data, authentication, rate limits and backward compatibility.
More on this platform →Layer 04
Cloud
What it runs on
Performance & load testing
Response times under normal and peak traffic, including one heavy tenant slowing down the rest.
More on this service →Scalability & auto-scaling testing
Scaling rules checked: new capacity starts in time and scales back down after a spike.
Infrastructure & configuration testing
Environment settings, secrets, storage access and network rules checked in every environment.
Monitoring & observability checks
Logs, metrics and alerts checked so they fire when something really breaks.
Disaster recovery, backup & restore testing
Backups restored for real, failover tried and recovery time measured against your target.
Layer 05
Change & trust
What keeps it safe as it moves
Security testing / VAPT
Vulnerability scans plus manual penetration testing of the app, APIs and cloud setup, retested after fixes.
More on this service →Compliance checks
Access control, audit trails, encryption and data handling tested against the controls your auditors check.
Cloud migration testing
Data, features and integrations compared before and after a move to the cloud, with rollback tested.
Upgrade & zero-downtime release testing
Blue-green and canary releases, database migrations and rollbacks tested so customers don’t notice.
[ Clouds & environments ]
Your cloud provider runs the servers. Everything on top is yours to test.
Cloud providers keep their data centres and managed services running. The code, settings, access rules, backups and scaling choices on top are yours, and that’s what breaks. That’s the part we test.
Your cloud provider
Runs the platform
- Data centres, hardware and networks
- Uptime of the managed services you use
- Patching of the services they manage
Your team
Owns what’s built on it
- Your code, tenants and customer data
- Settings, secrets and who has access
- Scaling rules, backups and alerts
QAonTOP
Tests everything you own
- The product, its tenants and its billing
- Configuration, access and security
- Load, scaling, backups and recovery
- Environment 1
Preview & dev
Fast checks on each pull request: automated regression, API checks and tenant isolation tests.
- Environment 2
Staging
A production-like copy where full testing, billing, load and security runs happen before release.
- Environment 3
Production
Smoke tests after every release, and alerts checked so problems surface before customers report them.
Where we test
Public clouds
AWS
Microsoft AzureGoogle Cloud
Developer clouds
DigitalOceanHerokuVercelNetlify
Containers
DockerKubernetes
Your own setup
Private / on-prem cloudHybrid & multi-cloud
We test in your accounts and environments, so results reflect how your product really runs.
[ Process & deliverables ]
Five steps, and what you get at each one
You always know what we’re doing and what you’ll get. Every deliverable belongs to you.
-
Step 1 of 5
Discover
We review your architecture, tenancy model, plans, integrations, release process and recent incidents.
You getTest strategy & risk map -
Step 2 of 5
Plan
We set up test tenants for each plan and role, agree environments and release gates, and write test cases.
You getTenant & plan matrixTest cases -
Step 3 of 5
Test
Manual and automated testing across tenants, roles, billing and integrations on every build.
You getBug reports in Jira or your trackerDaily or weekly status reports -
Step 4 of 5
Cloud & specialist checks
Load, scaling, security, backup restore and compliance testing where your scope includes them.
You getPerformance & scalability reportSecurity / VAPT reportDisaster recovery test report -
Step 5 of 5
Automate & release
Regression wired into your pipeline, release gates in place, fixes retested and each release signed off.
You getAutomation scripts in your CIRelease sign-off
- Free one-week POCSee how we test your product before you commit.
- Your tools, your pipelineWe work in your Jira, TestRail, Slack and CI/CD.
- NDA before accessWe sign your NDA first and use test tenants and synthetic data by default.
[ Tools ]
The tools behind our cloud and SaaS testing
We pick tools to fit your stack and cloud, and we’re happy to work with the ones you already use.
UI & end-to-end
03 TOOLS- Playwright
- Selenium
- Cypress
API & contract
04 TOOLS- Postman
- Newman
- REST Assured
- Pact
Performance & scale
03 TOOLS- JMeter
- k6
- Gatling
Security & cloud setup
04 TOOLS- OWASP ZAP
- Burp Suite
- Prowler
- Trivy
Infrastructure & environments
04 TOOLS- Docker
- Kubernetes
- Terraform
- LocalStack
Monitoring
04 TOOLS- Amazon CloudWatch
- Azure Monitor
- Google Cloud Monitoring
- Grafana
Billing & sign-in sandboxes
05 TOOLS- Stripe test mode
- Chargebee sandbox
- Okta
- Azure AD
- Google SSO
Browsers & accessibility
02 TOOLS- BrowserStack
- axe DevTools
CI/CD & test management
05 TOOLS- Jenkins
- GitHub Actions
- GitLab CI
- Jira
- TestRail
See the full list on our technology stack page →
[ Case Studies ]
SaaS products we’ve tested
A few of the cloud and SaaS products we’ve tested, written up by the engineers who ran them.
Workflo
600+defects found and verified before releaseRead the case study
Drop Delivery
~75%less manual regression time per releaseRead the case study
Kintavo
450+vulnerabilities found and verified fixedRead the case study
“Tremendous job! The team exceeded my expectations and addressed all my concerns. My experience with QAonTOP was very pleasant, and I highly recommend their QA services.”
[ Ways to work ]
Six ways to get your cloud or SaaS product tested
Choose the engagement model that matches how you build and release. You can switch models as your product grows.
01Fixed-price projectChoose it for a cloud migration, launch or one-off audit with a clear scope and end date.
02Dedicated QA teamChoose it when you deploy often and need the same testers who know your tenants and plans.
03On-demand testingChoose it when releases come now and then, and you want a cycle only when a build is ready.
04Managed testingChoose it when you want SaaS QA run end to end for you, measured against quality targets.
05Staff augmentationChoose it when your QA lead needs extra automation, performance or security testers in the team.
06QA consultingChoose it when you want an outside review of how your product and cloud setup are tested today.
Not sure which fits? Find your model in four questions or compare all six.
[ FAQ ]
Cloud and SaaS testing questions, answered
{{ f.a }}
[ Contact us ]
Get a test plan for your cloud or SaaS product
✓ Free one-week POC✓ NDA before access✓ A QA lead replies the same day
[ Keep exploring ]
Other platforms we test
All platforms →
01
Web applications
Every browser, device and layer
02Mobile apps
iOS and Android, on real devices
03APIs & microservices
Contracts, data and error handling
04Desktop software
Installers, updates and OS behaviour
05Data & databases
Pipelines, migrations and reports
06AI & LLM products
Accuracy, guardrails and agents
Also useful: SaaS industry testing · All testing services · Fixed-price packages · Estimate your QA cost