Skip to content
EVO-CODE®
Software testing QA automation Websites and shops Security and compliance AI solutions How we work Contact Wersja polska
Polish team · global projects

We find it before your customers do.

Software quality from the first test case, through automation, to security audits and regulatory compliance. Banking, telecoms, medical software, e-commerce.

Let's talk about your project Security and compliance
Software testing

Your system has a weak spot. We will find it first.

A tester who only checks what was supposed to work will find nothing. We go where nobody looked: boundary values, the double click, the browser back button pressed halfway through a payment.

  • Exploratory testing done by people, not by a checklist copied out of the documentation
  • Edge and negative cases: empty fields, characters outside the alphabet, a dropped connection mid-transaction
  • Regression before every release, so that one fix does not quietly break three other things
  • Testing on real devices, not just a browser window shrunk to phone size
  • Acceptance testing with your team, so handover is not their first meeting with the product
A report, not a complaintReproduction steps, environment, version, screen recording and severity. A developer should reproduce the problem in a minute, not run an investigation.
QA automation

Friday, 16:40. „It is only a small fix”.

Everyone knows this one. Somebody pushes a single line before the weekend, and on Monday the basket recalculates prices with a certain creative flair. Automation exists so that Monday never arrives.

  • Playwright for the paths people actually walk: sign-up, payment, refund
  • API tests where the logic really lives, because the interface is only a view over data
  • Performance tests, so you know at which thousandth user the trouble starts
  • Wired into the release process, so the suite runs on its own without asking anyone
  • A trace from every run: recording, screenshot and state, instead of the sentence „something broke”
The end of „works on my machine”That sentence ends the moment the same scenario passes on a clean environment. Or fails there, in which case at least everyone knows what the conversation is about.
Websites and shops

Performance measured, not promised.

WordPress, WooCommerce and custom builds. Contrast calculated on every background the colour actually sits on. Mobile layout checked by a tool. Media weight held to a threshold nobody is allowed to cross.

  • Core Web Vitals treated as a requirement, not as a report written after the fact
  • Accessibility from the first mockup, because bolting it on at the end costs twice as much
  • The client changes everything themselves from the admin panel, with no invoice for a corrected typo
26 timesThat is how much lighter we made the opening video on our latest build. No loss of image quality, and a visible difference on a mobile connection.
Security and compliance

Better that the gap is found by your own side.

Penetration testing, OWASP-based reviews and a security test coverage matrix mapped onto trust boundaries. Plus compliance with the regulations that have arrived in European IT one after another.

  • DORA in the financial sector: operational resilience, ICT third-party register, resilience testing
  • MiCA wherever crypto-assets and service provider obligations are involved
  • NIS2 and its national implementations across the EU
  • GDPR: data map, lawful basis, retention, handling of data subject requests
  • Accessibility: the European Accessibility Act covers e-commerce from June 2025
  • AI Act: risk classification of the system and the obligations that follow from it
DORA MiCA NIS2 GDPR EAA AI Act PCI DSS ISO 27001 WCAG 2.2 Banking Telecoms Medical E-commerce Dropshipping
Priorities, not a printoutThe report says what to fix first and why. It does not dump a thousand scanner warnings into a PDF and call it a day.
AI solutions

A model that does not invent on your data.

Deploying a language model without measurement is not a project, it is a hope. Before anything reaches people we build an evaluation set on your real cases, and that set decides whether the solution works.

  • Answers grounded in your documents, each with a link to the source, so every figure can be checked
  • Evaluations instead of impressions: measurable accuracy, hallucination detection, tests repeated after every prompt change
  • Model security following the OWASP Top 10 for large language models: prompt injection, input data leakage, excessive tool permissions
  • Cost control: budgets, response caching and matching the model to the task, because not every question needs the most expensive one
  • Data under control: what stays on your infrastructure, what leaves it, and on what legal basis
  • A human in the loop wherever a decision has consequences, with a record of who approved it and when
Measure first, deploy secondIf the evaluations show the model gives you no advantage, we will say so plainly. We would rather lose one project than build something that gets switched off six months later.
How we work

We measure. We do not eyeball it.

The human eye is a terrible measuring instrument. It will happily decide that grey text on a grey background „looks fine”, and then somebody reads it outdoors in sunlight and sees nothing at all.

A script does the maths

We calculate the contrast of every colour against every background that colour actually sits on. Not the main background, all of them, because a colour can pass on one and fail on the next.

Yes, this caught us out too. Twice.

A tool asks about phones

Narrow-screen layout is checked by tooling, not by a shrunken browser window. It measures overflow, tap target size and font size.

A finger is not a mouse pointer and never will be.

Media have a weight limit

A video over the agreed limit does not ship. There is no discussion about „it is only a few megabytes”, because those megabytes are paid for by someone on mobile data, in the field, with one bar of signal.

The check has a veto

When anything fails, work stops. A rule written in prose gets forgotten; a rule enforced by a machine does not.

A machine also never has a bad day or a deadline tomorrow.

It works without scripts too

Disabled or blocked JavaScript does not take the content away. The animations go; everything anyone actually came for stays: text, images, prices and the phone number.

Scripts blocked on a corporate network are not exotic. That is just Monday.

A backup before every change

Before we replace anything on a live site, the original lands next to it with a date on it. Rolling back to how it looked an hour ago is one command, not an evening with a backup.

Courage is cheap when you can go back.

Who we work with

Teams who would rather hear about the bug from us than from a customer.

From one-person workshops to organisations with an IT department on the other side of Europe. Usually when a regulatory deadline or an audit is hanging over someone.

Contact

Tell us what needs to work.

A short description is enough: what you have, what needs to work and by when. We reply with a proposed scope, schedule and cost range.

kontakt@evo-code.pl

Looking for the company rather than the workshop? EVO-CODE as a business, with references and ways to work together, lives at evo-code.pl. This site is the studio and the work on code.