Mobile App Testing Services in 2026: Devices, Store Rules and Cost
This guide explains what mobile app testing services cover, how to size a device matrix from United States traffic data, and what Apple and Google check before a rel…
Compliance Testing Services: HIPAA, PCI DSS, GDPR, WCAG
Vervali tests software that handles health, payment or personal data against the rules that govern it: HIPAA, PCI DSS, GDPR and the accessibility standards. Each engagement produces a control-by-control result, the gaps that would fail a review, the remediation path and the audit evidence, so a compliance deadline stops being a guess.
150+ clients
450+ projects
275+ engineers
15+ years
ISO/IEC 17025:2017Accredited testing laboratory
CMMI Maturity Level 3The process is written down and repeats
ISO 9001:2015Quality management
ISO/IEC 27001Information security
Which rules apply
This page is software-led: HIPAA, PCI DSS, GDPR and accessibility as a compliance obligation. Cloud configuration, IAM and restore evidence sit on cloud security and compliance. US teams get this work in US hours, 9am to 1pm Eastern, with delivery from India, from an ISO/IEC 17025 accredited lab. We test the controls. We do not issue a HIPAA, PCI or GDPR certificate. A free compliance gap check on one framework and one application is the first look.
HIPAA
Software that handles electronic protected health information. PHI handling, access control, audit logs, encryption in transit and at rest. Healthcare context sits on healthcare and life sciences.
PCI DSS
Software that touches payment data: the cardholder data environment in the application, storage versus tokenisation, and scripts on payment paths. Fintech context sits on fintech and banking.
GDPR
Software that processes personal data of people in the EU: lawful basis, consent, access and erasure paths, and whether the product actually does what the notice says. US and EU rules are both in the work when both apply.
Accessibility
WCAG as a compliance obligation, not a nice-to-have. Method, screen readers and ADA Title II dates live on ADA and Section 508 compliance testing. This page names the obligation. That page runs the pass.
Need a control-by-control pack for HIPAA, PCI DSS or GDPR? Get an Assessment, or start with a Free Gap Check.
Get an AssessmentHow a compliance test is run, control by control
Each engagement produces a control-by-control result, the gaps that would fail a review, the remediation path and the audit evidence, so a compliance deadline stops being a guess. One row per control: the control, the test, the result, the date, the artefacts. If a control cannot be evidenced, it is a gap, not a footnote. Neighbouring attack work sits on security testing and penetration testing. Test data for those artefacts sits on test data management and compliance.
HIPAA first: PHI handling, access, logs, encryption
HIPAA leads this page because that is the search that arrives. We test where electronic protected health information sits in the software, who can reach it, whether it is encrypted in transit and at rest, and whether a use can be reconstructed from logs. We do not certify a covered entity. OCR still enforces. Cloud accounts around that software sit on cloud security and compliance.
What we test in the product
Access control, session handling, audit logs, encryption, and the paths a user or an integration can take to PHI. Healthcare-compliance work that used to sit on a near-empty URL is this section. The diagnostics chain in Chennai is delivery proof for a health back end, not a named client.
What we do not do
We do not issue a HIPAA certificate. We do not treat a proposed Security Rule as a deadline. There is no new HIPAA Security Rule in force in 2026; that answer is in the FAQ. Get an assessment report if you need the control list named in a quote.
PCI DSS for software that touches payment data
The cardholder data environment you defined in the application, segmentation from everything else, what is stored versus tokenised, and scripts on payment paths that you did not write. Fintech-compliance work that used to sit on a near-empty URL is this section. UAE fintech API work is delivery proof, not a named client. We test those controls. We do not issue a PCI certificate. A PCI attack test of agreed in-scope assets is quoted on penetration testing.
Data protection and consent testing
GDPR on this page is the software: notices, consent, access, erasure, and whether the product does what it claims with personal data. US privacy rules sit in the same control list when they apply to the application. We produce evidence. A supervisory authority still decides. Vervali holds ISO/IEC 27001 as its own ISMS; that is not the client's certificate. A certification body issues ISO 27001 for you.
Accessibility as a compliance obligation
WCAG is in the same conversation as HIPAA, PCI DSS and GDPR when the product is public-facing software. This page does not duplicate the ADA Title II legal page. Keyboard, screen reader and VPAT method live on ADA and Section 508 compliance testing. If the question is a deadline, start there. If the question is a control-by-control pack across health, payment and personal data, stay here.
What the evidence pack contains
A dated pack, not a slide deck. One row per control: the control, the test performed, the result, the date, the artefacts, and the gaps with a remediation path. You can forward it. On a banking engagement, audit preparation went from 5 days to 5 hours once the pack existed. Retention of the pack is yours. We do not keep production data after the engagement unless the contract says so. Vervali tests a client's systems for SOC 2 readiness and is not itself SOC 2 certified. Only an auditor signs a SOC 2 report.
Remediation testing and re-audit
Gaps come with a path. After you fix, we retest the agreed in-scope controls and update the pack. A first pass that never comes back is a slide. Get an assessment report to name the framework and the application. A free compliance gap check on one framework and one application is the first look when you are not ready for a full pack.
Proof from delivery
Sector and country. Audit preparation, a diagnostics chain, and UAE fintech. They show Vervali has tested software at that scale. They are not a claim those were compliance-only jobs.
Banking · audit preparation
Before: audit preparation took five days of assembling screenshots. After: a dated evidence pack, and 80% less time spent assembling evidence, from 5 days to 5 hours. The bank stays unnamed.
5 days to 5 hours 80% less audit preparationIndia · Chennai diagnostics chain · back end
The back end of a diagnostics chain: PHI-class data and the load patient volume actually produces. A compliance pass that ignores that estate is a slide.
Diagnostics back endUAE · fintech platform · API
Authorisation between accounts on a payments platform, with APIs the team had not fully evidenced. After: a ranked report and a retest of agreed in-scope assets. The client stays unnamed.
UAE fintech API controlsFrequently Asked Questions
Vervali tests a client's systems for SOC 2 readiness and is not itself SOC 2 certified. On this page that means the software: access, logging, encryption, change control and the evidence an auditor would ask for. Only a licensed auditor issues a SOC 2 report. Cloud configuration evidence sits on cloud security and compliance. We do not sell SOC 2 as a ranking term. Get an assessment report if the question is the application.
We do not publish a project total. Clutch lists Vervali at $25 to $49 per hour. What you are buying here is testing and a dated evidence pack, not a certificate we issue. OCR and the covered entity still own HIPAA status. What moves the number is the application, how much PHI it handles, and how much evidence already exists. A free gap check on one framework and one application is the first look.
There is no new HIPAA Security Rule in force in 2026. HHS published a proposed rule on 6 January 2025 (90 FR 898). Comments closed 7 March 2025. OCR has not issued a final rule. The current Security Rule still applies. If a final rule is published, it would take effect 60 days later, with a general 180-day compliance period after that. We test against the rule that is in force. We do not treat a proposal as a deadline.
OCR enforces HIPAA. Covered entities and business associates still own the programme. On this page Vervali tests the software and produces a control-by-control result, the gaps, the path and the evidence. We do not certify you. Cloud accounts around that software sit on cloud security and compliance. Get an assessment report if you need the application named in a quote. A free gap check on one framework and one application is the first look.
This page tests software against HIPAA, PCI DSS and GDPR. Those are the three software rule-sets this URL is built around. Accessibility is the fourth obligation, run on the ADA page. We do not invent a textbook trio. Each control is tested for design, operating effectiveness and evidence. Cloud configuration sits on cloud security and compliance. Get an assessment report if you already know which of those three the application has to evidence.
It depends on the framework, the application and how much evidence already exists. We do not publish a fixed week count. A free gap check on one framework and one application is the first look. The quote after Get an assessment report names the weeks. Retest after remediation is a second pass. US teams get this in US hours, 9am to 1pm Eastern, with delivery from India. The pack is dated when it is done.
Yes for GDPR evidence on the software: notices, consent, access and erasure paths. Vervali holds ISO/IEC 27001 as its own ISMS; that is not the client's certificate. A certification body issues ISO 27001 for you. We map and test your evidence. We do not pretend our certificate is yours. Cloud ISMS evidence sits on cloud security and compliance. Get an assessment report if both frameworks apply to the same application.
Yes. Gaps come with a path, then a retest of the agreed in-scope controls and an updated pack. We do not issue the certificate. The evidence pack is dated so you can forward it. A first pass that never comes back is a slide. Get an assessment report to name the framework and the application. A free compliance gap check on one framework and one application is the first look when you are not ready for a full pack.
Email Us
Call Us
