Quality X-Ray
Has your software grown faster than your control over it? With MTAC, our quality assurance method, we tell you where you stand: what is broken, what is about to break and what to fix first.
Three deliverables and a review session
Executive report
Written for the people who decide, not the people who code: overall status, business risks, priorities and the consequences of not acting.
Technical report
Every finding, classified by severity, with reproducible evidence and its exact location in the system.
Remediation roadmap
What to fix, in what order and with what estimated effort. Written so any competent team can carry it out, including yours.
Review session
We walk through the report with your leadership and technical teams, answer questions and agree on priorities.
Turpial Quality Assurance Method
Four phases with defined deliverables in each.
Immersion and mapping
Understand the business before the code: what the system does, what happens if it goes down, who maintains it and what risks the team already knows.
Deliverable: inventory of systems, dependencies and declared risks.
Technical analysis
Code, architecture, data model, test coverage, security and deployment process.
Deliverable: technical findings with reproducible evidence.
Process analysis
How work comes in, how it's tested, how it's released and how defects are managed. This is where the causes of what the technical analysis found as symptoms appear.
Deliverable: process diagnosis and bottlenecks.
Synthesis and delivery
Severity classification, prioritization by business impact and an executable roadmap.
Deliverable: executive report, technical report, roadmap and review session.
The quality characteristics of ISO/IEC 25010
MTAC organizes findings according to the ISO/IEC 25010:2023 software product quality model. Every finding is tied to a concrete, verifiable characteristic, not to an opinion.
- Functional suitability
- Performance efficiency
- Compatibility
- Interaction capability
- Reliability
- Security
- Maintainability
- Flexibility
- Safety
How we classify what we find
Severity is assigned by business impact, not technical elegance.
| Severity | What it means | When to address it |
|---|---|---|
| Critical | Can stop operations, expose data or cause direct financial loss. | Immediately |
| High | Degrades the service, makes maintenance more expensive or blocks growth. | Short term, with a plan |
| Medium | Technical debt that doesn't hurt today but makes every future change more expensive. | Next planning cycle |
MTAC is more than an audit
As an audit
The Quality X-Ray: MTAC applied once to an existing system, yours or a vendor's.
In every sprint
In the projects we build, MTAC is one of the gates in our definition of done. No increment is considered done with critical findings open.
See the Turpial Method →Findings are not softened out of commercial courtesy.
If your software is better than you think, we'll tell you. If it's worse, we'll tell you that too. An assessment is only useful if it's honest.
Before you hire an audit
Do you need access to our code?
Yes, read-only, and under a non-disclosure agreement signed before any access. If your policy doesn't allow external access, we'll work out an alternative with you.
How is this different from a penetration test?
A penetration test looks for exploitable security vulnerabilities. The X-Ray assesses the overall health of the software: architecture, code quality, test coverage, deployment process and defect management. Security is one dimension, not the only one.
How much of our team's time do you need?
Very little: an initial context session, a few short technical interviews and the final report review session.
Does it work for software built with AI?
Yes. Code generated with assistants deserves the same review as any other, with special attention to architecture, error handling and security.
Can you carry out the remediation?
We can, but it's not required. The report is written so any competent team can carry it out, including yours.
How is it different from the free Technology Diagnostic?
The Diagnostic is a self-assessment of the whole company based on your answers. The X-Ray is an audit we perform on a specific system, with access to the code and evidence.
What does not knowing cost you?
A conversation with our quality team gives you a preliminary read on the state of your software. No cost, no commitment.