Cheesecake LabsNearshore software provider in Florianópolis, Brazil

Whether the company is who it says it is, where it says it is. A register record, delivery locations with addresses, and named people carrying public professional profiles. Nothing here is about quality — it is about whether there is something to hold to account.

• A1

  Entity registration

  Pending verification

  A record in a national companies or tax register, with the formation date and the legal name matching the name the company trades under. Where a country publishes no register we may query, this leaves the scale entirely — no company chose its registrar.

  Not measured yet. These points are out of the denominator — the gap counts against us, never against the company.

• A2

  Delivery footprint

  7/9

  Where the work is actually done. An address is the claim; a second country is reach. A published headcount per site adds to it, because "we have an office there" and "forty people work there" are different statements.

  What we found2 locations across 2 countries; 2 with a street address.

• A3

  Team verifiability

  8/8

  Named executives, and how many of them carry a public professional profile a reader can open. A company that will not name the people running it is asking for trust it has offered nothing for.

  What we found6 named executives; 1 with a public professional profile; headcount 100–+.

What the company puts on the record about work it has delivered, and what it has in the open as an engineering organisation. Deliberately "published" rather than "verified": a buyer can read the same pages we did.

• B1

  Case studies published

  5/7

  How many case studies the company publishes, in bands rather than exactly. Scored from its own index rather than from a homepage carousel, which would undercount a real portfolio.

  What we foundAt least 5 case studies published.

• B2

  Case study specificity

  3/7

  Whether those case studies say anything checkable: the client named, the outcome quantified, the stack and the team composition stated. Magnitude is deliberately not scored — the largest figure on a portfolio page is almost always a company-wide total, and rewarding it would reward the vaguest writing.

  What we found5 case studies name the client.

• B3

  Engineering footprint

  3/6

  Public code and technical writing: a GitHub organisation, repositories, contributions in the last twelve months, a blog with real depth. A services company with nothing in the open is not disqualified — it has simply not offered this particular evidence.

  What we foundGitHub org @cheesecakelabs; 99 public repositories.

What clients said somewhere the company does not control. Read from independent review platforms rather than from testimonials on its own site, because a testimonial is a quote the company chose to keep.

• C1

  Review volume

  No queryable source

  How many reviews exist across independent platforms, in bands. A precise count would reward a company for the exact number of clients it remembered to ask, which is not the thing being measured.

  What we foundThe review platforms serving this market answer an automated request with a bot challenge, including on robots.txt. We honour that, so no company here is scored on third-party reviews — and none is marked down for the access policy of a platform it does not control.

  The review platforms serving this market answer an automated request with a bot challenge, including on robots.txt. We honour that, so no company here is scored on third-party reviews — and none is marked down for the access policy of a platform it does not control.

• C2

  Rating quality

  No queryable source

  The rating, weighted by how many reviews stand behind it, so a 5.0 from two does not outrank a 4.7 from ninety.

  What we foundThe review platforms serving this market answer an automated request with a bot challenge, including on robots.txt. We honour that, so no company here is scored on third-party reviews — and none is marked down for the access policy of a platform it does not control.

  The review platforms serving this market answer an automated request with a bot challenge, including on robots.txt. We honour that, so no company here is scored on third-party reviews — and none is marked down for the access policy of a platform it does not control.

• C3

  Review recency

  No queryable source

  How old the newest review is. An excellent rating from 2019 describes a company that may no longer exist in the same form.

  What we foundThe review platforms serving this market answer an automated request with a bot challenge, including on robots.txt. We honour that, so no company here is scored on third-party reviews — and none is marked down for the access policy of a platform it does not control.

  The review platforms serving this market answer an automated request with a bot challenge, including on robots.txt. We honour that, so no company here is scored on third-party reviews — and none is marked down for the access policy of a platform it does not control.

• C4

  Platform breadth

  No queryable source

  Whether reviews appear on more than one platform. One platform is a channel the company chose and can curate; two are harder to shape.

  What we foundThe review platforms serving this market answer an automated request with a bot challenge, including on robots.txt. We honour that, so no company here is scored on third-party reviews — and none is marked down for the access policy of a platform it does not control.

  The review platforms serving this market answer an automated request with a bot challenge, including on robots.txt. We honour that, so no company here is scored on third-party reviews — and none is marked down for the access policy of a platform it does not control.

Authority and page experience, scored against the company’s own cohort rather than an absolute. A twelve-person studio and a two-thousand-person firm do not compete for the same links, and one scale for both would be measuring size.

• D1

  Site trust & experience

  1/6

  The pages a procurement team looks for — privacy, terms, security, a data processing agreement — plus whether the site passes Core Web Vitals. Both are things a buyer meets before a salesperson.

  What we foundPublishes a privacy policy. No terms of service or a security page found.

• D2

  Search authority

  5.74/7

  Domain rating, referring domains and organic traffic, expressed as a percentile of the company’s cohort. Where the cohort is too thin to establish a distribution this scores pending rather than inventing a benchmark.

  What we foundDR 53, 3628 referring domains — dr 89th pct, refdomains 89th pct, org_traffic 63th pct of the 19-company cohort.

• D3

  Content & structured data

  3/4

  Whether the site carries structured data a machine can read, and how much ground its content actually covers.

  What we foundOrganization schema detected; 198 organic keywords

• D4

  AI citations

  Pending verification

  Whether assistants cite the company when asked about this market. New, and weighted at three points accordingly — a company with none of it is not being marked down for missing something the market has not settled on.

  Not measured yet. These points are out of the denominator — the gap counts against us, never against the company.

What a buyer can find out before anyone answers the phone: the price, the shared hours, who owns the code, what the security posture is. The pillar most providers score worst on, and the one buyers ask about first.

• E1

  Commercial terms

  1/5

  A published price, the engagement models on offer, and a stated minimum. The single most useful thing a provider can put on its site, and the thing almost none of them do — which is exactly why it is worth points.

  What we foundEngagement models: end-to-end product development, cloud and modernization, data and AI.

• E2

  Overlap & languages

  0/4

  Stated overlap hours with United States business hours, and the working languages. The whole premise of nearshore is the shared working day, so a provider that does not state its hours has left its main argument unmade.

  What we found7h overlap with US Eastern.

• E3

  Security & compliance

  0/4

  Security certifications and a published data processing agreement. Scored only where a certification carries a citable statement — a logo in a footer is not evidence of a SOC 2 report, and treating it as one would reward the cheapest signal.

  What we foundNo certification carries a citable statement.

• E4

  Contracting & IP

  0/2

  Whether the company states in writing who owns the code. Two points, because it is a single sentence on a page — and because its absence is common enough that it does not distinguish much.

  What we foundNo IP assignment statement found.