A/B Testing & Experimentation
37 martech vendors in A/B Testing & Experimentation, part of Web & Digital Experience. Each record carries the date we last verified it, so you can see how current it is before you rely on it.
Last verified:
Procurement-readiness profiles — SOC 2, ISO 27001, GDPR and DPA posture, data residency, AI-training policies — are available when you sign in.
A/B testing and experimentation software splits live site or app traffic between variants and measures which one wins on a set goal, in place of a redesign based on opinion alone. Growth and product teams run tests through it daily. IT security still needs it audited, since it injects code into every visitor's browser to run each test.
Who it is for
- Growth, product, and web teams shortlisting a platform to test page or flow changes against a measurable goal before a full rollout.
- IT security reviewers assessing what third-party script this platform injects into every visitor session to run a test.
- Data governance teams checking what visitor-level data is collected to assign and track a test variant.
What your No-Committee will ask
- IT security
- Is the injected testing script served over a vetted content-delivery path, and is publishing access to test configurations restricted by role? Script-delivery and publishing-permission claims are each recorded as an evidenced claim, marked verified, self-attested, or not found.
- Data governance
- What visitor-level data gets collected just to assign and track a test variant? We check for a Data Processing Agreement and confirm data location straight from the vendor's own legal pages, not a blog post.
- AI governance
- If the platform uses AI to suggest a variant or shift traffic toward a leading result on its own, is that labeled, and can a reviewer see why it made that call? We log the label and that explainability question as one claim.
- Legal / compliance
- Does the platform respect a visitor's cookie-consent state before assigning a test variant that relies on tracking? Consent-gating support is recorded as an evidenced claim, separate from a general privacy-policy mention.
- Risk / finance
- Has the vendor published an uptime SLA, plus a status page covering past incidents where a test script failed to load or flickered on a live page? We record both if public, and say so plainly when neither exists.
How we verify
Every claim above comes from the vendor's own pages — trust center, privacy policy, or security page — never guessed from a case study about one good test result. Our methodology page sets out exactly what verified, self-attested, and not-found each require.
Frequently asked questions
How is A/B testing different from a personalization engine?
A/B testing compares a small number of fixed variants against each other to find a statistically better version, then applies that winner to everyone. A personalization engine instead tailors content per visitor or segment on an ongoing basis, without necessarily running a controlled experiment first. Many teams use experimentation to validate what a personalization engine later automates.
Do experimentation platform vendors typically publish SOC 2 or ISO 27001 certification?
Enterprise experimentation platforms running tests across high-traffic, revenue-critical pages more often publish a SOC 2 report behind a dedicated trust center. Smaller or free-tier testing tools more often rely on a general security page without independent certification, which our audits mark as self-attested.
Is pricing usually based on monthly tracked users or on the number of active tests?
Most vendors price against the number of monthly tracked users or unique visitors included in tests, with tiers scaling upward from there. Enterprise plans with server-side testing or unlimited concurrent experiments are more often quote-only, which we note rather than estimate from a published starting price.
What should I check beyond the visual variant editor before shortlisting a platform?
Confirm whether the injected script is known to cause visible page flicker before a variant renders, how publishing permissions for live tests are controlled, and whether the platform holds test assignment until consent is recorded. Those checks matter more than editor polish once a test is running on real revenue-driving pages.