A quote says what it costs to start. The questions below say what it will cost to continue, and how hard it will be to change supplier.
The ten questions
- Who owns the code and where does it live? It must be in your repository, owned by your organisation, from day one.
- Which automated tests exist? Without tests every change is a risk. Ask what is tested and how to run it.
- How do you release? A repeatable release (pipeline, identical environments, planned rollback) beats a promise of speed.
- How do you handle dependencies and secrets? Library updates, vulnerability scanning, no passwords in code. Useful references: OWASP ASVS and the NIST Secure Software Development Framework (SP 800-218).
- Which personal data will you process and where? You need a written processing agreement and a clear position on hosting and subprocessors.
- Who answers if something breaks? Times, channels and responsibilities, in writing.
- What documentation do you deliver? Architecture, key decisions, how to run and release.
- How does the work move to my team? The work is finished when your team can maintain it alone.
- What if we change supplier? Exit terms, access, data export, no technical lock-in.
- Can I talk to whoever will write the code? People, not only sales.
Warning signs
- Code or hosting accounts in the supplier’s name.
- No explanation of tests and release.
- Generic answers on security and personal data.
- Dependence on a single person with no documentation.
What is not verified
This note is a checklist, not legal advice, and carries no market data. For contracts and data protection consult a professional. References to OWASP ASVS and NIST SP 800-218 point to the official documents, to be read in their current version.
For an independent review of an offer or an architecture, see Assessment and second opinion; to build with a clear method, Software engineering.