A software vendor due diligence checklist is a list of checks you run before hiring a software company or buying a platform. Most bad software projects are not caused by bad code; they come from a weak vendor choice, unclear contracts, or missing safeguards. Use these 25 questions to compare vendors fairly. Pair it with our guide on how to compare software vendors.
A. Company and experience
- How long has the company operated, and who are the actual owners and team leads?
- Can they show similar projects, with live links or demos?
- Can you speak with two or three past clients?
- Will the people you meet be the people who build your project?
- What happens if a key developer leaves mid-project?
B. Scope, price and contract
- Is the scope written down, with phases and deliverables?
- Is the price fixed, phased or hourly, and what is excluded?
- How are changes requested, priced and approved?
- What is the payment schedule, and is it tied to milestones?
- Who owns the source code, designs and database when the project ends?
C. Process and communication
- Is there a discovery phase before the quote is final?
- Will you get regular demos of working software?
- Who is your single point of contact, and what is the response time?
- How are bugs tracked and fixed?
- Do they provide a staging environment where you can test before launch?
D. Security and compliance
- How is data stored, backed up and restored, and how often are backups tested?
- How are passwords, access roles and admin rights handled?
- Is the site or app served over HTTPS, and are dependencies kept updated?
- How do they handle customer data and privacy requirements?
E. Support and exit
- What support is included after launch, and for how long?
- What does a maintenance plan cost, and what does it cover?
- Will you receive documentation, including setup and API notes?
- Can another team take over the project if needed?
- Can you export all your data at any time?
Red flags
- A price given after one call with no questions asked
- No written scope or contract
- Vague or evasive answers about code ownership
- Pressure to pay a large amount upfront
- No access to a staging version until the end
- A quote far below all the others
How to score vendors
Give each question a score from 0 to 2 for every vendor and total the sections. Weigh section B (contract) and E (exit) heavily, since they are the hardest to fix later. Compare the final scores alongside price, not instead of it.
FAQ
What should I check before hiring a software development company?
Check their track record, written scope and price, code ownership, security practices and post-launch support. Speaking to past clients is the most reliable test.
Who should own the source code?
You should, once payment is complete. Put this in the contract in plain words.
How long should due diligence take?
Usually one to two weeks for a mid-size project: a few calls, reference checks and a review of the proposal.
Is the cheapest vendor a bad choice?
Not automatically, but a quote far below the rest usually leaves work out. Ask what is missing.
Want to see how a vendor should work? Read our custom software development process, then talk to us and ask us all 25 questions.