Look first at domain experience, not the size of the portfolio. Ask for two or three case studies that match your domain and your stack, and then ask specifically who actually wrote that code. A serious vendor will put you on a call with the people who would work on your project. Answers that name nobody at this stage generally mean you are talking to a reseller.
The agreement needs more attention than the sales deck. A few clauses carry most of the weight: assignment of intellectual property, non-disclosure, and notice periods and handover. Every artifact should transfer to you as it is paid for, together with documentation, pipelines and deployment scripts. Watch for wording that leaves reusable components in the vendor's hands, since it is usually exactly the piece that locks you in.
Ask how they estimate. An honest estimate arrives with a written set of assumptions, a breakdown per feature and a range rather than a single number. A fixed-bid deal works only when the specification is complete; when the scope is still moving the vendor adds a risk premium and you pay for uncertainty either way. Time and materials moves the risk back to the client, so it requires visible weekly reporting and a spending cap.
The delivery process matters more than team size. Ask how change requests are handled, who writes the acceptance criteria and how quality assurance works. A mature team will be able to show you running software product development company rather than status reports. Written acceptance criteria are your only real protection against an argument at delivery time.
Last, think about the day you no longer need this vendor before it becomes urgent. Insist that the repository sits in your organisation from the first commit, and that a readme and architecture notes are kept current as the code changes. A provider confident software development companies in united states its own work says yes immediately; resistance at this point reveals a great deal.
