25 questions to ask a software agency before signing

Before signing with a software agency, ask 25 questions across six areas: team, process, security, ownership, money, and exit. Good agencies answer them specifically and in writing, and weak ones answer with reassurance. Use the questions below as a script for your second call, and compare answers across vendors.

Which questions reveal the real team?

You are hiring people, not a logo, so start here.

1. Who exactly will work on my project, and what are their roles? You want names and seniority, not "a dedicated team".
2. Can I meet the technical lead before signing? The person who will make daily decisions should be on a call.
3. What happens if a team member leaves mid-project? Look for documented handover and a replacement commitment.
4. How many other projects will these people work on at once? Divided attention is a hidden cost.
5. Who is my single point of contact, and how fast do they reply? Get response times in writing.

Which questions expose their process?

Process is where projects succeed or drift. Ask to see it, not hear about it.

1. How do you turn my requirements into a scope? A good answer includes written scope, out-of-scope items, and acceptance criteria.
2. How often will I see working software? Every one to two weeks is a healthy rhythm.
3. How do you handle changes mid-project? Look for a clear process, not "we are flexible".
4. How do you review code and test it before release? Ask for review practice, automated tests, and a staging environment.
5. How do you use AI tools in your delivery, and how do you review the output? A transparent answer names tools and review gates. See what is an AI-native agency.

Which questions cover security and data?

Security answers should be concrete. If your policy requires an independent report, ask for it.

1. Do you hold a SOC 2 report or ISO/IEC 27001 certificate? A SOC 2 report comes from a CPA's examination of a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy, and ISO/IEC 27001 sets the requirements for an information security management system. Ask for the report or certificate and check its scope. If they hold neither, ask for a completed questionnaire instead.
2. Where will my data and code be stored, and who can access them? Expect named systems and access controls.
3. Which third-party services and AI providers will touch my data? Ask whether data is retained or used for training.
4. How do you manage secrets, credentials, and access at the end of the project? Offboarding should be a checklist, not a hope.
5. What is your process if a security incident happens? Look for notification timelines in the contract.

For a longer set of vendor security questions, use security questionnaire for tech vendors.

Which questions settle ownership?

Ownership gets awkward when it is not written down.

1. Who owns the code, designs, and content when the work is paid for? The default you want is that you do.
2. Which third-party or open-source components will you use, and under what licenses? Ask for a list, and watch for licenses that conflict with your plans.
3. Do you retain any rights to reuse code you write for me? Some vendors keep reusable components. Agree what is yours and what is licensed.
4. Will the project run in my own accounts and repositories? Hosting, domains, and repos in your name prevent lock-in.

The details for AI work are in IP and data terms for AI projects.

Which questions clarify money?

1. What is included in the price, and what is not? Ask for an itemized scope with exclusions.
2. Is this fixed price, time and materials, or capped? Each fits different risk, as explained in fixed-scope pilots vs time and materials.
3. What recurring costs will I carry after launch? Hosting, licenses, model usage, and support all belong on one list.

Which questions protect your exit?

1. What documentation and handover do I receive at the end? Expect architecture notes, setup instructions, and a walkthrough.
2. Can I terminate, and with what notice and payment for work done? Know the cost of leaving before you start.
3. Who supports the product after launch, and on what terms? Warranty periods and support rates should be explicit.

How do you score the answers?

Rate each answer on a simple scale.

Any zero on team, security, or ownership deserves a follow-up. Two zeros is usually enough to walk away. If you want a framework for the AI-specific parts, how to choose an AI agency adds ten more checks.

Frequently asked questions

The takeaway

Good vendors answer these questions in specifics and in writing. Weak ones answer with confidence and nothing else. Nactore is an AI-native technology and growth company that builds, ships, ranks, and grows as one partner, and you are welcome to put these 25 questions to us.

Want this built for your team? Book a free 30-minute call.