A bad vendor does not just cost you the project fee. It costs you a year of time and your board's trust in any further IT investment. So when choosing, do not test the portfolio — test the behaviour.
Questions about price and deadline
1. What is your hourly rate and why is it not on your website? 2. What exactly happens when you miss the deadline? 3. Which KPIs will be in the contract and what if you miss them? 4. Show me the last proposal where you talked a client out of a project. A vendor who has never turned down work takes everything — including what they cannot do.
Questions about process and people
5. Who specifically will write the code and can I talk to them? 6. How often will I see a working demo? 7. Who owns the code and the repository from day one? 8. What happens when I want to leave you? 9. What share of the team are juniors? 10. How do you test? 11. Who handles security? 12. What is the smallest project you are willing to do?
What the first proposal reveals
Even before the answers, the proposal itself tells you a lot. Does it break the scope into concrete deliverables, or is it just “app development” for one lump sum? Does it state assumptions and limits, or only an optimistic figure? A professional gives you a proposal you can compare against another; an amateur gives a number that changes at the first complication. The proposal is the first piece of work you get from a vendor — treat it as a sample of their quality.
The biggest red flag: a vendor who nods at everything
When every request you make is met with “yes, we'll do that”, it is not helpfulness — it is the absence of an opinion. A good vendor will sometimes stop you: “don't build this, it's expensive and you won't use it.” One who never pushes back either does not understand your business or does not care what they build as long as they bill it. You recognise expertise by what a vendor talks you out of, not by what they nod along to.
A good vendor answers these twelve from memory and with a smile — they are already answered in their contract. A bad one starts talking about an individual approach.