A bad vendor does not just cost you the project fee. It costs you a year of time and your board's trust in any further IT investment. So when choosing, do not test the portfolio — test the behaviour.
Questions about price and deadline
1. What is your hourly rate and why is it not on your website? 2. What exactly happens when you miss the deadline? 3. Which KPIs will be in the contract and what if you miss them? 4. Show me the last proposal where you talked a client out of a project. A vendor who has never turned down work takes everything — including what they cannot do.
Questions about process and people
5. Who specifically will write the code and can I talk to them? 6. How often will I see a working demo? 7. Who owns the code and the repository from day one? 8. What happens when I want to leave you? 9. What share of the team are juniors? 10. How do you test? 11. Who handles security? 12. What is the smallest project you are willing to do?
A good vendor answers these twelve from memory and with a smile — they are already answered in their contract. A bad one starts talking about an individual approach.