A number produced without questions is a red flag rather than good service. Any serious team will come back with questions first: about who owns the data and what happens on failure. A vendor that commits to a figure with no clarification is guessing, and that guess resurfaces as a change order — at your expense.

Look out for any distance between the team in the pitch and those who eventually appear in the repository. Insist on the names and CVs of the actual team in the statement of work, with a provision covering replacement. A team that will only describe roles and never names specific engineers is reserving the right to assign anyone it likes.

Require commit-level visibility from day one. A team that delivers nothing between demos is inviting you to trust a black box. Daily commits show you who is really on the project far better than a weekly report. The same applies to the build and deployment setup: if it does not exist, quality claims are nothing more than words.

Vague wording in the contract around code audit services ownership is not a formality. The contract should state explicitly that the code, designs and symfony vs spring documentation belong to your company upon settlement of the relevant invoice. Also check which country's law applies and the milestone terms: heavy prepayment with no deliverable attached takes away the only leverage you have.

Lastly, examine communication. Ask how much working-time overlap there will be with your working day, who answers day-to-day questions and on what response times. Some genuine overlap is usually enough; no overlap converts every clarification into a lost day. Sloppy written English in the proposal will not improve later.