How to choose a software development company: questions, red flags and contracts

Who builds your software matters as much as what they build. The company you hire will hold your data, shape how your team works, and decide how easy it is to change course later.

This guide shows how to choose a software development company from the buyer's side: what to settle before the first call, which questions to ask, the red flags, and how to check references and security claims. It works the same way whether you're deciding how to choose a custom software development company for one workflow or how to choose the right custom software development partner for a larger program. For what happens after you sign, see our guide to the custom software development process.

What should you decide before you talk to anyone?

Every firm will fill the gaps for you if you let it. Settle three things first, so each conversation starts from your facts.

• The process. Name the one workflow you want fixed, such as purchase approvals or client onboarding. Write down how it runs today, who touches it and where it breaks.
• The goal. Say what should change and how you'll measure it, for example fewer hours retyping data or faster approvals. Use your own numbers.
• The owner. Pick one person on your side who can make decisions and answer questions. The U.S. government's Digital Services Playbook calls for a single product owner with the authority to make decisions and accountability for the result. Without one, projects stall.

Also decide whether you need custom software at all. Our guide to build vs buy software helps you compare. If you're replacing an aging system, read about legacy system modernization first.

Which questions should you ask a software development company?

Ask every firm the same questions, in writing if you can. Here's what good answers sound like.

1. How do you start? With discovery. They study your process and the people who use it before they quote a firm price. The playbook says to spend time with current and prospective users early in the project. A firm that prices a build after one call is pricing a guess.

2. What will the written scope say? What's in, what's out, what needs your approval, and what counts as a change. "We'll figure it out as we go" is not a scope.

3. Who does the work? The names or roles of the people who will build and maintain your system, and whether any of it goes to subcontractors. Ask who your day-to-day contact is, and whether you'll meet the builders before you sign.

4. How do you test? Automated tests that run on every change, plus testing with your real users before launch. The playbook asks teams to create automated tests that verify all user-facing functionality and to run them as part of every build.

5. What are your secure development practices? A good firm can describe them in writing, in plain terms. The reference point is NIST's Secure Software Development Framework (SP 800-218). It groups the practices into four areas: preparing the organization, protecting the software, producing well-secured software, and responding to vulnerabilities. NIST notes that buyers can use it as a common vocabulary with suppliers. Version 1.1 is final; NIST published a draft of version 1.2 in December 2025.

6. Who owns the code, and who owns the data? There's no single right answer, but the contract must give a clear one. The U.S. Copyright Office explains that work commissioned from an outside party is "made for hire" only in nine listed categories, and only with a written agreement signed by both sides. So paying for software doesn't settle who owns it; the contract does. Some firms assign the code to the client. Others keep it and grant a license to use it, as we do. Either way, ask who owns your data, how you get it out, and in what format. This isn't legal advice: have your lawyer read the ownership section.

7. What happens after launch? Someone has to host, monitor, fix and update the software. Ask who does it, how fast they respond, and what it costs. The playbook's contract checklist includes a warranty period in which the vendor fixes defects found after release at no extra cost.

8. How are changes priced? Each change gets a quote before work starts. Our custom software development cost guide covers the full cost of building and running software.

9. What happens if we part ways? Ask for the handover plan before you sign: your data exported in a usable format, documentation, account access, and how long the service keeps running while you move. A firm that won't talk about the exit is counting on you never leaving.

What are the red flags?

• A firm price before anyone has studied your process. Either the price is padded or the change orders are coming.
• A vague scope. If it doesn't say what's out, everything becomes a dispute.
• No names. You can't learn who will do the work, or the people you meet aren't the people who build.
• "Security is handled." No written practices, no way to report a security issue, and audit badges with no report behind them.
• Silence on ownership and exit. If the contract doesn't say who owns what and how you get your data out, ask before you sign.
• Long gaps between deliveries. The playbook favors frequent deliverables, not multi-month milestones. Going months without working software you can try is a risk.
• Pressure to sign this week. A discount that expires before you can call references is a sales tactic.

Fixed scope, time and materials or monthly care: which model fits?

Most firms work in one of three ways, and many combine them: a fixed scope for the build, then monthly care to run it.

Model	How it's billed	Fits when	Watch for
Fixed scope	One price for a written scope	The work can be described in detail up front	Change orders for anything outside the scope
Time and materials	Hours worked at agreed rates	The size of the work can't be estimated yet	No ceiling and no end date
Monthly care	A monthly fee to host, monitor, fix and update	The software is live and has to keep running	What's included, and how new work is quoted

The federal government's own buying rules draw the same line. Fixed prices suit work with reasonably definite specifications. Time and materials may be used only when the extent or duration of the work can't be estimated with confidence, and the contract must include a ceiling price. Ask any firm for a cap.

How do you check references and security claims?

References. Ask for two or three clients you can call, ideally at a company like yours. Ask them:

• Did the project match the scope and timeline in the contract? If not, how were changes handled?
• Who did the work, and are those people still there?
• What happens today when something breaks?
• Would you hire them again?

Security claims. Treat every claim as something to verify. The FTC's security guide for businesses tells companies to put security standards in their contracts with service providers and verify compliance, rather than take a provider's word for it.

• Ask for the practices in writing, mapped to NIST's framework where they can.
• Ask for the report, not the badge. A SOC 2 report is a CPA firm's examination of a service provider's controls relevant to security, availability, processing integrity, confidentiality or privacy. For ISO/IEC 27001, ISO says a certificate from an accredited certification body adds confidence. Check who issued it and when.
• Use CISA's questions. The Secure by Demand guide gives software buyers questions to ask: is multi-factor sign-in on by default and at no cost, how are security patches delivered, is there a software bill of materials listing third-party components, and is there a public vulnerability disclosure policy?

A firm without an outside audit isn't automatically weak. What matters is that it tells you plainly what it has and what it doesn't.

How Raileon works

Raileon designs, builds and runs custom systems inside the tools your business already uses. Here's how we answer the questions above:

• Discovery first. It starts with a free 20-minute call with the founder. Then you get a written proposal with what we build, what needs your approval and the price, before anything starts.
• Who does the work. The engineers who build your system keep it running.
• After launch. Monthly care covers hosting, monitoring, fixes and updates, and starts from $1,999 a month. New builds and upgrades are quoted separately.
• Ownership. Our terms say Raileon owns the software and you get a license to use it. You own your data and the outputs your Modules produce for you, and you can export your data when the service ends.
• Security. Each client's data runs separately from every other customer's, encrypted in transit and at rest, with daily backups. Our security page lists what we have and the audits we haven't done yet.

FAQ

What questions should I ask a software development company?

Ask how they start, what the written scope will say, who does the work, how they test, what their secure development practices are, who owns the code and the data, what happens after launch, how changes are priced, and what happens if you part ways.

Who owns the code when you hire a software development company?

Whoever the contract says. Under U.S. copyright law, paying for the work doesn't by itself make you the owner. Some firms assign the code to the client; others keep it and grant a license. Read the ownership section, and ask how you get your data out.

What is the biggest red flag when choosing a software development company?

A firm price before anyone has studied how your process works. The scope is a guess, so either the price is padded or the gaps come back as change orders.

How do I check a software company's security claims?

Ask for their secure development practices in writing, mapped to NIST's Secure Software Development Framework where they can. Ask for audit reports, not logos, and check who issued them and when. Put your security requirements in the contract.

Talk it through with the founder

Book a free 20-minute call and bring the process you want fixed. You leave with the first 3 things to automate, whether or not we work together. If we're a fit, you get a written proposal before anything starts.

Book a call