Start with relevant experience, not the size of the portfolio. Request two or three projects that sit close to your domain and your stack, and aso consulting services then find out which engineers actually built it. A solid partner will put you on a call with the people who would work on your project. Answers that name nobody at this stage usually mean you are talking to a reseller.
The agreement warrants a slower read than the pitch. A few clauses carry most of the weight: intellectual property assignment, confidentiality, and exit terms and handover. Every artifact must transfer to you once invoices are settled, along with source code, designs and infrastructure as code. Watch for wording that keeps reusable components in the vendor’s hands, because it is usually the dependency that makes switching painful.
Ask where their numbers come from. A credible estimate is accompanied by the assumptions behind it, a breakdown per feature and a best case and a worst case. A fixed-price contract works only when the requirements are stable and documented; when the scope is still moving the vendor prices the risk in and you pay for it anyway. A time-and-materials model moves the risk back to the client, so it needs a sprint cadence, demos and a budget cap.
How the work is run matters as much as team size. Find out how a new requirement enters the plan, who signs off on a feature and how quality assurance works. A mature team will be able to walk you through a working build every one or hire pytest developers two weeks. Acceptance criteria in writing stay your only real protection against an argument at delivery time.
Before signing, think about the day you no longer need this vendor before it becomes urgent. Insist that the source repository lives under your account from the first commit, and that documentation is written as you go rather than left to the end. A partner who is comfortable with this says yes immediately; hesitation here says quite a lot.