Begin with relevant experience, not the length of the client list. Ask for three symfony or spring boot four projects that sit close to your technology stack, and then ask who actually wrote that code. An honest provider will introduce you to the engineers. Evasive answers at this stage generally mean the demo work came from somewhere else.
The paperwork warrants more attention than the sales deck. Three sections matter more than the rest: ownership of the code, non-disclosure, and exit terms and handover. Everything produced must transfer to you once invoices are settled, including source code, designs and infrastructure as code. Look closely at language that leaves so-called reusable libraries with the vendor, since it is usually exactly the piece that locks you in.
Ask how they estimate. An honest estimate arrives with a list of assumptions, a task-level breakdown and a best case and a worst case. A fixed-bid deal only makes sense when the specification is complete; in any other case the provider adds a risk premium and you pay for it anyway. A time-and-materials model puts the risk on your side, so it requires a cap, regular demos and transparent reporting.
How the work is run matters more than the number of developers. Establish what happens when the scope changes, who signs off on a feature and what the QA setup looks like. A well-run team will be able to walk you through running vertical software development services rather than status reports. Clear, written acceptance criteria remain your only outsource real estate development protection against an argument at delivery time.
Before signing, think about the end of the engagement while the relationship is still good. Insist that the code repository sits on infrastructure you own from the beginning, and that a readme and architecture notes are kept current as the code changes. A partner who is comfortable with this says yes immediately; a long negotiation over it reveals quite a lot.