A quote that comes back within a day should be treated as a bad sign. Any serious team responds with clarifying questions before any number: about users and volumes. A vendor that prices without asking anything is simply guessing, ai automation services and a guess will be corrected later — and you will pay for it.
Look out for a gap between the people you meet and those who eventually appear in the repository. Request specific people rather than roles in the agreement, php vs python with a clause covering replacement. A provider that talks only about abstract roles and will not commit to individuals is preserving the right to assign anyone it likes.
Require access to the repository from the first week. A partner that hands over nothing between demos is asking you to trust a black box. Daily commits tell you who is really on the project far better than a slide deck. This extends to the CI pipeline: if it does not exist, promises about quality remain unverifiable.
Ambiguous phrasing around code ownership is not an accident. The agreement should state in plain terms that the code, designs and documentation become the property of your company on payment. Look too at the governing law and how payments are structured: a large upfront payment with nothing due in return for weeks removes any leverage you would otherwise keep.
Lastly, examine how they communicate. Establish how many hours the teams will share with your timezone, which named person is expected to answer questions and how quickly. Four hours of overlap is normally sufficient; zero overlap stretches every clarification into a day of delay. Unclear written communication in the proposal rarely improves under delivery pressure.