Selecting a development company for a web application is structurally different from hiring someone to build a marketing website. The relationship lasts longer, the stakes are higher, and the consequences of a poor choice compound over time. A business system holds operational data, enforces processes and integrates with other software. If the supplier cannot deliver or you need to part ways, the exit costs are considerably larger than swapping a design agency.
The core challenge is that most businesses evaluate suppliers on the wrong signals. A polished pitch deck, an impressive portfolio of visually striking sites, or a low initial quote tells you very little about whether a company can build a reliable CRM, a multi-tenant SaaS platform, or a document workflow system. Those products demand a different skill set: careful data modelling, integration experience, role-based access design, and the discipline to write clear acceptance criteria rather than just making things look functional on the surface.
Ownership, access and exit planning should be treated as selection criteria from the start, not negotiated after you have already committed. If a supplier is reluctant to discuss source-code ownership, repository access, or what happens when the contract ends, that reluctance is itself useful information. The same applies to security practices and data-handling procedures. These are not peripheral concerns to be addressed later; they reveal how the supplier thinks about the long-term viability of what they build.
You are also selecting a working method, not just a team. A company that rushes to estimate before understanding your processes will likely build the wrong thing. A company that insists on a structured discovery phase before quoting is signalling that it takes requirements seriously. The way a supplier behaves during the sales process is usually a reliable preview of how they will behave during delivery.
Evidence to compare
| Area | Useful evidence |
|---|---|
| Discovery | A clear method for mapping processes, roles, data, exceptions and integrations. |
| Delivery team | Named roles, realistic availability and an explanation of how knowledge is retained. |
| Estimation | Assumptions, ranges, dependencies and a process for revising estimates as evidence improves. |
| Acceptance | Testable outcomes, business involvement and a route for recording defects and open obligations. |
| Operations | Support responsibilities, access, documentation, maintenance and supplier-exit arrangements. |
Process and discovery
The most revealing part of evaluating a development company is how it approaches the period before any code is written. A supplier that asks detailed questions about your current processes, data sources, user roles and integration points is doing the work needed to estimate accurately. One that provides a figure after a single call is either guessing or planning to control scope so tightly that the result will not fit your business.
For a customer portal, the discovery phase should cover which users need access to which documents, how authentication works, and what upstream systems hold the source data. For a CRM replacement, it should map the existing data model, identify the fields and relationships that matter, and establish where the gaps are between the current spreadsheets and the target system. For legacy modernisation, the supplier should propose an audit of the existing codebase and data before suggesting a rebuild or migration approach.
Team structure and continuity
Establish who will actually be working on your project day to day. A senior person may lead the sales conversation, but if the delivery team is junior or frequently rotated, the quality and consistency of the work will suffer. Ask about the specific roles involved: product owner or business analyst, developer, tester, and whoever handles deployment and infrastructure. Understand whether these people are employees or subcontractors, and whether the same individuals will remain available through the project.
Estimation approach
How a company estimates tells you a great deal about its risk management. Fixed-price quotes for complex business systems are often based on incomplete assumptions, which leads to either scope disputes or corners being cut. Time-and-materials arrangements with clear milestones and acceptance criteria give both sides more flexibility but shift some cost risk to you. Neither model is inherently better; what matters is whether the supplier explains the trade-offs honestly and structures the engagement so that you can verify progress at each stage.
Acceptance and verification
Before work begins, agree on what "done" means for each deliverable. Acceptance criteria should be written in terms of observable behaviour: what the user does, what the system shows, and what data changes as a result. A supplier that agrees to vague acceptance terms is storing up disagreements for later. For business systems, acceptance should also cover data integrity after migration, permission enforcement, and error handling when integrations fail.
Support, maintenance and ownership
Clarify what happens after the initial build is signed off. Who fixes bugs, and for how long? Who applies security patches to the underlying framework and dependencies? Who manages hosting, backups and monitoring? These are not optional extras; they are ongoing costs that should be factored into your decision. Equally, confirm the ownership position on source code, design assets and any custom integrations. If the supplier retains ownership or licences the code back to you, your ability to move to another provider in future is constrained.
Matching supplier type to project type
A company that specialises in SaaS products will approach multi-tenancy, subscription billing and onboarding flows differently from one that builds internal admin tools. A supplier with legacy-system experience will think differently about data migration and phased rollouts than one that only builds greenfield applications. There is no universal "best" development company; there is a best fit for the specific type of system you need, the integrations it depends on, and the stage your business is at.
Evaluating on visual portfolio alone
A slick portfolio of marketing sites or consumer-facing apps does not demonstrate the ability to build a robust internal system. Business applications are judged by data accuracy, process reliability, permission enforcement and integration stability, none of which are visible in a screenshot. When reviewing a portfolio, look for projects that match your type of system in complexity, not just in appearance.
Assuming a good sales process predicts good delivery
Polished proposals and responsive sales teams are deliberate investments. They do not guarantee that the delivery team communicates as clearly, writes tests, handles edge cases in data migration, or documents what they have built. Probe beyond the sales layer: ask to speak with the person who would manage your project day to day, and pay attention to how precisely they discuss technical trade-offs.
Not verifying subcontracting arrangements
Some companies win work with an in-house brand and then outsource development to freelancers or offshore teams you have not met. This is not necessarily a problem if managed well, but you should know it is happening, understand who holds responsibility for quality, and confirm that your data and code are not being handled by parties you have not vetted.
Deferring ownership and access discussions
If you do not establish source-code ownership, repository access, infrastructure credentials and data-export rights before signing, you will have far less leverage afterwards. A supplier that is confident in its work will usually agree to reasonable ownership terms. One that resists may be building in switching costs as part of its business model.
Overlooking integration experience
Business systems rarely exist in isolation. If your application needs to connect to an accounting package, a payment gateway, an email service or an internal database, the supplier's experience with those specific integrations matters more than general development skill. Ask which integrations they have built before, what went wrong, and how they handled rate limits, error retries and data reconciliation.
Evidence to verify before appointment
- Confirm who will work on the project, their roles, and whether they are employees or subcontracted.
- Ask how discovery is structured and what outputs it produces before any estimate is finalised.
- Request a sample of acceptance criteria from a previous project to see how precisely they define "done".
- Verify the ownership position on source code, and whether you receive full repository access.
- Establish what infrastructure, credentials and third-party accounts you will control directly.
- Understand the support model after launch: response times, what is covered, and how long the arrangement lasts.
- Check integration experience against the specific systems your application will connect to.
- Ask what happens if you need to end the relationship: what access, documentation and data you receive, and in what format.
No evaluation process eliminates risk entirely. The aim is to make the risk visible early enough to factor it into your decision, and to ensure that the contractual and practical structures are in place to protect your business if the relationship does not proceed as expected.
Before appointing the company
- Speak to the people who would actually lead delivery, not only the sales team.
- Verify at least one relevant project in enough detail to understand the supplier’s real contribution.
- Resolve ownership, account access and handover expectations in writing.
- Confirm who can approve scope, cost and timeline changes on both sides.
- Keep a written record of the assumptions on which the proposal depends.