How to choose a software development company: 20 questions to ask before you sign
Choose a custom software development company by its answers, not its pitch deck: who will actually work on your project, how the fixed price is set, who will own the code, who is responsible for your data, and what happens after launch. We put together 20 questions worth asking every vendor before you sign. For each one, you’ll find what a good answer looks like and what should worry you. Current as of October 17, 2026.
Many smaller companies order custom software without an in-house expert. According to Eurostat, only 13.2% of Czech businesses and 10.1% of Slovak businesses with 10 to 49 people employed an IT specialist in 2024 (Eurostat). So the person comparing offers is often the owner or a managing director. They don’t need to read code, but they do need to know what to ask.
The questions follow the order in which you’ll need them: team and references first, then process and price, code and rights, security and regulation, and finally handover and support. At the end, you’ll find a table for comparing offers and an honest section on when not to hire us. What the contract itself should cover is explained in our article on the software development contract.
01Questions to ask a software development company: the short answer
- Check the company in 10 minutes in the Czech or Slovak business, insolvency and tax registers.
- Ask to speak with a client the vendor built something similar for, and see a system that’s actually running.
- Insist on a fixed price for a clear scope and on rules for changes, priced before any work starts.
- Get the code rights and accounts in your name in writing, and if the vendor will handle personal data, sign a data processing agreement under Article 28 GDPR.
- Ask what happens after launch: how long fixes are free, how fast they respond, and how you can end the contract.
02Before you start: check the company in public registers
A register check takes about 10 minutes, costs nothing and weeds out companies that could vanish halfway through your project. All you need is the company ID (IČO) from the offer.
| Register | What it tells you |
|---|---|
| [ARES](https://ares.gov.cz/) (CZ) | Basic data on Czech companies from public registers in one place |
| [Public Register and Collection of Deeds](https://or.justice.cz/ias/ui/rejstrik) (CZ) | Shareholders and statutory body, date of incorporation, and financial statements in the Collection of Deeds if the company has filed them |
| [Insolvency Register](https://isir.justice.cz/isir/common/index.do) (CZ) | Whether insolvency proceedings are under way against the company |
| [VAT payer register](https://adisspr.mfcr.cz/dpr/DphReg) (CZ) | Whether the company is flagged as an unreliable VAT payer |
| [Business Register of the Slovak Republic](https://www.orsr.sk/) (SK) | Owners, statutory body, date of incorporation and business activities of Slovak companies |
| [Register of Financial Statements](https://www.registeruz.sk/cruz-public/home/) (SK) | Financial statements of Slovak companies, if they have filed them |
| [Register of insolvency proceedings](https://ru.justice.sk/ru-verejnost-web/) (SK) | Whether bankruptcy, restructuring or other insolvency proceedings have been opened |
| [Slovak Financial Administration lists](https://www.financnasprava.sk/sk/elektronicke-sluzby/verejne-sluzby/zoznamy) (SK) | List of tax debtors, VAT payers with grounds for deregistration and the tax reliability index |
A young company isn’t a bad choice in itself. But if it was founded six months ago and promises a large system, ask to see the people who’ll build it and their previous work.
03Team and references: questions 1 to 4
1. Who exactly will work on our project?
The pitch is often given by a salesperson or the founder, while someone else writes the code. You need to know who will lead your project, who will design the screens and who will do the programming.
Good answer: Names and roles, one accountable person on the vendor’s side, and a chance to meet them before you sign.
Red flag: “We’ll see who’s available” or a team that changes right after signing.
2. Can I talk to a client you built something similar for?
References on a website always look good. A short call with a client tells you more: whether deadlines were met, how changes were handled and whether the system still runs years later.
Good answer: Contact details for one or two clients and a demo of a system people actually use.
Red flag: Only logos on the website, no contacts, and confidentiality cited for every single project.
3. How many similar projects have you finished, and how many do you still maintain?
Finishing a project and looking after it for years after launch are two different skills. A company that still maintains its systems knows what breaks in production.
Good answer: Specific projects from your industry or a related one, and how long the vendor has been maintaining them.
Red flag: A portfolio full of designs and prototypes that never went live.
4. What do you do in-house, and what do you subcontract?
Freelancers often handle part of the work, such as design or testing. That’s fine as long as you know about it and the vendor is just as responsible for them as for its own staff. With personal data, a new sub-processor may only be brought in with your prior written authorization (GDPR, Article 28(2)).
Good answer: A list of subcontractors, their roles and clear responsibility on the main vendor’s side.
Red flag: You find out from an invoice or from another company’s email that someone else is working on your project.
04Process and price: questions 5 to 9
5. How will you find out exactly what we need?
Without an analysis, a price is only a guess. A good vendor asks first: who will use the system, what your team does in spreadsheets today, where errors happen and what should be automated.
Good answer: Kickoff workshops or an analysis that produces a specification, plus a clickable prototype before anyone starts coding.
Red flag: A fixed price for the whole system after a twenty-minute call, without a single question about how you work.
6. Is the price fixed, or based on hours worked? What does it include?
Both models make sense. A fixed price protects your budget, while hourly billing suits ongoing development. Overruns are common: in a 2011 study of 1,471 mostly large, mostly public sector IT projects, Bent Flyvbjerg and Alexander Budzier found an average cost overrun of 27%, and one project in six went over budget by 200% on average (Flyvbjerg and Budzier, HBR 2011, text on arXiv). Small projects are a different scale, but the practical lesson is the same: whatever isn’t in the scope, you pay for on top.
Good answer: A fixed price for a described scope, a payment plan by stage and a list of what isn’t included (licenses, hosting, paid services).
Red flag: A single number with no breakdown, or an hourly rate with no estimate and no cap.
- Average cost overrun27%
- One project in six: cost200%
- One project in six: schedule70%
For the schedule, the study says “almost 70%.” The sample consisted mostly of large projects averaging USD 167 million, 92% of them in the public sector and 83% in the US. Source: Flyvbjerg and Budzier, Harvard Business Review 2011, text on arXiv.
7. How do you handle changes and extra work?
Changes always come. Once people see the system, they think of more things it could do. What matters is whether you know the price of a change before it’s made.
Good answer: Every change is priced in advance, written down, and work only starts once you approve it.
Red flag: Extra work that first shows up on the final invoice.
8. When will I see the first working version, and how often will I see progress?
The worst part of any project is six months of silence followed by a big reveal. When you see the system as it grows, mistakes in the brief are caught early and cheaply.
Good answer: A test version with regular demos, for example every week, and the first part of the system live within a few weeks.
Red flag: Nothing to see until the whole thing is handed over.
9. What happens if you miss a deadline?
A deadline without consequences is just a wish. Ask how a delay on the vendor’s side is handled, and how your own delays count, for example when you send materials late.
Good answer: Binding deadlines for each stage in the contract, and a discount or late-delivery penalty if the vendor misses them for reasons of its own.
Red flag: Deadlines that are only “indicative” and no responsibility for delays.
05Code, rights and data: questions 10 to 13
10. Who will own the code, and what rights will we get?
Paying for development doesn’t by itself guarantee that you may modify the code or hand it to another company. It depends on the contract. We cover this in detail in Source code ownership and licensing.
Good answer: Rights to the code spelled out in writing (under Czech law, for example, an assignment of the right to exercise the economic rights; otherwise, an unrestricted exclusive license) and when they take effect, usually on payment.
Red flag: “The code is ours, you get a license to use it,” with no option to develop the system further with another vendor.
11. Whose accounts will the code, hosting, database and domains run on?
If the accounts are in the vendor’s name, you depend on them even if you formally own the code. In a dispute or when the contract ends, getting to your own system can be hard.
Good answer: The code repository, cloud accounts and domains in your company’s name, with the vendor holding only access you can revoke.
Red flag: Everything runs on the vendor’s server, and you get access “on request.”
12. Which ready-made libraries and paid services will you use, and what will they cost?
No modern software is built from scratch. Developers use open source libraries and third-party services such as payment gateways, maps or email delivery. Each comes with its own license, and some with monthly fees.
Good answer: A list of the services and licenses used, and an estimate of monthly running costs, right in the offer.
Red flag: Monthly bills for services nobody mentioned when you signed.
13. How do we get our data out if we want to leave?
The data is yours, but you also need it in a usable form: a complete export, a description of the database and backups.
Good answer: Direct database access or a complete export at any time, with documentation of the data structure.
Red flag: Exports only as PDFs, or only for an extra fee.
06Security and regulation: questions 14 to 17
14. Will you sign a data processing agreement under GDPR?
When a vendor has access to personal data about your customers or employees, for example while testing on real data or running your system, it acts as your processor. Under Article 28 GDPR, you may only use a processor that provides sufficient guarantees, and the processing must be governed by a contract. Among other things, that contract requires the processor to act only on your documented instructions and to delete or return the data when the services end (GDPR, Article 28). We explain GDPR-aware system design in GDPR in a web application.
Good answer: The vendor asks whether it will have access to personal data and, if so, provides a data processing agreement template, a list of sub-processors and a deadline for reporting a data breach.
Red flag: “We don’t need to deal with GDPR, the data is yours.”
15. How do you test security, and how do you report incidents?
Ask about code review, password management, backups, and who will tell you about a breach and how quickly. If a vendor shows you an ISO/IEC 27001 certificate, check the version: certificates based on the older 2013 version expired after October 31, 2025 (DQS). When certification makes sense for your own company is covered in ISO 27001: when it makes sense.
Good answer: A described process: code review, testing before launch, off-server backups with restore tests, and incident reports within hours.
Red flag: A generic “we take security seriously” without a single concrete step.
16. Does cybersecurity law or the CRA apply to us?
Czechia: the new Cybersecurity Act No. 264/2025 Coll. took effect on November 1, 2025. If your company provides a regulated service and relies on a vendor to implement or carry out its security measures, you must choose that vendor in line with those measures and write their requirements into the contract (Section 13(5), Act No. 264/2025 Coll.). Registered providers have up to one year from the registration decision to put the measures in place (Section 13(4)).
Good answer: The vendor knows whether and how these laws apply to you and helps with the technical side. It leaves the final legal assessment to your lawyer.
Red flag: “That doesn’t apply to you,” without a single question about what your company does.
Slovakia: an operator of an essential service that relies on a third party for work directly tied to the availability, confidentiality and integrity of its networks and information systems must sign a contract with that party covering security measures and incident reporting. This doesn’t apply when the risk is low or the third party is itself an operator of an essential service (Section 19(2) and (3), Act No. 69/2018 Coll.).
EU Cyber Resilience Act (CRA): it covers software made available on the market. Most of its obligations fall on the manufacturer, meaning whoever places the product on the market under their own name or trademark, and that can be your company, for example with a downloadable mobile app. According to the Commission’s summary, an internal system you don’t supply to anyone falls outside the CRA (CRA summary). Reporting of actively exploited vulnerabilities and severe incidents applies from September 11, 2026, and the main obligations from December 11, 2027 (European Commission).
How these rules affect company leadership is covered in App security for executives.
17. Will the website or app meet accessibility requirements?
Since June 28, 2025, accessibility laws implementing the European Accessibility Act have been in effect in both countries: Act No. 424/2023 Coll. in Czechia and Act No. 351/2022 Coll. in Slovakia. They cover selected consumer services, such as e-commerce and financial services, and don’t apply to services provided by microenterprises (CZ, SK). If you’re in scope, accessibility has to be part of the design from the start.
Good answer: The vendor asks who the service is for and builds accessibility into both design and testing.
Red flag: Accessibility as an “add-on at the end” for an extra fee.
07Handover and support: questions 18 to 20
18. What exactly will you hand over, and how does acceptance work?
Acceptance is when the clock starts running on fixes. You should know exactly what you’ll receive and how long you have to check it. Our handover checklist sums up what to check.
Good answer: A handover report, test scenarios, documentation, access credentials and training, with a review period in business days.
Red flag: A handover by email, with a link and the password in the message body.
19. How long do you fix bugs for free, and what happens after that?
After launch, there are always bugs the tests didn’t catch. What matters is how long the vendor fixes them at no extra cost, and where a fix ends and a new feature begins.
Good answer: A clear period of free fixes from acceptance, a way to report bugs and a line between a fix and a change.
Red flag: “If something doesn’t work, just let us know,” with no time limit and no rules.
20. How fast do you respond, and how can we end the contract?
A system your business depends on needs looking after once it’s live. Ask how soon the vendor starts working on an outage and what you get when you leave. If you can no longer reach an agreement with your current vendor, see how to take over a website from an unresponsive developer.
Good answer: Response times by severity written into the contract, a short notice period, and handover of code, access, backups and documentation when you leave.
Red flag: A one-year contract with no way out and vague handover terms.
08How to compare offers
Offers are hard to compare because each one describes something different. A simple table helps: go through every offer with it and ask for whatever is missing.
| What to compare | What to look for | Red flag |
|---|---|---|
| Scope | List of features and screens, what isn’t included | Just a project name and one price |
| Price and payments | Fixed price per stage, payment plan | Full price upfront, payments not tied to stages or acceptance |
| Deadlines | Deadlines per stage and what happens if they slip | A single deadline at the end |
| Code and accounts | Code rights, accounts in your name | License to use only, accounts in the vendor’s name |
| Personal data | Data processing agreement, list of sub-processors | No mention of GDPR |
| Running costs | Monthly costs, response times, notice period | Running costs missing, one-year lock-in |
| After launch | Free fix period from acceptance | Nothing |
If you don’t have an IT specialist on staff, you’re far from alone. Eurostat shows how strongly this depends on company size.
- 10 to 49 peopleSlovakia: 10.1%Czechia: 13.2%
- 50 to 249 peopleSlovakia: 37.0%Czechia: 40.4%
- 250 or more peopleSlovakia: 74.8%Czechia: 81.3%
Share of businesses with at least 10 employees, excluding the financial sector. EU average: 14.0%, 43.0% and 78.4%. Source: Eurostat, table isoc_ske_itspe (Eurostat).
Hiring your own IT specialist isn’t easy either. In 2024, 8.0% of Czech businesses with at least 10 employees looked for an IT specialist, and 5.7% had a vacancy that was hard to fill. By our calculation, that’s roughly seven in ten of those who were hiring. In Slovakia, it was roughly half (Eurostat). For many small companies, an external vendor is the fastest realistic way to get custom software built.
- Looked for an IT specialistSlovakia: 6.5%Czechia: 8.0%
- Had a hard-to-fill vacancySlovakia: 3.5%Czechia: 5.7%
Share of all businesses with at least 10 employees, excluding the financial sector. EU: 9.6% and 5.5%. Source: Eurostat, table isoc_ske_itrcrn2 (Eurostat).
09When not to hire us
Custom software isn’t right for everyone. In these situations, we’ll point you somewhere else.
- Off-the-shelf software covers nearly everything you need. If a standard CRM or invoicing tool fits and per-user licenses don’t hurt, a ready-made product is cheaper and faster.
- You need a small job worth a few thousand CZK. A freelancer will handle a simple script or a template tweak for less. Our smallest automation projects start at around CZK 60,000 excl. VAT.
- You want your own full-time development team. If development will be your core long-term activity, it pays to build an in-house team over time. We’ll hand over the code, documentation and access so your team can carry on.
- You need the vendor to run servers. We don’t provide hosting or run servers. Systems run on cloud accounts in your company’s name.
- You don’t have time for the project. Custom software can’t be built without you. Plan for two or three two-hour workshops at the start and a short demo every week, around 30 minutes for web apps.
10How we answer these 20 questions
You can ask us the same questions. Here’s how our terms and website answer them:
| Topic | How we do it |
|---|---|
| Offer | We get back to you within 24 hours on a business day, and you get a fixed-price offer within 2 business days |
| Price and deadline | Fixed price and deadline in the contract. If we miss a binding deadline for reasons of our own, you get a discount of 0.05% of the stage price per day, up to 10% of the stage price |
| Changes | We price extra work in advance and never start without your approval |
| Progress | A clickable prototype before coding and weekly progress on a test version |
| Code and accounts | On full payment, we assign you the right to exercise the economic rights (Czech law). Code and data are yours; the repository, domains and cloud accounts are in your name (small projects may use our account, transferred free on request). Our general libraries and tools: non-exclusive license |
| Personal data | Data processing agreement, non-disclosure agreement, incidents reported within 24 hours |
| After launch | 180 days of free fixes from acceptance, then support with response times in the contract and 1 month’s notice |
Our How it works page walks you through the whole project step by step. If budget is the question, see our article on digitalization grants in Czechia and Slovakia in 2026 and how to calculate software ROI. For where to start with the scope of the first version, read How to define an MVP.
11Frequently asked questions
How do I choose a custom software development company?
Check it in public registers, ask to speak with one of its clients, and ask about the team, process, price, code rights, data protection and support after launch. Compare offers based on the same scope, not the final number.
Is a fixed price better than paying by the hour?
For the first version of a system with a clear scope, a fixed price is usually better because it protects your budget. For ongoing development after launch, hourly billing with time reports works well. Either way, clear rules for changes matter most.
How much does custom software development cost?
With us, smaller automation projects start at around CZK 60,000, a CRM or internal portal typically runs CZK 120,000 to 300,000, and a simpler mobile app starts at around CZK 200,000, all excl. VAT. The exact price comes out of the scope analysis.
Who owns the source code?
It depends on the contract. Without an explicit agreement, your rights may be limited. Get it in writing which rights to the code you receive, from when, and where the code will be stored.
Do I need a data processing agreement with the vendor?
Yes, if the vendor will work with personal data, for example when testing on real data or running the system. Article 28 GDPR requires it (EUR-Lex). If it won’t have access to personal data, it isn’t a processor.
How can I tell if an offer is suspiciously cheap?
When it has no feature breakdown, doesn’t say what isn’t included, or was put together without a single question about how you work. A cheap offer usually assumes a smaller scope, and you end up paying for the rest as extra work.
12Conclusion
A good vendor isn’t afraid of specific questions and will give you the answers in writing. Most problems trace back to a missing scope, unclear code rights and no rules for after launch.
Take these 20 questions to your first meeting. We’re happy to answer them too: send us a few lines about what you need, and you’ll have a fixed-price offer within 2 business days.
13Sources
- ARES, Czech register of economic entities
- Czech Public Register and Collection of Deeds
- Czech Insolvency Register
- Czech VAT payer register
- Business Register of the Slovak Republic
- Slovak Register of Financial Statements
- Slovak register of pre-insolvency, liquidation and insolvency proceedings
- Slovak Financial Administration: information lists
- VIES: EU VAT number check
- Regulation (EU) 2016/679, GDPR
- Czech Act No. 264/2025 Coll. on Cybersecurity
- Slovak Act No. 69/2018 Coll. on Cybersecurity, version from April 30, 2026
- European Commission: Cyber Resilience Act
- European Commission: Cyber Resilience Act summary
- Czech Act No. 424/2023 Coll. on accessibility requirements
- Slovak Act No. 351/2022 Coll. on accessibility requirements
- DQS: transition to ISO/IEC 27001:2022
- Eurostat: businesses employing IT specialists by size (isoc_ske_itspe)
- Eurostat: hiring IT specialists (isoc_ske_itrcrn2)
- Flyvbjerg and Budzier: Why Your IT Project May Be Riskier Than You Think (2011)
Figures and legal information are current as of October 17, 2026. This article isn’t legal advice; for a specific contract, consult a lawyer.