The most common mistake in choosing an offshore partner is deciding on cost or speed alone. The lowest bid often turns into the most expensive outcome once rework, missed dates and a painful handover are counted. This is the due-diligence checklist that separates a delivery partner from a liability: what to ask, what evidence to request, and which answers should end the conversation.
How to use this checklist
Score each area from 0 to 2: 0 means no evidence, 1 means claims without evidence, 2 means evidence you could verify yourself. Weight security and the operating model more heavily if the partner will touch production systems or customer data. A zero on security is a stop, whatever the price. Throughout, ask for artifacts rather than answers: a sanitized repository, a real runbook, a sample status report, an actual contract clause.
1. Capability
- Architecture depth — can they reason about your system, or only build to a spec? Bring a real design problem from your backlog to the second call and listen for questions about load, failure modes, data ownership and running cost. A partner who only asks about screens and deadlines will build what you asked for, not what you need.
- Cloud readiness — real experience with your platform and with infrastructure as code (Terraform, CloudFormation, Pulumi or similar), not slideware. Ask for a walkthrough of a deployment pipeline they maintain today.
- Evidence of delivery — case studies you can check: the sector (if the client is under NDA), what shipped, what changed afterward, and a reference you can call. Treat headline numbers without context with caution; a twenty-minute reference call tells you more.
- Legacy comprehension — for modernization, can they uncover hidden business logic before they rewrite it? See our modernization framework for the questions that expose this.
- Seniority mix — who works on your project day to day, not who appears in the pitch. Ask for profiles of the named people and whether they can be swapped without your agreement.
2. Security, IP and compliance
- Data protection — a signed data processing agreement wherever personal data is involved, encryption in transit and at rest, least-privilege access, multi-factor authentication everywhere, and offboarding that actually revokes access. Article 28 of the GDPR lists what a processor contract must contain, which makes it a useful checklist even outside the EU. For EU work covering both GDPR and the EU AI Act, see our compliance guide.
- Certifications, read properly — an ISO/IEC 27001 certificate or a SOC 2 report is useful evidence, but check the scope: which sites, which services, which dates. A certificate that covers a different office or product line tells you little.
- IP and ownership terms — know exactly what you will own and when. It is common for bespoke code to transfer on full payment while pre-existing tools and libraries are licensed to you. That is fine, as long as it is written down and you can run, modify and redeploy everything you receive.
- Open-source hygiene — ask how they track the licenses of dependencies. A copyleft library in the wrong place can create obligations nobody planned for.
- Documented handover — a good partner makes itself replaceable on paper: runbooks, architecture notes, environment setup guides, and credentials held in your accounts rather than theirs.
3. Operating model
Demo cadence, escalation paths, time-zone overlap and who you actually talk to decide most of your day-to-day experience. Ask specifically:
- Who is the single accountable contact, and who do you escalate to when that person is the problem?
- How often will you see working software? Demos of deployed code every week or two beat status reports.
- Which hours overlap with your team, and what happens to a blocking question raised outside them?
- How are estimates made and re-forecast? Ask for an example of a project that ran over and how it was handled. A partner with no such story is either very new or not being candid.
- Where does the work live? Insist on your repositories, your cloud accounts and your ticket tracker from the first day.
- Is any work subcontracted? You should know who writes the code.
4. Commercial terms
- A pricing model that matches scope certainty: fixed price for a bounded scope, time and materials or a dedicated team for evolving work.
- Payments tied to milestones you can verify, not calendar dates.
- Notice periods and exit terms, including help with transition to another team.
- Liability caps, insurance and governing law that fit the size and risk of the engagement.
Run a paid pilot before a large commitment
A small paid pilot, two to four weeks on a real but contained piece of work, tells you more than any RFP response. Define success before it starts: code merged into your repository, passing your CI, reviewed by your own engineers, with a short handover note. Then watch the behaviors that matter: how they handle ambiguity, how early they raise problems, and whether the code is something your team would happily maintain.
Red flags that should end the conversation
- Reluctance to work in your repositories or cloud accounts.
- Senior people named in the proposal who never appear on calls.
- No written answer to "what happens to our data when the contract ends?"
- Pressure to sign a long commitment before any pilot.
- Vague answers about subcontracting or team turnover.
FAQ
How many partners should we shortlist?
Three is usually enough for a real comparison. Beyond five, the evaluation effort tends to outweigh the benefit.
Is the cheapest credible bid ever the right choice?
It can be, if it scores well on everything above. Price is a tiebreaker between partners who pass, not a substitute for passing.
Should the pilot be paid?
Yes. Unpaid pilots tend to get a partner's spare capacity rather than the team you would actually work with.
Holding Velura Labs to the same list
If you are evaluating Velura Labs, use this checklist on us: a signed DPA where personal data is involved, security-first infrastructure and MLOps, bespoke code that is yours on full payment, and a documented handover. A paid discovery through AI Strategy & Roadmap is a low-risk way to run the pilot step before you scale.
We ship work like this for clients in the US (California, Texas, Washington, New York), across Europe (France, Italy and the EU), the Gulf (UAE and Saudi Arabia) and India — with an India delivery base that keeps cost down and time-zone overlap high. Talk to us.