Choosing a software tool or a development agency often happens in a rush: a demo looks good, the price fits, someone signs. Problems surface months later, when the data will not export, the agency’s lead developer leaves or the invoice doubles at renewal. A vendor selection checklist slows the decision down just enough to catch those problems before you commit. Use the one below for both software subscriptions and agencies or freelancers who build for you. The two share more risks than people expect.
Step 1: write down what you need before you talk to anyone
Vendors are good at steering conversations toward what they do well. Before the first demo, write one page covering:
- The problem in plain words, and who in your team feels it.
- Must-haves and nice-to-haves, kept separate.
- Systems it must connect to, such as your accounting tool, CRM or payment gateway.
- Rough budget, including the first year and ongoing costs.
- The date you need it working, and why that date matters.
Say a Jaipur furniture brand wants an order management system. Its must-haves are syncing with its online store, generating GST invoices and showing stock across two warehouses. A tool that impresses in the demo but cannot handle two warehouses fails the brief, however polished it looks.
Step 2: build a shortlist of three
One option is not a choice and seven is a project in itself. Find candidates through peers in your industry, review sites and communities, then cut to three that meet every must-have on paper. Send each the same one-page brief so their answers are comparable.
Step 3: the vendor selection checklist
Fit and capability
- Have they shown, with your data or a realistic sample, that they meet each must-have?
- For agencies: have they built something similar, and can you see it working?
- Who exactly will do the work? Meet them, not only the salesperson.
References
- Speak to at least two current customers of similar size, ideally ones you find yourself rather than ones the vendor picks.
- Ask what went wrong and how the vendor handled it. Every project has problems. Response is what you are checking.
Price and terms
- What is the full cost for three years, including setup, per-user fees, usage charges, support tiers and likely price rises?
- For agencies: is the quote fixed for a defined scope, or time and materials? How are changes priced?
- What are the payment milestones, and are they tied to delivered work?
- What notice is needed to cancel, and is there a lock-in period?
Data and security
- Where is your data stored, and who at the vendor can access it?
- Do they offer two-factor login, role-based access and audit logs?
- How do they handle a security incident, and how fast will they tell you?
- If they process personal data of your customers, will they sign a data processing agreement? Under India’s DPDP Act 2023, your business remains responsible for personal data a processor handles on your behalf, and the Act expects that relationship to be set out in a valid contract. See the PRS summary of the Act for an overview.
Ownership and exit
- Can you export all your data in a usable format at any time, without paying extra?
- For agencies: does the contract assign all intellectual property in the code and designs to you on payment?
- Are code repositories, cloud accounts, domains and app store listings registered in your company’s name from day one?
- What happens to your data when the contract ends, and how long do you have to retrieve it?
Support and continuity
- What support hours and response times are in the contract, not just the brochure?
- How long has the vendor been operating, and how is it funded? A small, young vendor can be a fine choice, but plan for it disappearing.
- For agencies: what happens if the lead developer leaves mid-project?
Step 4: run a paid pilot or a small first phase
For software, run a trial with real data and the people who will use it daily, not the person who chose it. For agencies, start with a small, paid first phase such as a discovery and design sprint before committing to the full build. You learn more from two weeks of working together than from any proposal.
Step 5: score, decide and record why
Score each shortlisted vendor from 1 to 5 against each section of the checklist, weighting the sections that matter most to you. Write a short note on why you chose the winner and what would make you reconsider. When renewal comes around, that note tells you whether the vendor delivered what you bought it for.
Red flags
- Pressure to sign this week for a discount.
- Refusal to put verbal promises in the contract.
- No clear answer on data export or code ownership.
- An agency that wants to host everything in its own accounts “for convenience”.
- References that can only be contacted through the vendor.
The same standards apply to us. Every Emberoot project starts with a written scope, price and timeline, progress is shown weekly, and at handover the client owns the code, accounts and documents. If you want help running a selection, our technology advice service can join vendor calls and review contracts from a technical angle, and our strategy work helps define what you need in the first place.
Weighing up a vendor right now? Book a free 30-minute call and bring the shortlist.
Frequently asked questions
How many vendors should I compare?
Three is a practical number. Fewer makes it hard to tell whether a price or promise is reasonable, while more than five uses up time without improving the decision. Start with a longer list if needed, then cut to three that meet every must-have on paper before booking detailed demos or proposals.
Should I always choose a fixed-price contract with an agency?
Fixed price suits work with a clear, stable scope. For products where requirements will change as you learn, time and materials with a capped budget and weekly reviews can be fairer to both sides. In either case, define what is included, how changes are priced and what counts as finished before work begins.
What should a software contract say about data?
It should say where data is stored, who can access it, how security incidents are reported, how you can export everything and what happens to the data when the contract ends. If the vendor processes personal data for you, include a data processing agreement. Ask a lawyer to review the terms for anything significant.