Choosing and vetting a vendor, and what the handover should look like
Years in business are a weak signal. Habits you can inspect are a strong one. Eight checks, a handover list and a maintenance list you can hold any vendor to.
- Ask: what did your last audit find, and what is still open?
- A new vendor can pass these checks. An old one can fail them.
- Accounts and domains should be in your name from day one.
- Keep maintenance and new development in separate documents.
Quick answer
Judge a vendor by habits you can inspect: what their last audit found and what is still open, how they release, how they test, what is out of scope, and what their handover looks like. Get a handover checklist and a maintenance agreement in writing before launch, with maintenance separate from new development.
The eight checks, in short
- What did your last audit or review find, and what is still open?
- Show me your release process.
- How do you test, and what happens under load?
- What is out of scope for my first release?
- How do you handle something not in scope?
- Show me a handover checklist.
- What do you label as built, tested, deployed, measured?
- Who owns the code and the data at handover?
If a vendor can’t answer four or five, that tells you more than their portfolio. Full table with good answers and warning signs: how to vet a software vendor.
A new vendor, honestly. We started in December 2025, so we have no long record. What we show is named work with honest labels. On our clinic-queue build our own audits found a queue update that could tear, a rate limiter that blocked nothing, and a release process still run in four manual steps. Some are fixed in tests only. We say which.
The handover
If the lead person left tomorrow, could you still find, deploy and fix everything? The handover should cover accounts, code, environments, secrets, backups with a tested restore, documentation, monitoring, third-party services with renewal dates, people and an exit. For a marketplace client we produced such a checklist. The client’s details are under an NDA. Use ours: handover and maintenance checklist.
The checks measure how a vendor works, not whether they understood your problem. Also run a scope check on your own problem. A brochure site needs a short handover list, not ten rows.
Next chapter: Architecture questions for your engineers.
More by GarunaCDX
Keep going with the next handbook.
Chapter-by-chapter guides from the engineers who build these systems for clients.
