12 Red Flags When Hiring a Software Development Agency
Twelve red flags when hiring a software agency: unnamed teams, quotes with no discovery, IP that never transfers, no repo access. What to ask before you sign.
The most serious red flags when hiring a software development agency are a contract that doesn’t assign the code’s copyright to you in writing, code and cloud accounts held in the agency’s name, a firm price with no discovery or written assumptions, and nobody willing to name the engineers who will do the work. The first two decide whether you own what you pay for: under US law, a copyright transfer is not valid unless it is in writing and signed. The other two decide whether the quote means anything, because an estimate made at the concept stage can be wrong by a factor of four in either direction.
Key takeaways
- Paying for code doesn’t make it yours. Commissioned software generally isn’t “work made for hire” under US law, so you need a signed assignment.
- Access is the practical test. The repository, cloud and domain should sit in accounts you own from day one.
- A number without assumptions is a guess. In a study of 1,471 IT projects, one in six overran its budget by about 200%.
- Vague scope is where projects fail. When projects miss their goals, requirements are the primary cause 47% of the time, a 2014 PMI study found.
- “AI makes us faster” needs a review process. Veracode found security flaws in 45% of AI-generated code.
Who’s writing this. We’re coderband, a senior software studio, and we’re happy to be held to the same twelve tests. The last section shows how our published terms answer them.
The twelve red flags at a glance
| # | Red flag | Why it matters | What to ask |
|---|---|---|---|
| 1 | Nobody will name the people doing the work | A swap after signing changes what you get | Who writes and reviews the code? |
| 2 | No references you can call | Logos and anonymous quotes can’t be checked | Can I talk to two past clients? |
| 3 | “AI makes us ten times faster,” with no review process | Generated code carries security flaws | Who reviews AI-written code? |
| 4 | A firm price with no discovery or assumptions | Early estimates can be off by 4x | What is this number built on? |
| 5 | A price or timeline far below the other bids | The gap returns as change requests | What isn’t included? |
| 6 | Scope with no acceptance criteria | “Done” becomes whatever the invoice says | How will we know it’s finished? |
| 7 | Payment terms where all the risk is yours | You have no leverage once you’ve paid | What can be billed without my approval? |
| 8 | IP that doesn’t transfer to you in writing | The agency keeps the copyright | Which clause assigns copyright to us? |
| 9 | No answers on security and personal data | You answer to regulators for your vendor | Will you sign a data processing agreement? |
| 10 | Code, cloud and domains in the agency’s accounts | Admin rights decide who controls the product | Am I an owner of every account? |
| 11 | No tests, CI, staging or code review | Users find the bugs first | Who reviewed your last pull request? |
| 12 | No warranty and no handoff plan | Bugs appear after delivery | How long do you fix defects for free? |
In the sales process
1. Nobody will name the people doing the work
A founder or principal engineer leads the pitch, the proposal promises “a dedicated team”, and after signing the work goes to people you’ve never met.
You’re buying the judgment of particular engineers. The US Department of Health and Human Services guards against this in its own contracts: its key personnel clause calls named staff “essential to work performance” and requires 30 days’ notice and written consent before they’re replaced. Undisclosed subcontracting adds a legal problem: copyright vests initially in the author, so an agency can only pass on code its subcontractor has assigned to it.
A good agency names each person, their seniority and weekly hours, and says who is a contractor. Ask: “Who will write and review the code, for how many hours a week, and are any of them subcontractors?”
2. No references you can call
The website shows logos and quotes from “CTO, fintech startup”, and requests for a reference call get deflected.
Testimonials are easy to invent. The US Federal Trade Commission banned fake reviews and testimonials in 2024 and can seek civil penalties from knowing violators. Confidentiality is a fair reason for missing logos: NDAs are normal, and agencies doing white-label work can’t name end clients at all. It doesn’t explain why no past client will take a private call.
A good agency connects you with two or three clients. Ask: “Can I speak to two clients whose projects finished more than six months ago?” Then ask them what happened when something went wrong.
3. “AI makes us ten times faster,” with no review process
The short timeline or low price is explained by AI tooling, and nobody says who reads the generated code.
AI coding tools are useful, and we use them, but neither their speed nor their safety should be taken on trust. Veracode tested more than 100 models and found that 45% of the generated code introduced a security vulnerability, with no improvement in newer models. In METR’s randomized trial, 16 experienced developers took 19% longer with AI tools while believing they had been 20% faster. METR’s 2026 follow-up says developers are probably faster now, but calls its own data “only very weak evidence” of how much. Our guide to fixing vibe-coded apps shows what unreviewed AI code costs to repair.
A good agency names its tools, confirms their terms don’t allow training on your code, and has a senior engineer review every change. Ask: “Which AI tools touch our code, and who reviews AI-written code before it merges?”
In the proposal and the price
4. A firm price with no discovery and no written assumptions
You send a one-page brief, and two days later you get a fixed price and a date with no questions asked.
The cone of uncertainty, as Construx describes it, puts concept-stage estimates at up to 4x too high or 4x too low, a range that “narrows only as you make decisions that eliminate variability.” In a study of 1,471 IT projects, the average cost overrun was 27%, but one in six overran by about 200%, with a schedule overrun of almost 70%. A firm number on a thin brief means the agency hasn’t priced that risk, or plans to hand it back as change requests.
A good agency sells a paid discovery or a small first phase and writes down its assumptions and exclusions. Ask: “What assumptions is this number built on, and what happens if one is wrong?”
5. A price or timeline far below the other bids
Three quotes land close together. A fourth comes in far lower, or far faster, for the same scope and seniority.
Prices vary by region: senior teams charge about $100–$250 an hour in the US and $58–$95 in Central and Eastern Europe (our 2026 rates guide). A quote well under the range for its own region saves the money somewhere: less experienced people, skipped testing, or a low bid recovered through change requests. EU procurement law treats this as a formal warning sign: public buyers “shall require economic operators to explain the price or costs proposed” when a tender looks abnormally low. Do the same.
A good agency explains the gap openly: a smaller scope, reused components, a more junior team. Ask: “What are you doing differently from the other bidders, and what isn’t included?”
6. Scope with no acceptance criteria
The statement of work lists features by name (“user dashboard”, “admin panel”, “integrations”), and nothing says how you’ll tell that one is finished.
In PMI’s 2014 study, when projects missed their goals, inaccurate requirements management was the primary cause 47% of the time. Without acceptance criteria, you think a feature is half done and the agency thinks it’s delivered and billable.
A good agency writes testable criteria for each deliverable, gives you a set review period, and prices every change in writing first. Ask: “How will we both know each deliverable is done, and what happens if I reject it?”
In the contract
7. Payment terms where all the risk is yours
Three versions: hourly billing with no cap and no timesheets, a large non-refundable deposit on a months-long project with no checkpoint, and a discount that expires on Friday.
The US Federal Acquisition Regulation says a time-and-materials contract “provides no positive profit incentive to the contractor for cost control or labor efficiency”, and federal contracts of this type must include a ceiling price. Deposits are normal, and we take them too. The flag is a large one on a long project with no way out (see fixed price vs. time and materials vs. retainer for typical schedules). In our view, an offer that lapses before you can call references is meant to stop you calling them.
A good agency caps hours, reports them weekly, and gives you an exit at each milestone. Ask: “What’s the most I can be billed this month without approving it in writing, and what do I owe if I stop?”
8. IP that doesn’t transfer to you in writing
The contract is silent on intellectual property, gives you only “a licence to use the software”, or transfers ownership “on completion”, so stopping early leaves you with nothing.
In the US, copyright belongs first to the author, not to whoever paid. A commissioned work is “made for hire” only in nine listed categories (17 U.S.C. §101), and software isn’t one of them. So the agency owns what it writes until a transfer, which “is not valid unless” it’s in writing and signed (§204). In Community for Creative Non-Violence v. Reid, the US Supreme Court held that a statue commissioned and paid for by a nonprofit was not a work made for hire, because the sculptor was an independent contractor. The UK’s Intellectual Property Office says the same: the first owner is the creator “and not you the commissioner, unless you otherwise agree it in writing”.
A good contract assigns each deliverable to you on payment, licenses the agency’s pre-existing tools permanently, and confirms every contractor has assigned their rights to the agency. Technical due diligence checks for exactly this. Ask: “Which clause assigns copyright to us, and when does it take effect?”
9. No answers on security and personal data
Security questions get “we take security seriously”, there’s no data processing agreement (DPA), and nobody can say who will have production access.
If GDPR applies to your product and the agency can reach its personal data, the agency is your processor. GDPR Article 28 lets you use only processors “providing sufficient guarantees”, under a contract with specific terms, and bars them from bringing in another processor without your written authorisation. Breaches of these duties carry fines of up to €10 million or 2% of worldwide annual turnover. The FTC’s guidance to US companies is similar: put security requirements for service providers in writing and verify compliance.
A good agency answers in writing: who gets access, whether multi-factor authentication is enforced, who its sub-processors are, and how fast it reports an incident. Ask: “Who will have access to production data, and will you sign a DPA that lists your sub-processors?”
In delivery and handoff
10. Code, cloud and domains in the agency’s accounts
“We’ll host it for you.” The repository is in the agency’s GitHub organization, the cloud and domain accounts are registered to the agency, and you’ll “get everything at the end”. A variant: the product runs on the agency’s own framework, licensed only while you stay a client.
Whoever holds admin rights controls the product if the relationship sours. On GitHub, organization owners “have complete administrative access”. ICANN warns that a developer who registers your domain with their own details “may be listed as the official Registrant of record”, even though you paid.
A good agency works in accounts you created, with you as owner, from the first commit, and licenses anything proprietary to you permanently. Check: log in to the repository host, cloud console and domain registrar yourself. Then ask: “If we parted ways tomorrow, what would we need from you to keep running?” The right answer is “nothing”.
11. No tests, CI, staging or code review
“We test everything manually before release.” Deploys happen from a laptop, there’s one environment, and nobody reviews the code.
Google’s DORA research finds that continuous integration “leads to higher deployment frequency, more stable systems, and higher quality software”, and that automated testing improves software stability. Without them, any change can break what used to work, and the next team’s first job is writing the tests you believed you’d paid for.
A good agency reviews every pull request, runs tests on every commit, and deploys to staging first. Ask: “Show me a recent pull request. Who reviewed it, and which tests ran?”
12. No warranty and no handoff plan
The contract ends at “delivery” and says nothing about bugs found afterwards, documentation, or when the agency’s access is removed.
If the contract is silent, every fix is a new invoice, and the agency decides what counts as a bug. Without a README, a runbook and a list of every service and secret, you also depend on the agency to run your own product. DORA reports “a clear link between documentation quality and organizational performance”.
A good agency fixes defects for a stated period at no charge, hands over documentation, and has its access revoked at the end. Ask: “How long after acceptance do you fix defects for free, and what do we receive at handoff?”
Green flags: a pre-signing checklist
Before you sign, you should be able to say yes to all ten:
- The proposal names the engineers and discloses any subcontractors.
- You’ve spoken to two past clients.
- The quote lists its assumptions and exclusions.
- Every deliverable has acceptance criteria and a review period.
- Billing is fixed or capped, with an exit at each milestone.
- The contract assigns copyright to you on payment.
- The repository, cloud and domain accounts are in your name.
- Security answers are in writing, with a DPA if personal data is involved.
- You’ve seen a real pull request and a CI run.
- The contract states a warranty period and what you get at handoff.
If you can, buy something small first, such as an audit or a discovery phase. It tests most of this list cheaply.
This article is general information, not legal advice. Have a lawyer read any contract before you sign it.
Apply the same twelve tests to us
Here is how our published terms and offers answer these questions.
- People (1, 2). Senior engineers do the work, and you meet the engineers on your project at the kickoff call. We may deliver through vetted contractors. Each is bound to confidentiality and assigns their rights to us in writing, so full ownership passes to you. We’re your only contracting party and fully responsible for the work, and on request we tell you who has access to your systems. We never use a client’s name or logo without written permission, so ask us about references on a call.
- AI (3). A senior engineer reviews all code before we deliver it. We use only AI-assisted tools whose terms prohibit training on your code or data, and you can ask us not to use them.
- Scope (6). Every deliverable has written acceptance criteria, and you get five business days to review it against them. On a sprint, the scope and the success measure are fixed in writing by day two.
- Money (7). Each offer has a fixed, published price for a defined scope, and the guarantees are in writing: a full refund if the AI-App Rescue Audit finds fewer than five material issues or the GPU audit can’t show 30% savings, your deposit back if the day-5 sprint demo doesn’t convince you, and the first retainer month refunded if the first week isn’t worth it.
- Ownership (8, 10). Your code lives in your repository from day one, your cloud accounts stay in your name, and each deliverable becomes yours automatically once it’s paid in full.
- Security (9). Our terms commit us to least-privilege access, multi-factor authentication on the accounts that reach your systems, and no secrets in code, tickets or chat. We don’t copy production data unless the work requires it, and we sign a GDPR data processing agreement whenever we touch personal data.
- Warranty and handoff (12). Every deliverable is warranted to meet its acceptance criteria. For 14 days after acceptance we fix any defect at no charge, and if we can’t fix it, we refund that part. When the work ends, we ask you to revoke our access and we delete your materials.
The simplest way to see how we work is the Senior Team Retainer: $6,000 a month for 30 senior hours or $9,500 for 50, with a weekly written update of what shipped and the hours used. We work US Eastern business hours, and on-call cover can be quoted separately. Cancel anytime, effective at the end of the paid month. If the first week isn’t worth it, cancel in writing by the end of the seventh day and the first month is refunded in full.
Or start with the questions. Book a call, put all twelve to us, and compare our answers with the other agencies on your list.