A number produced without questions is a warning, not a service level. A competent team responds with questions first: about who owns the data and what happens on failure. A supplier that quotes without asking anything is simply working from a template, and the gap resurfaces cto as a service a change order — on your budget.
Be wary of any distance between the team in the pitch and the developers actually assigned. Ask for the names and CVs of the actual team in the agreement, symfony vs laravel performance with wording that requires notice before anyone is swapped. A vendor that only offers a pool of resources and will not commit to individuals is preserving the option to staff you with whoever is free.
Insist on commit-level visibility from day one. A provider that delivers code only at milestones expects you to take delivery on faith. Daily commits reveal how many people are really working far better than a weekly report. The same holds for the CI pipeline: if it does not exist, quality claims are just talk.
Ambiguous phrasing around intellectual property is never a formality. The agreement must state explicitly that all outputs produced under it transfer to your business upon settlement of the relevant invoice. Check also the jurisdiction and how payments are structured: heavy prepayment with nothing due in return for weeks takes away any leverage you would otherwise keep.
Last, examine communication. Confirm how much working-time overlap the teams will share each day, which person handles day-to-day questions and on what response times. Some genuine overlap generally works; no overlap converts every clarification into a day of delay. Careless writing in the early emails rarely improves later.