Five Questions to Ask Before You Hire Any Software Development Agency

Not just us — this is the checklist we'd want if we were hiring an agency ourselves.

Most software agency websites lead with logos, testimonials, and "150+ projects delivered" badges. Almost none of that is independently checkable. Here's what actually is, and what we'd ask before signing with anyone — including us.

1. Are they registered with the ICO? If they'll touch any personal data — yours, your customers', your team's — they should be registered as a data controller. It's a public, searchable fact, not a claim. Check the ICO register directly.

2. Do they hold a recognised security certification? Cyber Essentials (UK Government-backed, assessed via IASME) is the common baseline. It's independently assessed, not self-declared — ask for the certificate number and verify it.

3. Are they insured for the work they're doing? Employers' liability insurance is a legal requirement the moment an agency has employees — ask what it covers and who underwrites it. Professional indemnity or cyber liability cover matters too, especially for anything touching sensitive data or critical infrastructure.

4. Can they show real, verifiable work — not just claimed work? Case studies with live URLs you can actually visit are worth more than a client logo wall with no context. If an agency can point you to something they built and operate themselves, that's harder to fake than a quote.

5. Do they tell you what they don't have yet? Every agency starts somewhere. The ones worth trusting are the ones who'll tell you plainly what's still early — a young track record, a certification in progress, a team that's still small — rather than papering over it with invented numbers.

Why we're publishing this

We hold ourselves to every item on this list — ICO registered, Cyber Essentials certified, employers' liability and cyber insured, real shipped work you can visit. We'd rather you check than take our word for it.