You can verify a software development company in one afternoon, using public records, the company's own work and two conversations. You won't learn everything. You will learn whether the company is who it says it is, whether its work exists, and whether the people you would work with can talk sensibly about your project. Whatever is still uncertain after that is best tested with a small paid piece of work.
Here is the routine we would follow if we were the buyer. It assumes a shortlist of two or three companies and about four hours in total.
What to write down before you verify a software development company
Open each company's website, proposal and emails, and copy its claims onto one page, word for word: legal name, address, founding year, team size, project counts, partner badges, certifications and named clients. Add the name printed on the quote and on any bank details it has sent you.
This takes 15 minutes and makes the rest of the afternoon faster. You are no longer asking whether a company feels trustworthy. You are checking a list of statements, one at a time.
Step 1: confirm the legal entity (30 minutes)
For a company in India, start with the Ministry of Corporate Affairs website, mca.gov.in, which lets the public view the master data of any company or LLP registered with the Registrar of Companies. Search by name. A company's record shows its CIN, date of incorporation, registered address, company status and the date of its last annual general meeting.
Then check the GST number if the company has given you one. The GST portal's taxpayer search works without logging in: enter the GSTIN and you see the legal name, trade name, effective date of registration, constitution of business, GSTIN status and taxpayer type, along with return filing details. The portal's taxpayer search FAQ lists what is shown.
If the company presents itself through a UK entity, search the Companies House register. It is free and shows the registered office, officers and filing history. Companies House itself says it does not check the accuracy of what is filed, so read it as a record of what the company declared.
You are looking for consistency:
- The name on the quote matches a registered name, or the trade name on the GST record.
- The status is active, and filings are not years out of date.
- The incorporation date fits the "since" year on the website.
- The bank account you would pay into is in the name of the business you are signing with.
Two cautions. A sole proprietorship or partnership firm won't appear in the MCA records, which cover companies and LLPs. And businesses below a turnover threshold are not required to register for GST, so a very small firm or a freelancer may legitimately have no GSTIN. A missing record from a small outfit is a question to ask, not proof of anything. A contract in one name with payment to an account in another is a bigger concern.
Step 2: check how old the website really is (15 minutes)
A domain's registration date is public. ICANN Lookup shows current registration data for a domain name, including when it was registered. Personal contact details may be redacted for privacy, which is normal and tells you nothing.
Next, the Internet Archive's Wayback Machine at web.archive.org keeps saved copies of websites going back years. Look at the earliest captures and at the homepage from a year or two ago. You are checking whether the story holds together. A company claiming ten years in business on a domain first registered last year, or whose "500+ projects" became "1,500+" in twelve months while its portfolio stayed the same, owes you an explanation.
There may be a good one. Companies rename, merge and move domains. Ask, and see whether the answer is specific.
Step 3: open the work (60 minutes)
This is the easiest step to rush, and the one that tells you the most. Go through the portfolio and open every link. For each project, note whether it loads, what it does, and what the company says it did: design, the whole build, a redesign, or ongoing maintenance of something another team made.
For mobile apps, open the store listing and look at who published it. For an organization account, Google Play shows the developer's legal name, address, email and phone number, and on the App Store the seller shown for an organization is its legal entity name. Expect that name to be the client's, not the development company's. An app built for a client should be published from the client's own developer account. A vendor that puts client apps under its own account is showing one of the warning signs in our article on outsourcing app development safely.
Then pick the two projects closest to yours and ask the company to walk you through them on a call: the admin screens, one tricky feature, and what they would do differently now. People who built something can talk about it in detail without preparing.
Step 4: check the claims that can be looked up (30 minutes)
Go back to your page of claims. Some of them have a public source:
- Partner badges. Google, AWS and Shopify each run a public directory: the Google Partners directory, the AWS Partner Solutions Finder and the Shopify Partner Directory. If a company shows one of these badges, search for its name there. The AWS and Shopify directories mainly list partners above the entry tier, so if the company is missing, ask which tier it holds and how you can confirm it.
- Management system certifications such as ISO/IEC 27001 can be checked in IAF CertSearch, a global database of accredited certifications. It depends on data from participating certification bodies, so if a certificate isn't listed, ask for a copy and the name of the body that issued it.
- Named clients and logos. Ask what was built for each, when, and whether you can speak to someone there.
Our article on checking inflated claims on IT company websites goes through each type in more detail. An honest company will be comfortable with this step, because its claims hold up.
Step 5: talk to the engineers, then a past client (60 minutes)
Ask for a 30-minute call with the people who would actually work on your project, not only the person selling it. Keep a short script:
- Who exactly would work on this, and which projects in your portfolio did each of you work on?
- Looking at our brief, what is the riskiest part, and how would you reduce that risk?
- In the project closest to ours, what did you build yourselves, and what came from a theme, a plugin or another team?
- Where does the biggest number on your website come from, and how was it counted?
- Which legal entity will sign the contract and issue the invoices, and is the bank account in that name?
- Can you put us in touch with a client whose project was similar to ours?
Pricing, changes and ownership belong in the same conversation, and our list of questions to put to a software company before you sign covers those.
On the reference call, ask the past client four things: how the result compared with what was promised, how problems were raised, whether they received their code and credentials without friction, and whether they would hire the team again for something larger.
Some clients ask to stay confidential, and that is a fair reason for a company not to share one particular reference. Having no past client anywhere willing to speak for it is a different matter.
Two companies, one afternoon
Say you run a freight forwarding business in Manchester and have shortlisted two Indian companies for a shipment-tracking portal.
Company A's website says "since 2012" and "600+ projects". The MCA record shows a private limited company incorporated in 2021, status active. ICANN Lookup shows the domain was registered in 2020, and the earliest Wayback capture of its homepage, from 2021, says "50+ projects". Seven of its twelve portfolio links open. On the call its engineers answer clearly, and when you ask about 2012, the founder explains that he freelanced for nine years before incorporating.
Company B makes no count claims. Its MCA record shows incorporation in 2019 and an active status, the GST record matches the name on its quote, and eight of its nine portfolio links open, including a logistics dashboard. Its engineers point to the customs data integration as the riskiest part of your brief and suggest building it first.
Neither company is ruled out. Company A's explanation for 2012 is plausible, but its website overstates, and you would want the "600+" explained as well. Everything Company B claimed checked out, and its engineers have already started thinking about your risk. On this evidence, B gets the first paid milestone, and A gets a polite note saying why.
What an honest company should be happy to show you
- Its registered name, company number or GSTIN, and an address that matches the public records.
- Live projects you can open, with a plain account of what it did on each.
- The engineers who would work with you, by name, on a call.
- An NDA before you share details, and a contract that gives you ownership of the code and access to the repository.
- A sample of how it reports progress and bugs.
- A written answer to any claim on its website you ask about.
Here is what you can hold us to. Our portfolio of projects we built gives each one a case study, and each entry links to the project's own website where one is public. We sign an NDA before a project starts, the client owns the code and has repository access, and clients talk directly to the engineers on their project. We are based in Rajasthan, India, and work remotely with clients in India and other countries.
If you only have an hour to verify a software development company, do steps 1 and 3: the registry check and opening the work. For the time they take, those two tell you the most.
If we are on your shortlist, run this routine on us and send us whatever questions it raises. We reply to every enquiry within 24 hours, and we would rather answer a hard question before you sign than after.
