How to Verify a Software Development Company in India Before You Sign

Find the right partner for your business

Browse our curated list of Software Development Companies

Explore Companies

To verify a software development company in India before you sign, check four things that sit outside the company's own sales deck: its record on the Ministry of Corporate Affairs (MCA) portal, its GST registration and return filing, its provident fund record with EPFO, and what its past clients tell you on the phone. All four are free. GST and EPFO need no login, MCA needs only a free user account, and the whole set takes one to two hours per company once you know where to look.

This guide walks through each check step by step, then covers the team, the portfolio, security, data handling and the contract. It's written for whoever is doing the hiring, usually a founder, an operations head or an IT manager, and it uses what we've seen ourselves while verifying the 83 companies that have applied to list on UpBusiness.

Key takeaways

• Four free checks confirm most claims: MCA company status, GST registration and return filing, EPFO payroll records and reference calls you make yourself.
• In our analysis of 83 partner company applications, 53 were approved and 25 rejected, and approval took a median of 10 days.
• Only 17 of 159 clients replied to our emailed reference requests, so phone references directly rather than relying on email.
• Before signing, confirm in writing that the code, designs and accounts will be assigned to you.

Why You Should Verify a Software Development Company Before Signing

A polished website and a confident sales call prove very little. Most hiring mistakes come from things a buyer could have spotted in an afternoon: a "company" that turns out to be one freelancer with a logo, a team that's half the size it claimed, a GST number that was cancelled last year, or a portfolio full of projects someone else built.

None of these are rare, and they're expensive to discover after you've paid an advance. If the company can't raise a proper GST invoice, your finance team can't claim input tax credit. If the people on the sales call aren't the people who'll write your code, the estimate was built for a different team. And if the company quietly folds halfway through, getting your code and your server access back can take weeks.

Verification won't tell you whether a company will do good work. It tells you whether the company is what it says it is, which is the question you should settle before you start comparing designs and prices.

What We Learned Verifying 83 Partner Companies

Every company that applies to list on UpBusiness, whether it builds software, AI, websites or marketing campaigns, goes through document and portfolio checks before it can appear in front of buyers. As of October 2026, 83 companies had applied. We approved 53, rejected 25, and 5 were still under review.

Rejection isn't always the end of it, though. 31 applicants were rejected at least once, 8 of them fixed the problems and resubmitted, and 5 of those were later approved. The fixes were usually simple, such as a missing incorporation certificate or GST details that didn't match the company name, and in our experience genuine companies can usually produce these documents within a few days, so if one still can't after a week of reminders, it's fair to ask why.

Approval took a median of 10 days from application, ranging from the same day to 71 days, mostly depending on how fast the company sent documents. Among the 53 approved companies, 33 are private limited companies, 9 are LLPs, 7 are sole proprietorships, and the rest are a partnership firm, a public limited company and a foreign company. So don't rule out a company just because it isn't a private limited company. Plenty of good small studios are sole proprietorships, and you just verify them differently, mostly through GST rather than MCA.

Step 1: Check the Company on the MCA Portal

Start with the MCA's "View Company or LLP Master Data" service. It shows the master data of any company or LLP registered with a Registrar of Companies^[1]. Viewing it is free, though the current portal asks you to sign in with a free MCA user account first. Search by the company's name or its CIN (Corporate Identification Number), which a legitimate company should share without hesitation, and it usually appears on its invoices and website footer.

The record shows the company's status, its date of incorporation, its registered address and its directors or designated partners. Look at four things in particular.

• The status should read Active. "Strike off", "Under process of striking off" or "Dormant" means you stop there, whatever the sales team says.
• The incorporation date should roughly match the company's story. If the website says "12 years of experience" and the company was incorporated in 2024, ask about it. There may be an innocent answer, such as a founder who freelanced for years first, but you want to hear it.
• The directors' names should match the founders you meet. If the person introduced as the CEO isn't a director, find out what their role really is.
• The registered address should make sense. A residential address isn't a problem for a small company, but it should match what's on the GST record.

Sole proprietorships and partnership firms won't appear on MCA at all, because they aren't incorporated under the Companies Act. For them, the GST record in Step 2 does most of the work. In our own checks, 44 of the 53 approved companies passed the incorporation check, and most of the rest were proprietorships and partnerships that simply don't have an incorporation certificate.

Step 2: Check GST Registration and Return Filing

Any Indian software company billing serious work should have a GSTIN, and you can check it on the GST portal's Search Taxpayer page without logging in. The search shows the legal name of the business, its trade name, the effective date of registration, the constitution of the business, the principal place of business, the date of cancellation if there is one, and details of returns filed^[2].

That last part is the one most buyers miss. Click "Show Filing Table", pick the financial year, and you'll see whether the company has actually been filing its returns^[2]. A company that's registered but hasn't filed for six months is either in trouble or not really trading, and both are bad news for a project that will run for months.

Check that the legal name on GST matches the name on the proposal and the MCA record. Small mismatches happen, like a trade name that differs from the legal name, but the legal entity you sign with, pay and get invoices from should be the same one. It's also worth knowing that the middle ten characters of a GSTIN are the business's PAN, so you can match the GSTIN against the PAN on the contract.

GST was the check we could complete most often. 50 of the 53 approved companies on UpBusiness passed it, and of the few rejection notes our team has written so far, half were about GST problems.

Step 3: Check Real Headcount on the EPFO Portal

Team size is the claim buyers check least and companies stretch most. "50+ developers" on a website can mean 50 employees, or 8 employees plus a list of freelancers they call when needed. Both models can work, but you should know which one you're buying.

The EPFO's public establishment search lets you look up an employer by part of its name or its seven-digit establishment code. The results include the establishment's status as per the EPFO master, details from its registration form, other establishments with the same PAN, and a "View Payment Details" link that shows its monthly provident fund payments^[3].

The payment details are what you want. If a company claims 60 people and its monthly provident fund return covers 12, ask why. There can be a fair answer, as some staff may be above the wage ceiling and opted out, or some may be on a sister company's payroll, but the gap should be explained before you sign, not after the first missed deadline.

Very small companies may not be registered with EPFO at all, so a missing record isn't proof of anything on its own. Treat this check as a way to test a headcount claim, not a pass-or-fail test.

Step 4: Check the Founders and the Team

Once the company checks out, look at the people. Match the directors on MCA to their LinkedIn profiles and see whether their work history fits a software business. A founder who has spent ten years building products is a different bet from one whose last three ventures were in unrelated trades, though neither is automatically good or bad.

Then ask the question that matters more: who exactly will work on your project? Get names and roles for the project manager, the tech lead and at least the senior developers, and look them up too. If the company won't name anyone until you sign, it probably hasn't decided yet, which means the team you get will be whoever is free that week.

Ask whether those people are employees or contractors. Contractors aren't a problem in themselves, but it changes who owns the code they write (more on that in Step 8) and how easily the company can replace them. Ask too what happens if your tech lead leaves mid-project. A good company will have a straight answer, such as a notice period, a handover plan and a named backup.

Step 5: Check the Portfolio Properly

Portfolios are the easiest thing to fake and the easiest thing to check, if you do more than look at screenshots. For every project you care about, ask three questions: is it live, can you see it, and can you speak to the client?

For mobile apps, open the listing on the App Store or Google Play and look at the seller or developer name. If it's the client's company name, ask the software company to show you its involvement, such as a short screen-share of the code repository or the project board. If the app isn't live anymore, ask why. Apps get retired for many normal reasons, but "the client ran out of money" and "we lost the code" are very different stories.

For web projects, check whether the site is still up and whether the stack matches what the company says it built. Browser tools and the page source often show the framework in use. If the company says it built a custom platform and the site is a standard WordPress theme, the claim needs explaining.

Fake portfolio work is one of the common reasons we turn applicants down, which is why every applicant has to submit three client projects with details we can check. A company that has done real work can usually tell you, without notes, what went wrong on a project and how they fixed it, and that's often more convincing than the case study itself.

Step 6: Call the Client References Yourself

Ask each shortlisted company for two or three past clients you can call, ideally ones you choose from its client list rather than ones it hand-picks, and then make the calls. A short phone conversation reveals far more than an email exchange.

Our own data shows why a phone call matters. Each company that applies to UpBusiness lists three client projects, and we email every one of those clients asking them to confirm the work. For the 53 approved companies, that's 159 client contacts, and so far only 17 have replied. Busy clients ignore reference emails, which means an email that goes unanswered tells you nothing either way, and a reference you speak to directly is worth far more.

When you get a past client on the phone, these questions work well:

• What did they build for you, and roughly how long did it take compared with the original plan?
• Did the people you met during sales actually work on your project?
• How did they handle a change in scope or a missed deadline?
• Do you have full access to your code, servers and app store accounts today?
• Would you hire them again for your next project, and if not, why not?

The last question is the one to listen to carefully. People are usually polite about past suppliers, so a pause, or a "yes, for small things", tells you a lot.

Step 7: Check Security and Data Handling

If your software will handle customer data, payments or anything sensitive, the company's security habits are part of verification, not a detail for later. Ask how they manage passwords and access to your systems, whether developers can reach production data from personal laptops, and how they test for security problems before launch. Our guide to VAPT testing costs explains what a proper security test covers if you need one.

Two Indian rules are worth knowing here. CERT-In's 2022 directions require service providers, data centres and body corporates to report listed cyber incidents to CERT-In within 6 hours of noticing them, and to keep logs of their ICT systems for a rolling 180 days within India^[4]. Ask the company who its CERT-In point of contact is and how it would handle an incident on your project. A company without a clear answer has likely given incident handling little thought.

The second is the Digital Personal Data Protection Act. Under it, a business can use a data processor, such as a software company handling your customers' data, only under a valid contract^[5]. The DPDP Rules were notified on 14 November 2025 with an 18-month phased rollout, and the highest penalty under the Act, up to $26.3 million, applies to a failure to keep reasonable security safeguards^[6]. Your contract should say what the company may do with personal data and what happens if there's a breach.

Step 8: Check the Contract Before You Sign

Verification ends with the paperwork, and ownership is where buyers get caught out most. Under the Copyright Act, the author of a work is its first owner unless it's made by an employee under a contract of service, and an assignment of copyright has to be in writing^[7]. Software built for you by an outside company is not made by your employees, so you need a written clause that assigns the code, designs and documentation to you once you've paid.

Payment structure comes a close second. Avoid paying more than 20 to 30% upfront to a company you haven't worked with before, and tie the rest to milestones you can see and test. Our software development contract checklist covers these clauses in detail, along with exit terms and support.

How Long Verification Takes

For one company, the public checks take about an hour, and the reference calls take a day or two to arrange. For a shortlist of three to five companies, set aside a week.

That week is cheap compared with the cost of a failed project. It also tells you something about each company: the ones that respond quickly and openly to your questions are usually the ones that will respond the same way when something goes wrong mid-build.

Red Flags That Should Stop the Deal

Most of what you find is worth a conversation with the company, but a few findings should end the deal unless there's a clear, documented explanation:

• The MCA status isn't Active, or the GST registration has been cancelled or suspended.
• The legal entity on the contract is different from the one on the GST record or the invoices.
• GST returns haven't been filed for several months.
• The company won't name the people who'll work on your project.
• None of the portfolio projects can be shown live or traced to a real client.
• It refuses to let you speak to any past client.
• It wants most of the money before any work is delivered.
• It wants to keep your code in its own repository or host your app on its own accounts, with no plan to hand them over.

Softer warning signs are better weighed together than one at a time. A very low quote after a single call, a team that changes between meetings, or vague answers about testing don't prove anything alone, but two or three together usually point the same way.

How UpBusiness Verifies Partner Companies

If you'd rather not run every check yourself, every company listed on UpBusiness has already been through them before you see it. We ask for incorporation certificates, GST details, Aadhaar verification of the founder through DigiLocker, business proof and three client projects with details we can follow up. The team checks each document against the public records described above and turns down applications that don't hold up.

Every one of the 53 approved partner companies on UpBusiness holds a TrustScore of 70 or more, with a median of 75. Verification doesn't guarantee how a project will go, and we'd still encourage you to call references and review the contract yourself, but it removes the fake companies and the obvious mismatches before you spend time on them.

To compare verified companies, start with our list of software development companies, or read our software development services guide to understand what to ask for. If you'd like us to do the matching, post your requirement once and we'll send you three verified companies that fit your budget and project, free and with no commission. And once you have a shortlist, our software company due diligence checklist gives you a template to score them side by side.

Browse verified software development companies