Browse our curated list of Software Development Companies
A software company due diligence checklist covers eight areas: legal identity, tax and statutory compliance, team and capacity, delivery record, security, data protection, intellectual property and exit terms, and financial stability. Below is a free template you can copy into a spreadsheet, score each finalist against, and finish in about two weeks.
It's built for buyers who have already shortlisted two or three companies and need to pick one, usually a founder, a CTO, or a procurement or IT head signing off on a sizeable contract. If you're still at the stage of checking whether a company is real at all, start with our guide on how to verify a software development company, which covers the basic public record checks. This checklist goes further, into the things that decide whether a project survives its first serious problem.
Key takeaways
- The checklist covers eight areas and 43 checks, from legal identity and GST filing to IP assignment and financial stability.
- Run the full checklist for contracts above about $12,000, for software that handles personal or payment data, or for teams engaged for six months or more.
- Score finalists 0 to 2 on each check, weight team and delivery record highest, and drop any company that fails a must-pass item.
- Two weeks is enough for two or three finalists if every company receives the same written questions on the same day.
When You Need Full Due Diligence
Not every project needs all eight sections. A $530 landing page doesn't justify two weeks of checks, and asking a small studio for its security policies on a brochure site wastes everyone's time.
As a rough guide, run the full checklist when any of these apply: the contract is above about $12,000, the software will store customers' personal data or payment details, it will become core to how your business runs (an ERP, a customer app, a SaaS product), or you're committing to a dedicated team for six months or more. For anything smaller, sections 1, 2, 4 and 7 are usually enough.
It's also worth running when you're outside India and hiring an Indian company for the first time. Every public record we mention below is online and in English. You can do almost all of it remotely.
The Software Company Due Diligence Checklist at a Glance
| Area | What you're checking | Evidence to ask for or find |
|---|---|---|
| 1. Legal identity | The company exists, is active and is who it says it is | MCA master data, certificate of incorporation, directors' names |
| 2. Tax and statutory | It's registered and actually filing | GST search with filing table, EPFO payment details |
| 3. Team and capacity | The people you'll get, and whether they're enough | Named team with roles, employee or contractor status |
| 4. Delivery record | It has built similar things for real clients | Live projects, reference calls you make yourself |
| 5. Security | Your systems and data are handled safely | Access policy, testing process, incident plan |
| 6. Data protection | It meets DPDP Act duties as a data processor | Data processing clause, breach process |
| 7. IP, contract and exit | You own the work and can leave cleanly | Assignment clause, repository access, handover terms |
| 8. Financial stability | It will still be around to finish and support | Company age, filings, client concentration |
Use the sections below as the actual checklist. Each one lists the questions to ask and the evidence that should back the answer, and you can copy them straight into a spreadsheet with one column per finalist.
1. Legal Identity and Ownership
When something goes wrong, you need to know exactly which legal entity you have a contract with, and it should be the same one doing and billing the work. Search the company on the MCA portal's master data service, which shows companies and LLPs registered with a Registrar of Companies[1]. It's free, with a free MCA user account. Note the status, incorporation date, registered address and directors.
- Is the MCA status Active?
- Does the legal name on the proposal match the MCA record exactly?
- Are the founders you met listed as directors or designated partners?
- Does the company have a parent, sister company or offshore entity involved in billing? If so, which one signs the contract?
- For a sole proprietorship or partnership firm, which won't be on MCA, who is the owner or partner who'll sign?
2. Tax and Statutory Compliance
A company that's behind on its own filings is often behind on other things too, which is why this section is worth ten minutes even on small projects. Check the GSTIN on the GST portal's Search Taxpayer page. Without logging in, you can see the legal and trade name, the date of registration, the constitution of the business, the principal place of business, any date of cancellation, and the return filing table by financial year[2].
- Is the GST registration active, not cancelled or suspended?
- Have returns been filed regularly for the last twelve months?
- Does the GST legal name match the MCA name and the contract?
- Does the EPFO establishment search show regular monthly provident fund payments[3]?
- Will the company raise proper tax invoices for every milestone?
3. Team and Capacity
Buyers skip this section more than any other, and it's often where trouble starts. Get the named team in writing before you sign.
- Who are the project manager, tech lead and senior developers, by name?
- Are they employees or contractors? If contractors, who holds their contracts?
- How many other projects is each of them on right now?
- What happens if the tech lead leaves mid-project: notice period, handover, named backup?
- Can you meet the tech lead before signing, not just the sales lead?
- Does the headcount on the EPFO record roughly match the size the company claims?
Write the key names into the contract, with a clause that any replacement needs your approval. Companies that plan to swap senior people for juniors after signing will push back on this, and that pushback tells you something.
4. Delivery Record
You're looking for evidence that the company has built something like your project, for a real client, and that the client was happy enough to say so out loud. Screenshots and case study PDFs are a start, not proof.
- Which two or three past projects are closest to yours in type and size?
- Are they live? Can you open the app or site yourself?
- For apps, does the App Store or Google Play listing name the client, and can the company show its involvement?
- Can you speak to those clients by phone, ideally ones you pick from the client list?
- What went wrong on those projects, and how was it handled?
Then call the references, and our own experience shows why it has to be a call: every company applying to UpBusiness lists three client projects and we email each client to confirm, but for the 53 companies we've approved, only 17 of 159 client contacts have replied so far. Emailed reference requests mostly go unanswered, so a phone call is the only reference check that reliably tells you anything.
5. Security Practices
The depth here depends on what the software touches. For an internal tool with no customer data, a short conversation is enough. For anything with payments, health records or large customer databases, ask for documents.
- How is access to your code, servers and accounts granted and removed? Do developers use personal accounts or company ones?
- Is multi-factor authentication enforced on code repositories and cloud accounts?
- How is code reviewed before release, and is security part of that review?
- Will the software get a security test before launch? Who runs it, and what does it cover? Our guide to VAPT testing costs explains the options.
- Who is the company's point of contact for CERT-In, and what's its incident process?
- Does it hold any security certification, and can it show the certificate and its scope?
Don't skip the CERT-In question, because CERT-In's 2022 directions require service providers and body corporates to report listed cyber incidents within 6 hours of noticing them and to keep logs of their ICT systems for a rolling 180 days within India[4]. A company that's never heard of this hasn't thought much about incidents.
6. Data Protection
If the software will process personal data of your customers or staff, the company becomes a data processor under the Digital Personal Data Protection Act, and you remain responsible as the data fiduciary. The Act allows a business to engage a data processor only under a valid contract[5], so this section mostly ends up as contract wording.
- What personal data will the company's team be able to see, and can test environments use dummy data instead?
- Where will the data be stored, and will any of it leave India?
- Will the company tell you about a personal data breach immediately, so you can notify affected people without delay as the DPDP Rules require[6]?
- Will it delete or return the data at the end of the contract?
- Does it use any sub-processors, such as hosting or AI services, that will see the data?
The DPDP Rules were notified on 14 November 2025 with an 18-month phased rollout, and the highest penalty under the Act, up to $26.3 million, applies to a failure to keep reasonable security safeguards[6]. That penalty falls on you as the data fiduciary, not on the software company, and the processor contract is your main protection.
7. IP, Contract and Exit
This section protects you if the relationship ends, and it's the one buyers most often regret skipping. Under the Copyright Act, the author of a work is its first owner unless it's made by an employee under a contract of service, and any assignment of copyright must be in writing[7]. Code written by an outside company belongs to that company until a written assignment says otherwise, and our software development contract checklist goes through that clause and the others below in more detail, including payment terms, warranties and dispute resolution.
- Does the contract assign all code, designs, documentation and data to you once you've paid?
- Will the code live in a repository you own from day one, with the company given access, rather than the other way round?
- Are cloud accounts, domains and app store accounts opened in your company's name?
- What notice is needed to end the contract, and what does the company hand over when it ends?
- Does the company use any of its own libraries or frameworks in your project, and on what licence?
- Are milestone payments tied to working features you can test, with no more than 20 to 30% paid upfront?
8. Financial Stability and Continuity
You don't need audited accounts for a $15,800 project, but you do want some sign that the company will still exist in a year to support what it built.
- How long has the company been incorporated, and how long has it been trading under this name?
- Is it filing its annual returns on MCA on time?
- Does any single client make up most of its revenue? If that client leaves, what happens to your team?
- How many people has it added or lost in the last year?
- Will it agree to a support period after launch at a fixed monthly price?
Client concentration is worth asking about directly. A 15-person company with one client providing 70% of its work can disappear quickly if that client walks away.
How to Score the Checklist
Scoring turns a pile of notes into a decision you can defend to your board or finance team. A simple approach works best: mark some items as must-pass, and score the rest from 0 to 2.
| Area | Must-pass items | Weight for the rest |
|---|---|---|
| Legal identity | MCA or GST record matches the contracting entity | 10% |
| Tax and statutory | GST active and filing regularly | 10% |
| Team and capacity | Key people named in writing | 20% |
| Delivery record | At least one reference you spoke to yourself | 20% |
| Security | Access control and a pre-launch test plan | 10% |
| Data protection | Willing to sign a data processing clause | 10% |
| IP, contract and exit | Written assignment and code in your repository | 15% |
| Financial stability | Company active and filing on time | 5% |
Any finalist that fails a must-pass item drops out, however good the rest looks. For the others, score each item 0 (no evidence), 1 (partial or verbal) or 2 (documented), multiply by the weights, and compare. The weights above favour the team and the delivery record because that's where projects tend to fail, but adjust them to your project. A healthcare app, for example, should weight security and data protection much higher.
A Two-Week Due Diligence Plan
Most buyers can finish all eight sections for two or three finalists in two weeks without slowing the project down. Here's a schedule that works.
| When | What to do | Who |
|---|---|---|
| Days 1 to 2 | Public record checks on MCA, GST and EPFO for each finalist | You or an analyst |
| Days 2 to 3 | Send the written questions below to all finalists at once | You |
| Days 4 to 7 | Reference calls, portfolio checks, meet each tech lead | You and your technical adviser |
| Days 6 to 8 | Security and data protection review for higher-risk projects | IT or security lead |
| Days 8 to 12 | Contract and IP review, negotiate key clauses | Legal or finance |
| Days 12 to 14 | Score, decide, and tell the companies that weren't chosen | Decision maker |
Sending the same written questions to every finalist at the same time matters more than it sounds. It makes the answers comparable, and how quickly and carefully each company replies is part of the evidence.
Questions to Send Before the First Call
Paste these into an email to each finalist. Good companies answer most of them in a day or two.
- Please share your CIN or LLPIN, GSTIN and PAN.
- Who will work on our project, by name and role, and are they employees?
- Which two past projects are most similar to ours, and can we speak to those clients?
- How do you handle access to client code and cloud accounts, and how is it removed at the end?
- Will our code be in a repository we own from the start?
- How do you test before each release, and do you run a security test before launch?
- Will you sign a data processing clause covering personal data and breach notification?
- What is your payment structure, and how much do you need upfront?
- What happens if a key team member leaves during the project?
- What does support cost after launch, and what response times do you commit to?
If you haven't written a project brief yet, do that first so every company is answering about the same project. Our software project brief template takes about an hour to fill in, and our guide to comparing software development proposals helps once the quotes come back.
Where Companies Fall Short: What Our Verification Data Shows
We run a lighter version of this checklist on every company that applies to list on UpBusiness, across software, AI, marketing and design. By October 2026, 83 companies had applied, 53 were approved and 25 rejected, with 5 still under review.
The documents themselves are rarely the problem for genuine companies. Of the 53 approved, 50 passed the GST check and 44 passed the incorporation check, and most of the rest were sole proprietorships and partnerships, which don't have an incorporation certificate. When applications fail, it's often over things a buyer can't see from documents alone. The common reasons we list in our partner guide include incomplete verification, fake portfolio work and misleading information.
The weakest area across the board is client confirmation, which is why section 4 tells you to call references yourself. And companies that fix problems do come back: 8 rejected applicants resubmitted, and 5 of those were later approved.
Due Diligence for Buyers Outside India
If you're in the US, UK, the Gulf or elsewhere and hiring an Indian company, the checklist works the same way. The GST and EPFO searches need no login at all, and the MCA records need only a free user account.
Three things deserve extra attention. Agree on which country's law governs the contract and where disputes will be heard, because enforcing a judgment across borders is slow. Make sure the IP assignment clause works under both your local law and India's, since the Copyright Act's written assignment rule applies to the Indian side[7]. And agree working-hour overlap in writing, such as three or four shared hours a day, with named people available in those hours.
Skip Most of Sections 1 and 2
Every company listed on UpBusiness has already passed the identity and tax checks in sections 1 and 2, along with a review of its portfolio and three client projects, and holds a TrustScore of 70 or more. That leaves you free to spend your two weeks on the team, the contract and the reference calls, which is where the real decision gets made.
You can browse verified software development companies and shortlist the ones that fit, or post your requirement once and we'll match you with three verified companies for free, with no commission.
