A quote that comes back within a day is a warning, not a service level. An experienced provider will come back with clarifying questions before any number: difference between rest and graphql about who owns the data and outsource retail ecommerce development what happens on failure. A provider that quotes with no clarification is probably pricing a guess, and a guess will be corrected later — at your expense.
Look out for a gap between the people you meet and those who eventually appear in the repository. Ask for the names and CVs of the actual team in the statement of work, with a clause that requires notice before anyone is swapped. A provider that only offers roles and will not commit to individuals is preserving the right to assign anyone it likes.
Require access to the repository from day one. A partner that hands over code only at milestones expects you to accept a black box. Daily commits reveal the actual pace far better than any status report. The same applies to the build and deployment setup: if nothing runs automatically, promises about quality remain just talk.
Vague contract language around intellectual property is not a formality. The agreement needs to state explicitly that all deliverables become the property of the client on payment. Check also the jurisdiction and how payments are structured: a request for most of the money up front with no deliverable attached takes away any leverage you would otherwise keep.
Last, pay attention to how they communicate. Establish what overlap you will share with your timezone, who is expected to answer day-to-day questions and within what time. Some genuine overlap is normally sufficient; none at all turns a five-minute question into a twenty-four hour round trip. Sloppy written English in the sales phase rarely improves once the work starts.