Look first at relevant experience, not the size of the portfolio. Ask to see two or three projects that resemble your domain and your stack, and startup mvp development then ask which engineers actually built it. A serious vendor will introduce you to the engineers. Vague answers at this stage usually mean the delivery team is not the team you were shown.
The contract deserves more scrutiny than the proposal. A few clauses carry most of the weight: ownership of the code, non-disclosure, and notice periods and handover. Everything produced has to transfer to you as it is paid for, along with source code, designs and infrastructure as code. Be careful with language that leaves framework code outside the transfer, as this is frequently the part you cannot replace later.
Ask how they estimate. A credible estimate comes with the assumptions behind it, a breakdown by feature or module and a range rather than a single number. A fixed-bid deal works only when the requirements are stable and documented; otherwise the provider prices the risk in backend and frontend technologies we use you pay for uncertainty either way. A time-and-materials model moves the risk back to the client, so it requires a cap, regular demos and transparent reporting.
Process matters more than headcount. Establish what happens when the scope changes, who writes the acceptance criteria and what the QA setup looks like. A well-run team should be able to demonstrate a working build every one or two weeks. Written acceptance criteria stay your only real protection against an argument at delivery time.
Finally, consider the day you no longer need this vendor at the start rather than at the end. Insist that the code repository sits under your account from day one, and that documentation is updated as part of the work. A provider confident software development companies in saudi arabia its own work says yes immediately; hesitation here tells you a great deal.