I review agency-built codebases for a living, which means I meet founders at the exact moment they wish they had asked better questions a year earlier. The questions below are that list — contract-time and invoice-time — written so a non-technical founder can ask them and judge the answers. None are hostile. Good agencies answer them easily, and quietly respect clients who ask.
Before you sign
- "Does the code live in a repository I own from day one?" Your org, your admin rights, their access as collaborators. "We will hand it over at the end" is how hostage situations begin — politely, and always with a reason.
- "Do I hold the keys?" Cloud account, domain, database, deployment pipeline — created under your accounts, with their access removable by you in an afternoon. Whoever holds the keys owns the product, whatever the contract says.
- "Are tests and migrations deliverables?" Not aspirations — line items. A database that cannot be rebuilt from the repo and code with no meaningful tests are the two most common expensive surprises in the codebases I review.
- "May I have it independently reviewed at any time?" The clause costs nothing to include and tells you everything by how it is received. Confident agencies say "of course." The other reaction is your answer.
- "Who exactly writes my code?" Named people, including subcontracting policy and what happens when the senior who sold you leaves the account after month one.
While you pay
- Watch the repository, not the demo. Continuous commits with readable messages vs. month-end bursts tells you more than any status meeting. You do not need to read code to read a commit graph.
- Demos happen on staging you can open. A demo from the developer's laptop is a rehearsal, not evidence.
- Ask for the walkthrough, quarterly. An hour of "show me how a booking becomes money in the bank" in plain language. Fluent teams love this question; the answer's clarity tracks the architecture's.
- Tie milestone payments to verifiable states, not descriptions: deployed to staging, tests green in CI you can see, feature usable by you. "90% done" is not a state; it is a mood.
The benchmark question
All of this rolls up into one asymmetry: the agency knows exactly what state your codebase is in, and you are taking their word for it. Every question above narrows that gap; an independent review closes it — evidence-graded findings, severities, and the exact challenges to hand your team, in the format the sample report shows. Announced at contract time and exercised before big payments, it is the cheapest quality-assurance mechanism that exists — because it improves the work even when it never runs.
Frequently asked questions
What should I ask a software agency before signing?
The ownership questions first: is the code in a repository I control from day one, do I hold deploy and infrastructure access, are tests and migrations contractual deliverables, and do I have the explicit right to an independent review at any time. A good agency answers all four instantly and in writing. Hesitation on any of them is the cheapest red flag you will ever get.
How do I know if my agency is doing a good job?
You cannot fully know from inside the relationship — that is the structural problem, not a personal failing. The signals you can read: commits landing in your repository continuously (not in month-end bursts), demos on a staging environment you can open yourself, tests that grow with the code, and comfortable answers to 'why' questions. For the part you cannot see, that is what independent review exists for.
When should I get an independent review of agency work?
Three natural checkpoints: before a major payment milestone, before renewing or expanding the contract, and before any handover between teams. A fixed-scope review at those moments costs a fraction of one sprint and converts 'I hope it is fine' into a findings table you can hand back — and its existence, announced early, measurably improves what gets delivered in the first place.
Written by Andrej Dragojevic, Stripe Certified Professional Billing Architect.