How to check a small software supplier before you sign

Trustees, bursars and business owners are often asked to approve a software supplier they have no way of judging. The code is invisible, the proposal is full of unfamiliar words, and the supplier is confident. This checklist is for that moment. We are a small supplier ourselves, so we have written the list we think we should be held to.

Why small suppliers need a different check

With a large agency the risk is paying too much and being passed between people. With a small one the risk is dependence: one person holds the knowledge, the passwords and the code. Every check below is really the same question asked ten ways. If this supplier disappeared next month, would we still have a working system and the means to get it looked after?

Before the first call: five minutes each

1. Is there a real, registered business? Search the Companies House register for the company name. Check that it exists, when it was formed, and that its accounts and confirmation statement are up to date. The registered name and number should also be on the supplier’s website. A sole trader will not be on the register, which is not a fault, but you should then know exactly who you are contracting with. A new company is not a warning sign in itself. A supplier who is vague about being new is.

2. Are they registered for data protection? If the system will hold personal data, search the Information Commissioner’s Office register for the supplier’s name. Organisations that use personal information, sole traders included, must pay the ICO’s data protection fee unless they are exempt, and fee payers are listed there.

3. Can you open something they built? Not a screenshot: a live website or product you can click through yourself, on your phone. Try a form. Notice how fast it is and whether it works with the keyboard alone. Ten minutes with real work tells you more than any testimonial.

4. Do they publish what they charge and what they will not do? A supplier who shows prices, exclusions and the kinds of work they turn down has thought about their limits. One who says yes to everything will find the limits later, on your project.

On the first call: ask, and listen to how they answer

5. “Who will actually do the work, and who do I call when it breaks?” You want to know exactly who that is, and a plain description of their working hours. Be wary of “our team” from a company of one, and of any promise of support at all hours from a business too small to provide it.

6. “Who owns the code, and whose name are the accounts in?” The answer you want: you own the code once it is paid for, in writing, and the domain, hosting and database are in accounts in your organisation’s name with the supplier added as an administrator. If the supplier wants everything in their own accounts, ask why, and what happens to it if you part company.

7. “What happens if you stop trading or fall ill?” There is no perfect answer from a small supplier, and an honest one will say so. A good answer has three parts: the system keeps running without them because it is in your accounts, the code and a written guide are somewhere you can reach, and they commit to a notice period and a handover.

8. “How will you handle our data?” Listen for: a data processing agreement signed before any personal data is touched, building and testing with made-up data and not your real records, a list of every other company that will process the data, and a straight answer about whether AI tools are used and what goes into them.

9. “Is the price fixed, and how are changes priced?” “It depends” is a reasonable answer to “what will it cost?” before the work is understood. It is not a reasonable answer after a proposal. Ask what is excluded, how a change is quoted, and what you pay if the work takes longer than they expected.

Before you sign: two documents

10. Insurance and the contract. Ask for a certificate of professional indemnity insurance and check the dates and the amount. Then read four clauses in the contract, or ask someone to: ownership of the work, the cap on the supplier’s liability, how either side can end it, and what you receive when it ends. If any of those four is missing, ask for it to be added before work starts.

Signs to slow down

• No written scope, or a scope you cannot explain to a colleague.
• Payment in full before anything is delivered.
• Reluctance to put accounts in your name.
• No answer, or an irritated one, to “what if you are not here?”.
• Guaranteed results: rankings, revenue, savings or uptime figures that nobody could promise.
• Pressure to decide this week.

The checklist to copy

1. Company found on the Companies House register, filings up to date.
2. Found on the ICO register, if personal data is involved.
3. A live product or site opened and tried.
4. Prices and exclusions published or provided in writing.
5. The person doing the work is named, with working hours.
6. Code ownership and account ownership confirmed in writing.
7. A continuity answer: your accounts, written guide, notice period.
8. Data processing agreement offered, made-up data for testing, AI use explained.
9. Fixed price, exclusions and the rule for changes in the proposal.
10. Insurance certificate seen, four contract clauses read.

A supplier does not need ten out of ten on day one. What matters is that the answers are straight, and that the gaps are named by the supplier before you find them.

How we answer these ourselves

We publish our answers so that you can check them: who you deal with and where the company stands on our about page, what you own and what happens if something happens to us on our approach page, and every price and exclusion on our pricing page.

Tibyan Labs Ltd is on the Companies House register, company number 17573021, and was incorporated on 10 November 2026. Two of the ten are not in place for us yet, and we would rather say so here: registration with the ICO and professional indemnity insurance are being arranged now that the company is registered. Our about page will list them when they are done.