Questions to ask a software partner and the checks that tell you if the answers are true.

Most buyers interrogate the technology and the timeline. Those are the easy parts to answer confidently and the hardest to verify. The questions that actually predict whether a project succeeds are about what happens at the end and what happens if it goes wrong: who owns what, what is not included, what it costs to run, and what you would hold if the supplier vanished on a Tuesday.

The first version of this guide was twelve good questions. This revision turns it into a protocol, because a question is only useful if you know what a true answer looks like and can check it. So each stage below pairs the question with the public record, the legal default or the published norm that tests it. Most of the checks are free and take under an hour. The suppliers who pass them will not mind you running them; the ones who do mind are telling you something.

Two free searches tell you more than any sales deck. Companies House’s Find and update company information service shows, at no charge, a company’s registered address and date of incorporation, current and resigned officers, document images, mortgage charge data, previous company names and insolvency information, and lets you search for disqualified directors. A private company must file accounts within nine months of its financial year end (twenty-one months for its first accounts), and the penalties for lateness are automatic: £150 up to a month late, £375 to three months, £750 to six months and £1,500 beyond, doubled if late two years running. A supplier with overdue accounts has a cash or attention problem you are about to inherit.

The second search is the ICO’s register of fee payers. Every organisation that processes personal information must pay the data protection fee unless exempt: £52 a year for the smallest tier, £78 for small and medium organisations, £3,763 for the largest, with fines of £400 to £4,000 for not paying. The register publishes the controller’s name and address, registration reference, fee tier and dates, and is searchable by reference, name or postcode. A software company that will hold your customers’ data and is not on it has either misunderstood its obligations or ignored them. Either is disqualifying for a supplier whose job is building systems that handle data.

All figures from GOV.UK, the ICO and the insurers’ published pages, read on 14 September 2026. The searches are free; only the insurance certificate needs the supplier’s cooperation.

Professional indemnity insurance is the cover that pays if the supplier’s negligent work costs you money, and it is the one to ask about by name. The published UK market gives you a sense of scale. Simply Business reports that 10 per cent of the software developers it insured between 1 January and 30 June 2026 paid £92.56 a year or less for up to £1 million of professional indemnity cover, and its example quotes show £250,000 for a sole trader and £2 million for a small development company. PolicyBee offers software developer professional indemnity from £8.14 a month for £100,000 of cover, with limits up to £5 million available.

Two conclusions follow. First, cover is cheap enough that a supplier without it has chosen not to have it, and that choice tells you how they think about your risk. Second, £1 million is the level the headline premiums are quoted for and £2 million appears in the insurers’ own example quotes for small development companies, so a larger buyer contracting a critical system may reasonably ask for more; the cost to the supplier of raising it is modest. Ask for the certificate, check the insured name matches the company you are contracting with, and check the expiry date. Employers’ liability, if they employ anyone, is a legal requirement; public liability matters less for a firm that does its work at a keyboard.

The single most misunderstood point in software buying is that paying for code does not make you its owner. Under section 11(1) of the Copyright, Designs and Patents Act 1988, "The author of a work is the first owner of any copyright in it," and section 11(2) moves that ownership to the employer only where the author is an employee acting in the course of employment. A supplier you commission is not your employee. Its code is its copyright, whatever the invoice says, until it assigns the copyright to you. And section 90(3) is unambiguous about how: "An assignment of copyright is not effective unless it is in writing signed by or on behalf of the assignor."

So the question "who owns the code?" has a checkable answer: show me the clause. A proper contract assigns to you the intellectual property in everything created for the project (the foreground IP) on payment, or better, from creation with a lien until payment; licenses you the supplier’s pre-existing tools and libraries (the background IP) perpetually and irrevocably; and lists any open-source components with their licences. It also puts the repositories, the hosting, the domain and every third-party account in your name from day one, so that ownership is a fact of the login rather than a promise in the contract.

Watch for two clauses that undo all of this. A licence dressed as ownership ("the client shall have the right to use the software") is not an assignment. And an assignment "on final payment" of a contract whose final payment can be withheld by the supplier for any dispute is an assignment you may never receive. If the supplier’s commercial model depends on you not being able to leave, the ownership clause is where it lives.

Source code escrow means a third party holds a copy of the code and releases it to you if the supplier fails, stops supporting the product or breaches the agreement. It matters most when you are buying a product the supplier keeps, rather than a bespoke build you own outright. If the code is assigned to you and lives in your repositories, you do not need escrow; you need a backup. If you are buying a licence to somebody else’s platform and your business depends on it, escrow is the difference between an inconvenience and a rebuild.

The published UK prices are lower than most buyers assume. Escode, the NCC Group escrow business, states that basic services "start at around £1,600/year, with pricing adjusted for verification or SaaS features". The Escrow Company published in July 2024 a base fee of £1,695 a year for software escrow and £2,995 a year for a SaaS access-continuity arrangement, with verification services, where the escrow agent confirms the deposit actually builds, from £10,995. Unverified escrow is worth little; a deposit nobody has compiled may be a folder of nothing.

The question to ask is therefore twofold. If you own the code: "Are the repositories in our name today, and can we prove we can deploy from them without you?" If you do not: "Is the code in escrow, with whom, is it verified, and what are the release triggers?" A supplier who answers the first with "we will hand it over at the end" has described a dependency, not a handover.

If the supplier will touch personal data on your behalf, whether by building on your live database, running your AI agent, or hosting your app, UK GDPR requires a written contract between you as controller and them as processor, and the ICO says exactly what it must contain. The contract must set out the subject matter and duration of the processing, its nature and purpose, the type of personal data and categories of data subject, and the controller’s obligations and rights. Then it must include eight terms.

A quote is a scoping document with a number at the bottom. If the number is the only specific thing in it, the work has not been scoped; it has been estimated, and an estimate on a fixed price is a risk premium waiting to be revealed. The following are the parts of a quote a buyer should expect to see, and can reasonably refuse to sign without.

Scoring is not about precision; it is about forcing every supplier through the same questions so that the confident one and the careful one are compared on the same page. Score each row 0, 1 or 2, weight as shown, and treat any zero in a weighted-3 row as a stop regardless of the total. Two suppliers within a few points of each other are equivalent; pick the one whose people you would rather phone at 8am. The red flags below the table are the zeros that recur most often, with the reason each one matters.

Maximum 44. A supplier scoring under 30, or zero on any weight-3 row, is not a supplier yet, whatever the price.

Since we are asking you to run these checks, here is how we answer them. Augustova Limited is registered at Companies House and with the ICO. IP in everything we build for you is assigned to you in writing; repositories, hosting and every third-party account are in your name from the first day; open-source components are listed with their licences. Every quote is a fixed price against a written scope with an exclusions list and a stated monthly running cost, and we sign a processor contract containing the Article 28 terms before we touch live data.

Handover is documentation, credentials, a runbook and a recorded walkthrough, so another developer could pick the system up without calling us. Our prices are published: a single-process tool £4,000 to £10,000, a business application £10,000 to £20,000, a first AI implementation £4,000 to £15,000, excluding VAT. Run the table on us and on whoever else you are talking to; we would rather lose a comparison on the numbers than win one on the demo.

Company and filing facts are from GOV.UK and the Companies House service, read on 14 September 2026. Data protection fee tiers, penalties and the contents of the register are from the ICO’s own pages on the same date, as are the required contents of a controller-processor contract and the list of processing that requires an impact assessment. Copyright ownership and assignment are quoted from sections 11 and 90 of the Copyright, Designs and Patents Act 1988 on legislation.gov.uk.

Insurance figures are the insurers’ published premium data and example quotes; escrow prices are the escrow agents’ published pages, with dates. Nothing here is legal advice; it is the public record and the published norms, arranged so that a buyer can check a supplier’s answers against them. Where a source page gave no figure we have said so rather than supplied one.

We will revise the figures as the sources change; the date at the top of this page is the date of the last check, and every fee, penalty and premium above should be read as correct on that date rather than permanently.