How to vet an offshore AI development company: 12 questions to ask
By Tarannum Khan|Updated
Short answer
Ask who will do the work, what AI they have shipped, where your code and data will live, and who owns the result. Get the answers in writing, interview the named engineers, and test them on a short piece of real work before a long contract. A good provider answers every question plainly, including the ones where the answer is no.
Key takeaways
- Interview the engineers who will do the work, and have them named in the contract.
- Ask for AI work that real users relied on, and how its quality was measured.
- Code, prompts and documents should live in your repositories from day one.
- Get a written IP assignment, an NDA before you share details, and agreed data terms.
- Judge the total monthly cost and a short trial on real work, not the hourly rate alone.
What should you ask an offshore AI development company?
Twelve questions cover the main risks: the people, proof of AI work, your code and data, the cost and the contract. Ask every provider the same questions in writing, so the answers compare. Our own answers are in the right-hand column.
| Question | A good answer | Webify.AI's answer |
|---|---|---|
| 1. Can we interview the engineers who will do the work? | Yes, before they start | Yes. We send two named profiles within 48 hours |
| 2. Will the contract name them? | Yes, with no swaps without your agreement | Yes. They are never swapped without your agreement |
| 3. Will any work go to another company or freelancer? | Not without your consent | Not without your consent |
| 4. What similar AI work have you shipped to real users? | Specific projects, with what went wrong | See our portfolio of 20 client projects, anonymised |
| 5. How do you measure answer quality? | A test set of real requests, rerun after every change | A test set agreed with you, with the failures reported |
| 6. How do you test for LLM security risks? | Prompt injection, data leaks and excessive permissions | Tests with hostile inputs such as prompt injection, narrow tools, and human approval for risky actions |
| 7. Where will our code, prompts and documents live? | In your repositories and accounts | In your repositories |
| 8. How do your engineers use AI coding tools? | A written policy, with human review | A person reviews all AI-assisted code. Your code never goes into public AI tools |
| 9. How will you handle our personal data? | Data terms agreed first, and the least data needed | Data-protection terms agreed before a developer touches personal data |
| 10. What is the total monthly cost? | Rate, hours and every fee, in writing | Published rates. The only optional extra is 15% for the US evening shift |
| 11. What if the engineer isn't a fit or leaves? | A trial, and replacement terms in writing | Two-week trial with the developer you choose. No charge if you stop within the first five working days. Free replacement within five working days |
| 12. Who owns the work, and what happens when we stop? | A written IP assignment, and a clean handover | You own all the code. It stays in your repositories when we stop |
Ask about certifications too, if your buyers or regulators need them. If a provider says it holds ISO/IEC 27001, check the edition: 2013 certificates were withdrawn on 31 October 2025, so a current one says 27001:2022 (transition timeline). We hold no ISO 27001 or SOC 2 certification.
How do you check the answers?
Ask for evidence, not promises. Read the contract clauses before you sign, interview the named engineers, speak to a similar client, and run a short paid trial on your real work. A trial shows how a team works, not only what it ships.
- 1
Shortlist three to five providers
Look for similar AI work, named engineers and published prices or clear quotes.
- 2
Send the same questions in writing
Sign an NDA first, so you can describe the real project.
- 3
Interview the named engineers
Ask each one how they would test your system and what could go wrong.
- 4
Read the contract clauses
IP assignment, naming, subcontracting, data terms and exit, before you sign.
- 5
Run a short trial
One real task with a clear pass mark, judged against your own test set.
What are the red flags?
Refusing to name the engineers, showing only demos, answering security questions vaguely, and pushing a long contract before any trial. So is any reluctance to sign your NDA first, to assign the IP in writing, or to keep the code in your systems.
- You can only meet a sales lead, never the engineers.
- Every example is a demo or a prototype that no real users relied on.
- Nobody can say how answer quality was measured on a past project.
- They haven't heard of prompt injection or excessive permissions, two of the OWASP Top 10 risks for LLM applications (OWASP).
- The code would live in their accounts, not yours.
- The rate is low but the fees for setup, replacement or overlap only appear later.
- They want a long commitment before any trial on real work.
Should you choose the provider with the lowest rate?
Not on the rate alone. As one outsourcing adviser puts it: "Hourly rates are a poor measure of the true cost of software development". Compare the total monthly cost, including your own management time, any shift premium and the cost of rework.
Source: 2026 rate survey. Our guide to the cost of hiring an AI developer in India shows what a rate should include.
Where does Webify.AI fit?
We are an offshore AI development company, so you should vet us with these same questions. Our answers are above, and our security page lists them in full, including the ones where our answer is no.
- Headquartered in Ahmedabad, India, where the work is done.
- An IBM Partner and a signatory of the Cloud Security Alliance's AI Trustworthy Pledge, a public commitment rather than an audit.
- No ISO 27001, SOC 2 or Cyber Essentials certification. See our security page for what we do instead.
Frequently asked questions
What questions should I ask an AI development company?
Who will do the work, what similar AI they have shipped, how they measure quality, where your code and data will live, how they use AI coding tools, the total cost, the trial and replacement terms, and who owns the result.
How do I know an offshore AI team is any good?
Interview the named engineers, ask how they tested a past project, and run a short paid trial on real work, judged against your own test set.
Do I need a provider with ISO 27001 or SOC 2?
Only if your buyers, regulators or own policies require it. If they do, ask for the certificate or report itself. If not, ask for the contract terms and working rules that protect your code and data instead.
How many providers should I compare?
Three to five is usually enough. Send them all the same questions in writing, so the answers compare.
Should the trial be paid?
A short paid trial on real work gives the most honest picture. With us, there is no charge if you stop in the first five working days.
Sources
Checked on 30 October 2026. Webify.AI figures are our published prices.
Put our answers to the test
Tell us the role and when you need someone. We'll email two named engineers with their experience and availability within 48 hours, and you choose who to interview.
- No cost to receive profiles
- Two-week trial with the developer you choose. No charge if you stop within the first five working days.
- Invoiced in USD, GBP, EUR, CAD or AUD by local transfer; IP assigned to you.