Begin with proven experience, not the size of the portfolio. Ask for a couple of engagements that sit close to your technology stack, and then find out whether those engineers are still with the company. An honest provider will introduce you to the tech lead. Answers that name nobody at this stage almost always mean the demo work came from somewhere else.
The paperwork warrants more attention than the sales deck. Three sections matter more than the rest: intellectual property assignment, confidentiality, and notice periods and handover. All the work product must transfer to you once invoices are settled, along with documentation, pipelines and deployment scripts. Watch for language that leaves framework code with the vendor, .net cloud development as this is frequently the part you cannot replace later.
Ask how they estimate. A credible estimate is accompanied by a list of assumptions, a breakdown by feature or module application support and maintenance services an explicit range. A fixed-bid deal works only when the specification is complete; otherwise the vendor adds a risk premium and you fund the buffer regardless. A time-and-materials model shifts that risk to you, so it demands a sprint cadence, laravel vs nodejs demos and a budget cap.
Process matters more than team size. Establish what happens when the scope changes, who writes the acceptance criteria and how testing is organised. A team will be able to demonstrate a live build at the end of each sprint. Acceptance criteria in writing remain the practical protection against endless rounds of rework.
Last, plan for the day you no longer need this vendor at the start rather than at the end. Ask that the code repository sits in your organisation from day one, and that documentation is updated as part of the work. A provider confident in its own work says yes immediately; resistance at this point reveals most of what you need to know.