Checklist
Development vendor evaluation checklist
Questions worth asking any development vendor, including us. Tick items off as you go; nothing here is a download.
4 sections, 16 items
For enterprise
A development partner that procurement can approve
We answer security questionnaires, sign data processing agreements, invoice on net-30 terms and agree custom SLAs. You contract with a US company and work with a named team sized to your roadmap.
What enterprise teams need from a vendor
Good engineering is only part of it. Large organizations also need a vendor that fits their review and payment processes.
- Security review
- Your security team needs detailed answers about access control, data handling and incident response before any code is written.
- Contract and data terms
- Legal needs a DPA, clear IP terms and confidentiality obligations that match your standards.
- Procurement and payment
- Finance needs a vendor that can be onboarded, accepts purchase orders and invoices on standard terms.
- Integration with your identity and systems
- Apps must work with your identity provider, logging and internal systems, not sit beside them.
Typical challenges in detail
How each of these problems usually shows up, and what we change in response.
ChallengeWhat it looks likeWhat we do about it
- Security review
- What it looks likeA long questionnaire, follow-up evidence requests and a review board that meets monthly, all before a vendor can touch code.
- What we do about itWe answer in writing, describing the practices we actually follow, and say plainly where we don't meet a requirement rather than overstating. Access always runs through accounts you control.
- Contract and data terms
- What it looks likeLegal needs a DPA, IP assignment and confidentiality terms that match your standards, and vendor templates rarely do.
- What we do about itWe review your master services agreement and DPA and propose changes only where needed, or provide our own templates if you prefer.
- Procurement and payment
- What it looks likeThe vendor must be set up in your procurement system, accept purchase orders and invoice on standard terms before work starts.
- What we do about itWe provide a completed Form W-9 and the company details your vendor system asks for, and invoice on net-30 terms with your PO numbers on every invoice.
- Integration with your identity and systems
- What it looks likeApps must use your identity provider, send logs to your monitoring and live in your cloud accounts, not run beside them.
- What we do about itWe build SAML or OIDC sign-in, send logs where your security team wants them, and deploy into accounts and regions you choose.
Vendor onboarding, step by step
We've set our processes up to move through enterprise onboarding without long delays. A typical sequence looks like this.
- 01
Scoping call
We meet with your product and engineering leads to understand the roadmap and size the team.
- 02
Security and legal review
We complete your security questionnaire, review your DPA or provide ours, and agree on contract terms.
- 03
Vendor setup
We provide a completed Form W-9, remittance details and the company information your vendor management system asks for.
- 04
Order and kickoff
A statement of work or purchase order is issued, access is provisioned through your identity provider and work starts.
How plans map to stages
Most teams change plans as they go. This is the usual path; you can move up or down at the end of any billing period.
StageTypical planWhat's in scopeMove on when
Evaluation and vendor onboarding
Typical planBefore any plan
What's in scopeScoping call, security questionnaire, DPA and contract review, Form W-9 and vendor setup.
Move on whenVendor approval and a signed order.
Pilot project
Typical planScale
$1,490 per month
What's in scopeOne product team and one well-defined project, to test the working relationship before a larger commitment.
Move on whenThe pilot shows the working model fits your organization.
Program delivery
Typical planEnterprise
Custom quote
What's in scopeA named team sized to your roadmap, custom SLA and support hours, invoicing against purchase orders.
Move on whenThe roadmap expands to more products or moves into steady operations.
Long-term operations
Typical planEnterprise
Custom quote
What's in scopeMaintenance, incident response and quarterly architecture and cost reviews for the systems we've delivered.
Move on whenReviewed each contract term; handover to your own teams whenever you choose.
Illustrative example, not a client case study
Example engagement
An enterprise product team adds an AI document workflow
Imagine a large company's claims operations team that wants AI to summarize incoming documents. Security requires that data stays in the company's AWS account and that vendor access runs through its identity provider.
Weeks 1 to 3
Review and onboarding
The security questionnaire, DPA review and vendor setup run in parallel with scoping, so the legal process doesn't hold up planning.
Weeks 3 to 4
Access and environment
Our engineers get accounts in the company's identity provider. Claude is enabled through Amazon Bedrock in the company's own AWS account.
Weeks 4 to 10
Build with evaluation
The workflow is built against an evaluation set of anonymized documents, with logs sent to the company's monitoring platform.
Weeks 10 to 12
Internal review and rollout
The company's security team reviews the feature and its data flow document, then it rolls out to one department first.
Where it ends up
Documents never leave the company's AWS account, vendor access can be revoked in one place, and the feature went through the company's own review process before anyone outside the pilot used it.
Your code, accounts and data stay with you
We work in repositories, cloud accounts and tools your organization owns, through access you grant and can revoke. Production data stays in your environment unless a task requires otherwise and you approve it.
What we provide for procurement
Ask your sales contact for any of these during evaluation.
Security questionnaire responses
We complete standard and custom questionnaires describing the practices we follow. See our Security page for an overview.
Data processing agreement
We sign a DPA covering how we handle personal data on your behalf, including subprocessors and breach notification.
Net-30 invoicing
Enterprise plans are invoiced in US dollars with net-30 payment terms, against a purchase order if you use them.
Single sign-on
Our team can access your systems through accounts in your identity provider, and we build SAML or OIDC sign-in into the apps we deliver.
Service level agreement
Custom SLAs with defined uptime, response targets and support hours, building on our standard Service Level Agreement.
Form W-9
As a US LLC, we can provide a completed Form W-9 for your vendor records.
Recommended plans
All work is delivered under a monthly development subscription. These plans suit most teams in your position.
PlanWhy it fitsLink
Enterprise
Custom quote, best fit
A named team sized to your roadmap, security questionnaire and DPA, net-30 invoicing and a custom SLA.
Talk to salesScale
$1,490 per month
For a single product team that needs four parallel requests, AI integration and a 99.9% uptime SLA on hosted apps.
Start with Scale
Common questions
Anything else, ask us on a call.
Do you hold security certifications?
We describe the specific practices we follow in our security questionnaire responses and on our Security page, rather than pointing to a badge. If your process requires particular evidence, tell us during scoping and we'll say clearly what we can provide.
Can we pay by invoice instead of card?
Yes. Enterprise plans are invoiced with net-30 terms in US dollars. We can reference your purchase order numbers on every invoice.
Can you work under our contract paper?
Often, yes. We'll review your master services agreement and DPA, and propose changes only where needed. We can also provide our own templates.
Where is the company based?
PapelSoftware LLC is a US limited liability company. Contracts are with the US entity, and we can provide a Form W-9 for vendor setup.
How do you handle access to production data?
By default we work with test or anonymized data. Where a task needs production access, it's granted through your identity provider for that task, logged, and removed afterward, and data stays in your environment.
Do you work with regulated data, such as health or payment card data?
Tell us during scoping. We'll describe the practices we follow and be clear about any requirement, such as a specific certification or agreement, that we can't meet, so you can decide before any work starts.
Services you'll likely use
All services
Web applications
Customer portals, dashboards and SaaS products built on Next.js and TypeScript.
AI integration
Assistants, search and document workflows built on Anthropic's Claude.
Cloud and DevOps
AWS infrastructure, CI/CD pipelines and cost reviews.
Maintenance and support
Dependency upgrades, bug fixes and on-call coverage for live apps.
Looking for something else?
Tell us what you're building.
A 30-minute call with an engineer, not a sales script. You'll leave with a scope, a plan recommendation and a start date.