What contracts should I expect from a nearshore vendor?

Three minimum: (1) Master Services Agreement (MSA) — overall terms, IP assignment, liability, termination. (2) Statement of Work (SOW) — per-project scope, deliverables, pricing, timeline. (3) Data Processing Addendum (DPA) — GDPR-compliant terms, sub-processors disclosed, audit rights. For US clients add: Standard Contractual Clauses (SCCs) for cross-border data transfers, BAA for HIPAA-covered work, security questionnaire (SIG or CAIQ) on request. Vendors who push back on standard contracts are red-flagged.

How long should a vendor evaluation take?

3-5 weeks total. Week 1: shortlist 5-7 vendors based on portfolio fit. Week 2: 30-min discovery calls with each. Week 3: deep-dive technical interviews with 2-3 finalists, including a paid 4-hour scoping engagement. Week 4: reference calls (3 per vendor minimum, including one ex-client). Week 5: contract negotiation with the winner. Cutting this to 2 weeks is a common mistake — you skip reference checks and pay for it later.

What are the most common contract red flags?

Top 6: (1) IP assignment is conditional on full payment of all open invoices (creates leverage). (2) Non-solicit of vendor's engineers extends 24+ months (locks you in). (3) Termination requires 60-90 days notice (hostage rule). (4) No SLA on response times or sprint commitments. (5) Sub-processor list is missing or vague. (6) Liability cap is below 1x annual fees. Negotiate all six before signing.

Should I do a paid trial before committing?

Yes, almost always. A 2-4 week paid scoping or prototype engagement at $8-25k tells you more than 10 reference calls. You see actual code quality, communication cadence, project management discipline, and how the team handles ambiguity. Real vendors want this — it's how they qualify you too. Vendors who refuse paid trials and only sell big retainers are flag-worthy.

What questions should I ask in vendor reference calls?

Five questions that work: (1) What was the engagement that almost didn't work, and how did they fix it? (2) Who specifically on the team would you hire again? Who wouldn't you? (3) How did they handle the moment scope went out of control? (4) On a scale of 1-10, how proactive were they about flagging risks before you noticed? (5) Did the senior they sold you stay through the engagement, or did you see rotation? Reference calls under 20 minutes are not real reference calls.

How to Choose a Nearshore Software Development Partner (2026 Checklist)

Q: What's the most important criterion when choosing a nearshore software development partner?

Senior engineering retention. Vendors that can't keep their best engineers for 3+ years end up rotating you through a churn pipeline. The senior who interviewed you in month 1 leaves in month 9, gets replaced by a mid promoted to senior, code quality drops, you don't notice for 3 more months. Retention is the single best predictor of long-term delivery quality. Ask for average tenure across senior IC roles — under 2 years is a red flag.

Q: Should I pick a nearshore partner based on hourly rate?

No. Hourly rate is the worst single metric. The same $60/h can mean 1 senior engineer at full productivity or 2 mid-levels at half-productivity each. Ask for fully-loaded cost per outcome (cost per shipped feature, cost per sprint), not per hour. The cheapest hourly rate often produces the most expensive total cost of ownership, especially for compliance-heavy or regulated work.

Choosing the wrong nearshore partner doesn't just slow you down. It burns 6-12 months of runway, ships you a codebase you'll need to rewrite, and leaks IP you'll spend years trying to recover. This guide is the diligence framework I'd hand a US CTO or VP Engineering evaluating Polish, LATAM or CEE nearshore vendors. 12 evaluation criteria, a scoring rubric, a decision tree, and the contract red flags I'd negotiate before signing.

Where you are in the funnel matters. If you're still figuring out whether nearshore is the right model at all, start with our pillar: nearshore software development USA. If you've already decided on Poland and want to compare it to other countries, see our best countries for software development 2026 hub. This page assumes you've decided to evaluate nearshore vendors and want a checklist.

TL;DR, vendor evaluation

Score 5-7 vendors across 12 criteria. The single best predictor of long-term quality is senior engineer retention (3+ years average), not hourly rate, not portfolio size, not certifications. Always do a 2-4 week paid trial. Reference calls under 20 minutes are not real reference calls.

5-week evaluation: shortlist → discovery → technical → references → contract
Paid trial ($8-25k) tells you more than 10 reference calls
6 contract red flags to negotiate before signing
Decision tree at the bottom

12 evaluation criteria (with scoring rubric)

Score each vendor 1-5 on every criterion. A combined score of 50+ out of 60 is a strong yes. 40-50 is "negotiate further". Under 40 means the vendor isn't a finalist.

1. Senior engineer retention (weight: 3x)

Ask: "What's the average tenure of your senior engineers? Show me the team sheet of any client who's been with you 3+ years."

Vendors with under 2-year average tenure have a senior churn problem. The senior who interviews you leaves in month 9, gets replaced by a mid promoted to senior, code quality drops invisibly. Polish vendors typically average 3-3.5 years; Ukrainian pre-2022 was 2; Indian outsourcing firms often 12-18 months. Triple-weight this criterion.

2. English fluency at senior tier (weight: 2x)

Ask: "Can I have a 30-min unscripted call with a senior IC engineer (not a sales lead, not a PM) to discuss a technical problem?"

If the vendor pushes back on this, the answer is no. CEFR B2+ should be a baseline. C1 is realistic for senior tier. Polish seniors are usually C1; Spanish-speaking LATAM seniors range B2-C1. Sales people speak great English everywhere — that's not the test. The engineer who'll write your PR descriptions is the test.

3. Compliance posture (weight: 2x for regulated)

Ask: "What's your SOC 2 / HIPAA / PCI DSS experience? Can you walk me through how you handle a Subject Access Request under GDPR?"

For regulated industries (healthcare, fintech, gov), this is non-negotiable. EU vendors operate under GDPR by default, which is stricter than CCPA and similar to SOC 2 Trust Services Criteria. Ask for a redacted SIG or CAIQ they've completed for an enterprise client. Vendors who can't produce one have never been through a real audit.

4. Timezone overlap (weight: 1.5x for sync work)

Ask: "What hours will my team actually overlap with the engineers, not the PM?"

Polish team typically flexes to 11am-7pm Warsaw, giving 5am-1pm EST overlap (4 hours). LATAM same-day overlap with PST. Ukrainian similar to Polish. Asian offshore offers 1-3 hours of overlap with US East Coast. If your workflow is async-first, this matters less. If you do daily live pair-programming, this matters a lot.

5. Reference depth and willingness

Ask: "Can I talk to 3 references: one current client of 12+ months, one 12+ months client whose engagement ended, and one engagement that almost failed and how you fixed it?"

Vendors who only offer current happy clients are filtering. The most useful reference is the engagement that hit a wall and recovered — it tells you how the vendor handles real adversity, not the easy path.

6. Senior tech-lead seniority and visibility

Ask: "Who's the senior tech lead on my engagement, and can I see their LinkedIn / GitHub / portfolio before signing?"

Many vendors do "bait-and-switch": you meet a senior, sign the contract, get a different mid-level. The fix: name the tech lead in the SOW, with a clause that replacement requires 2-week notice and your approval.

7. Pricing transparency

Ask: "What's included in the hourly rate? Show me the math."

Should include: developer time, daily standups, code reviews, sprint planning, retros, demos, documentation. Should NOT include: cloud infra (passed through at cost), 3rd-party licenses, travel. Hidden margins on infra are a common gotcha. See our full nearshore rates 2026 guide for what's normal.

8. Engagement model flexibility

Ask: "Can we scale up by 2 in 4 weeks? Can we scale down by 2 with 30-day notice? Can we switch from staff augmentation to dedicated team mid-engagement?"

Real vendors say yes, with reasonable terms. Vendors who lock you into multi-year minimums or 90-day notice periods are protecting their bench economics, not your business.

9. Technical due diligence quality

Ask: "Before quoting, will you spend 3-5 days on a paid technical discovery to write a real proposal?"

Vendors who quote without seeing your codebase are guessing. A real proposal includes: team composition, week-by-week plan, identified risks, fallback options. Cost: $5-15k. Worth every dollar — it's also how you evaluate them.

10. Domain experience (vertical match)

Ask: "Show me 3 case studies in my exact vertical, not 'similar' verticals."

If you're building healthcare software, FHIR R4 + HL7 + HIPAA experience matters. A vendor who's done 3 healthcare projects beats one who's done 30 generic SaaS projects. Generic depth is not vertical depth.

11. Stack and architecture experience

Ask: "Have you delivered on my exact stack at scale (production traffic, not prototypes)?"

Be specific: not "we know React" but "we've shipped React + Next.js apps with 100k+ DAU, here's the case study". Stack mismatch costs 2-3 months of ramp-up that nobody bills you for, but you pay for in delays.

12. Cultural and communication fit

Ask: "How do your engineers handle disagreement with the client?"

Polish engineering culture is direct and will push back on bad requirements. Indian outsourcing culture historically defers more. LATAM is mixed. Neither is universally better — but match your team's comfort. If you want yes-men, don't hire Polish. If you want passive execution, don't hire Polish either.

5-week evaluation process

Week 1: Shortlist (5-7 vendors)

Sources: Clutch, GoodFirms, LinkedIn, founder peer referrals, conference talks. Filter by: size (matched to your engagement), vertical experience, geographic location. Don't shortlist on logo recognition — small focused vendors often outperform big-3 outsourcing firms on quality, especially for sub-15-engineer engagements.

Week 2: Discovery calls (30 min each)

Goal: filter from 5-7 to 2-3 finalists. What you're testing: how they qualify YOU. Real vendors ask you about scope, success metrics, current pain. Sales-heavy vendors lecture you about their process. Discovery should feel collaborative, not promotional.

Week 3: Technical deep-dives (2-3 hours each)

Get the real tech lead on a call. Walk through your existing codebase or architecture diagram. Ask them to spot 3 problems and propose 3 solutions — live, no prep. This separates vendors who can think from vendors who can pitch.

Week 4: References (3 per finalist, 30+ min each)

Use the 5 questions from the FAQ below. Talk to one ex-client minimum. Ask for the names of specific engineers — confirm they're still at the vendor (LinkedIn check).

Week 5: Paid trial / scoping engagement

2-4 weeks, $8-25k. Real engagement on a real problem. You see actual code quality, communication cadence, PM discipline. This is where 80% of bad-fit reveals happen. Vendors who refuse this in favor of long retainer commitments are filtering.

6 contract red flags to negotiate before signing

IP assignment conditional on full payment. "All work-for-hire transfers on full payment of all open invoices" creates leverage if a dispute arises. Push for assignment on individual invoice payment, per deliverable. More red flags here.
Non-solicit of vendor engineers extends 24+ months. Reasonable: 12 months. 24+ months is hostage rule. Negotiate down to 12 with a buy-out clause (e.g., 3 months of vendor's billing rate to convert).
Termination requires 60-90 days notice. Reasonable: 30 days for staff augmentation, 30-60 days for dedicated teams. Anything longer is bench-economics protection.
No SLA on response times or sprint commitments. Sprint velocity should be a measurable KPI. Response times to critical issues should be explicit (4 hours / 24 hours).
Sub-processor list missing or vague. Required under GDPR. Vendor must disclose all sub-processors handling your data. If they can't, they're not GDPR-compliant.
Liability cap below 1x annual fees. Standard is 1-2x annual fees, with carve-outs for IP infringement and gross negligence. Vendors pushing 0.5x or 50% caps know something you don't.

Decision tree: when to pick which model

Pre-seed / pre-PMF, 1-2 engineers, 6 weeks runway: hire a freelancer through a platform. Don't engage an agency. See alternatives to Toptal for platform options.
Seed / Series A, need 3-5 engineers fast, 6-12 month horizon: nearshore agency with dedicated team or staff augmentation. Polish or LATAM both work — pick on timezone preference. See dedicated team or staff augmentation.
Series B+ or post-PMF mid-market, scaling 5-15 engineers, 24+ month horizon: dedicated team with senior tech lead from the vendor. Negotiate retention guarantees and named engineers in the SOW.
Regulated industry (healthcare, fintech, gov), any stage: EU-based vendor with GDPR baseline. Polish, German or Portuguese vendors all work. Avoid offshore for compliance-critical work — the timezone gap kills audit response.
Legacy modernization (.NET, PHP, Java monolith): agency with strangler-pattern experience. Avoid big-3 outsourcing firms — they tend toward big-bang rewrites that don't ship. See legacy modernization.

FAQ

What's the most important criterion?

Senior engineer retention (3+ years average tenure). It's the best single predictor of long-term delivery quality. Triple-weight it in scoring.

Should I pick on hourly rate?

No. Hourly rate is the worst single metric. Ask for fully-loaded cost per outcome (cost per shipped feature, cost per sprint), not per hour.

What contracts should I expect?

MSA + SOW + DPA minimum. For US clients add SCCs, BAA for HIPAA work, SIG/CAIQ on request. Vendors who push back on standard contracts are flagged.

How long should evaluation take?

3-5 weeks. Cutting to 2 weeks skips reference checks and paid trials — you pay for it in months 4-9 of the engagement.

Should I do a paid trial?

Yes, almost always. 2-4 weeks at $8-25k. Tells you more than 10 reference calls. Vendors who refuse paid trials are filtering.

Want a vendor that survives this checklist?

15+ years, 140+ B2B projects, 3.5y average senior tenure, EU GDPR baseline, BAA-ready for US healthcare. We earn renewal every month.

Book a 45-min scoping call →