Picking the wrong nearshore vendor doesn't fail visibly. It fails slowly — code quality drops 6-8 weeks before you notice, senior engineers churn, scope creeps, and 9 months in you've burned $400k for an MVP that needs a rewrite. 15 red flags below, in priority order. Each one alone is negotiable. Three or more, walk away.
Where this fits. If you haven't done vendor evaluation yet, start with our 12-point evaluation framework. For pricing context (so you know what's anomalous), see nearshore rates 2026. For the buyer-side US context, see nearshore software development USA.
The 5 highest-impact red flags: (1) Bait-and-switch on tech lead, (2) Blended rate fraud, (3) IP assignment conditional on full payment, (4) Senior tenure under 2 years, (5) Refusal to do paid trial. Each costs you a quarter of runway minimum if it bites.
- 3+ red flags = walk away
- 1-2 = negotiate fixes into the contract
- 0 = move to paid trial
People and team red flags (highest impact)
1. Bait-and-switch on the senior tech lead
The senior who interviews you and is named on the proposal is replaced 4-8 weeks into the engagement by a mid-level engineer with a senior title. Detection: vendor refuses to name the lead in the SOW, refuses pre-contract introductions, or pushes back on a clause requiring 2-week notice for replacement.
Fix in contract: name the tech lead by full name in the SOW. Add clause: "Replacement of named senior engineers requires 14-day prior written notice and client approval."
2. Blended rate fraud
Vendor quotes "senior $60/h" but the team is 1 actual senior at $80/h + 2 mids labeled senior at $50/h, averaged to $60/h. You pay senior money, get mid-level work. The senior is a sales prop.
Fix: demand per-engineer rates and individual CVs. Verify LinkedIn tenure (5+ years for senior). Verify GitHub activity (active contributions, code style). Live English call with each named engineer before signing. Reference rates here.
3. Senior engineer tenure under 2 years average
Vendors with under 2-year senior tenure rotate engineers through your engagement on a 9-month cycle. The senior who shipped Sprint 3 leaves in Sprint 9, replacement is mid promoted to senior, quality drops 6-8 weeks before you notice.
Fix: ask for the team sheet of any client who's been with them 3+ years. If they can't produce one, ask for retention data — average senior tenure across their last 5 client engagements. Polish nearshore typically averages 3-3.5y; Ukrainian was 2y pre-2022; Indian outsourcing 12-18 months. Comparison details.
4. English-only-on-paper
The CV reads beautifully in English. The 30-min unscripted call with the senior reveals CEFR B1 fluency. They struggle with technical disagreement, ambiguity, conditional language. They're capable engineers in their native language; in English they're disabled.
Fix: 30-min unscripted call with each named senior IC engineer (not sales, not PM) before signing. Discuss a real technical problem. If they can't push back fluently, they're not actually CEFR B2+.
5. No introduction to peer engineers (only sales / PM)
The vendor walls off engineers from pre-contract conversations. Sales lead, BD, PM all available. Engineers only after signing. This is bench protection — they're hiding the actual team behind the proposal.
Fix: insist on at least one technical deep-dive call with the proposed senior tech lead, no sales chaperone. If declined, walk.
Contract red flags
6. IP assignment conditional on "full payment of all invoices"
Standard contract: "All work-for-hire transfers to client on payment of the invoice for that deliverable." Trap version: "All IP transfers on full payment of all invoices, current and future, in the engagement." Creates leverage if a payment dispute arises — vendor can withhold IP for an unrelated invoice.
Fix: negotiate down to per-invoice or per-deliverable assignment. Industry standard is per-deliverable.
7. Non-solicit of vendor's engineers extends 24+ months post-engagement
Reasonable: 12 months. 24+ months is hostage rule. Combined with senior tech lead bait-and-switch, this locks you in: even if you want to convert the senior to direct hire, you can't for 2 years.
Fix: negotiate to 12 months with a buy-out clause (e.g., 3 months of vendor's billing rate to convert the engineer to direct hire).
8. Termination requires 60-90 days notice
Reasonable: 30 days for staff augmentation, 30-60 days for dedicated teams. 90 days protects vendor's bench economics, not your business agility. If a project is failing, 90 days locks you into 3 more months of bad work.
Fix: 30 days for staff aug, 60 days for dedicated. With material breach exit clause (no notice if vendor fails delivery SLA).
9. No SLA on response times or sprint commitments
Reputable vendors commit to: 4-hour response on critical issues during work hours, 24-hour response on non-critical. Sprint velocity is a measurable KPI tracked monthly. No SLA = no accountability when things go wrong.
Fix: add SLA exhibit to MSA. Tie missed SLAs to credit on next invoice (1-3% per missed SLA, capped at 10% per quarter).
10. Liability cap below 1x annual fees
Industry standard: 1-2x annual fees, with carve-outs for IP infringement and gross negligence. Vendors pushing 0.5x or 50% liability caps know something you don't — usually about their security, IP cleanliness, or compliance gaps.
Fix: 1x annual fees minimum. Carve-outs for IP, gross negligence, willful misconduct.
Compliance and security red flags
11. Sub-processor list missing or vague
Required under GDPR. Vendor must disclose all 3rd parties handling client data (cloud provider, monitoring tool, helpdesk, password manager, repo). "We use industry-standard tools" is not a list. More on US compliance posture here.
Fix: demand a written sub-processor list in the DPA. Update notification clause for new sub-processors (30-day notice, right to object).
12. No SOC 2 / HIPAA / PCI DSS reference work
For regulated US industries, vendor needs proven compliance experience. "We can do compliance work" without reference engagements means they'll learn on your dime. Compliance audits cost time; learning on the job costs more.
Fix: ask for a redacted SIG or CAIQ they've completed for an enterprise client. Ask for a HIPAA BAA they've signed. Ask for an audit they've passed.
13. Refusal to sign US-aligned contracts (MSA, DPA, SCCs, BAA)
For US clients: SCCs (Standard Contractual Clauses) for cross-border data, BAA for HIPAA work, US-aligned MSA referencing US law (or NY law as default). Vendors pushing only Polish/EU jurisdiction with no US carve-outs are inflexible — that inflexibility extends to delivery.
Fix: insist on US-aligned MSA template. EU jurisdiction is fine for Polish entities; US contract law for the engagement substance is normal for US clients.
Commercial and process red flags
14. Refusal to do a paid trial / scoping engagement
Real vendors love paid trials — it filters bad-fit and showcases real work. Vendors who only sell 12-24 month retainers without prior engagement are usually struggling with churn or quality, and the long lock-in is the only way they retain revenue.
Fix: insist on 2-4 week paid scoping ($8-25k). If declined, walk. More on this in the partner evaluation framework.
15. References are all current / happy clients only
The most useful reference is an engagement that hit a wall and recovered. Vendors who only offer current happy clients are filtering out adversity. You'll never hear how they handle real problems before you sign.
Fix: ask for 3 references — one current 12+ month client, one ex-client, one engagement that almost failed. If they can't produce the second or third, weigh it as a flag.
Related reading
- Nearshore software development USA — pillar
- How to choose a nearshore partner
- Nearshore rates 2026
- Alternatives to Toptal
- Cost of nearshore software development 2026
- How to hire Polish developers
- Nearshore vs offshore
Want to start with a paid scoping, not a 12-month lock-in?
2-4 week paid scoping engagement. Real code, named senior engineers, written deliverables. Credit applied if you continue to a full build.
Book a 45-min scoping call →