Security questions to ask a software development partner, and the evidence behind good answers

This guide is for founders, CTOs, security leads and procurement teams shortlisting a partner that will write code for them. Our software development outsourcing guide covers cost, team models and the wider vendor checklist; this page goes deeper on one row of it: security. It is general guidance, not a security audit.

In this guide

• Why a development partner needs different questions
• Twelve questions and the evidence to ask for
• What certificates prove, and what they do not
• How to run the security review
• Red flags
• AI coding tools: three questions to add
• Alternatives and selection criteria
• How Netbase answers these questions
• What delivery record exists, and what does not
• Limits of this guide
• Frequently asked questions
• Next step

Why a development partner needs different questions

A software vendor sells you a finished product. A development partner builds your product with you, which changes where the risk sits. Its engineers push code to your repositories, deploy to your cloud accounts, read your specifications and sometimes see production data. Their laptops, accounts and tools become part of your attack surface, and the code they write becomes your product's security.

So a partner review has two halves. The first is enterprise security: how the company protects itself, its staff and its systems. The second is product security: how the software it builds for you is designed, reviewed, tested and maintained. CISA and the FBI make the same distinction in their Secure by Demand guide for software buyers, and they stress product security, not only the vendor's own controls. Most generic vendor questionnaires cover the first half well and the second half poorly.

Twelve questions and the evidence to ask for

Two items on that list are newer than most questionnaires. On components, CISA, the NSA, the FBI and international partners published the 2026 Minimum Elements for a Software Bill of Materials on 29 July 2026, replacing the NTIA elements of 2021; asking for an SBOM is now a mainstream request, not an exotic one. On AI tools, see the section below.

What certificates prove, and what they do not

ISO 27001 certification and a SOC 2 report are useful signals, but they answer narrower questions than buyers often assume.

• They cover the company, not your product. An information security management system or a set of audited controls says how the vendor runs itself. It does not certify the application the vendor builds for you, or your hosting.
• Scope matters. Ask which entities, locations and services the certificate or report covers, and whether your delivery team works inside that scope.
• Type matters for SOC 2. AICPA's illustrative SOC 2 Type 2 report shows that a Type 2 report includes the auditor's tests of controls and their results over a period, not only a description of the controls.
• Dates matter. A certificate expires and a report covers a past period; ask for the current one.

A partner without a certificate can still practise security well, and a certified partner can still ship insecure code. Use certificates to shorten the review, never to skip the product questions.

Red flags

• Answers that name tools but cannot show their output.
• Shared logins, or access that is never removed.
• Your code held in the vendor's repositories and accounts, not yours.
• No written process for incidents, or no one who owns it.
• Real customer data copied into test environments by default.
• Security testing offered only as an optional extra at the end.
• A certificate presented as if it covered your product.

AI coding tools: three questions to add

AI-assisted engineering is now normal, including at Netbase, and it adds three questions. First, which tools may see your code, and are they configured so your inputs are not used to train shared models? Second, is every AI-suggested change reviewed by a named engineer and covered by the same tests and scans as human code? Third, may you switch AI assistance off for sensitive repositories? A partner that cannot answer these clearly has not thought about where your code goes. Netbase works with the major commercial and open-source AI tools and models, chosen per project, and every AI-assisted change stays under human review.

Alternatives and selection criteria

Choose by four criteria: the sensitivity of the data the team will touch, whether the vendor will access production, the contract's size and length, and whether your sector sets its own rules.

How Netbase answers these questions

Netbase's security practices are secure code review and version control, TLS in transit and AES at rest, role-based access control, MFA for admin dashboards, vulnerability scanning and penetration testing, and disaster recovery. Contributors work under NDA, and NDAs, data processing agreements and SLAs are available to clients on request. Netbase follows GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling and CCPA compliance practices for clients with U.S. customer bases.

Netbase holds ISO 27001 certification and a SOC 2 Type II attestation. Both cover Netbase's own operations, not a client's product or hosting, and certificate details are shared during due diligence rather than published. In Netbase custom development the client owns the IP created for it, while Netbase productized modules and Business Division products are licensed, not transferred; our guide to protecting IP when outsourcing covers those clauses. Most Netbase projects are delivered on fixed-price contracts agreed after discovery, and the same security terms apply to dedicated development teams; see dedicated team vs fixed price for the trade-offs. The full statement is on security and compliance.

What delivery record exists, and what does not

• What exists. Since 2020 Netbase has worked as offshore development and managing partner on a multi-tenant cloud ERP for a US client, sold as SaaS to small and mid-sized businesses; the public record withholds the client's name. Netbase also builds and runs its own SaaS, Printcart.
• What does not. No published Netbase record states penetration-test results, incident history, audit findings or response times, and neither record above is evidence of any particular control. Netbase does not publish certificate numbers, dates, auditors or scope.

Limits of this guide

• It helps you choose a partner; it does not test your application. For that, see application security assurance.
• Regulated sectors such as payments or healthcare add their own requirements; take specialist advice.
• Standards change: check the current ASVS, SSDF and SBOM guidance on the day you review.
• For governing security release by release once work starts, see software quality governance for outsourced delivery.

Next step

Send us your security questionnaire or the questions above, and we will book a solution review to walk through our answers with the engineer who would lead your project. You can also browse more Netbase insights.

Related services and solutions