How to Choose a Software Development Company in Canada
If you are working out how to choose a software development company in Canada, start with a question most buyers leave too late. What will your own customers ask about the software after it is built? Most firms look similar on price and portfolio. The differences show up later, when a customer sends you a security questionnaire or asks where their data is stored. Here is how to compare firms, and ten questions to ask on the first call.
Start with what your customers will ask you
If you sell to universities, hospitals, government, or large companies, your software will be reviewed before they buy. A university may send a HECVAT, which is a long security questionnaire for vendors. A larger customer may ask for a SOC 2 report. A healthcare customer in Ontario will ask how you handle personal health information under PHIPA. Private-sector customers will ask how you handle personal information under PIPEDA, and under Quebec's Law 25 if you handle the personal information of people in Quebec. Public bodies will ask the same questions under their own privacy laws.
A firm that has never seen these reviews can build software that works but is hard to get through a security review. You then pay a second time to add the logging, access controls, and documentation that should have been there from the start. So ask early whether the firm has built software that went through this kind of review.
Find out who will do the work
Some firms send senior people to the sales call and hand the project to a different team once the contract is signed. That team may be more junior, or in another country. Ask to meet the engineers who will write your code. Ask how long they have been with the firm, and whether they will stay on your project to the end.
Offshore work can be fine. Make sure you know where the work is done, who is accountable for it, and who you can call when something breaks.
Ask where your code and data will live
Ask which country your data will be hosted in, and who will have access to it during development. Many Canadian customers, especially in the public sector and healthcare, expect their data to stay in Canada. This usually comes from a contract or a policy. The law itself often does not require it. PHIPA, for example, does not require hosting in Canada. If developers outside Canada can see real customer data, you may have to explain that to your own customers later.
Also ask where the source code is kept and whose accounts it sits in. It should be in accounts you control, from the first day.
Ask to see the work
Be careful with firms that say their software is "PHIPA certified" or "PIPEDA certified". Neither law has a certification for software, and neither privacy regulator issues one. Compliance depends on how the system is built and how your organization runs it.
SOC 2 is different. There is a formal report, but it comes from an independent CPA firm that audits your company and the system you run. Your developer cannot issue one. What a developer can do is build the controls the auditor will test.
Ask to see the work itself. Ask for an example of how they record who accessed what. Ask how they manage passwords and keys, how they test for security problems, and what documents they hand over at the end. A firm with real experience can answer in plain words and show you samples.
Read the contract for ownership and handover
The contract should say that you own the code, designs, and documentation written for you once you have paid for them. It should also say what happens if you part ways: what gets handed over, in what form, and how fast. Ask how open-source parts and the firm's own existing tools are licensed to you. Have your lawyer read it.
Ask what support looks like after launch. Software needs updates and security fixes for as long as it runs. If a firm has no plan for the second year, you will be looking for someone else to maintain the software.
Compare price the right way
A fixed price gives you certainty, but only if the scope is clear. Hourly billing is flexible, but you carry the risk of the work taking longer. Either can work. Ask the firm to explain what is included, what is not, and what would change the cost.
If one quote is far below the others, ask what it leaves out. Security, testing, and documentation are often the first things cut.
Ten questions to ask on the first call
- Who will write the code, and can we meet them before we sign?
- Have you built software that went through a customer security review? Which kind?
- Where will our data be hosted, and who can access it during development?
- Whose accounts will hold the source code and the hosting?
- How do you record who did what inside the system?
- How do you test for security problems before each release?
- What documents do we receive at the end?
- Who owns the code, and what happens if we stop working together?
- What is included in the price, and what would change it?
- What does support look like after launch?
You should get a plain answer to all ten. If several answers are vague, keep looking.
How we approach it
NorthSight Technologies is a software development company in Ontario, Canada. We build custom software for organizations whose customers ask hard questions about security and privacy. Senior engineers scope the work and write the code. We do not audit and we do not give legal advice. We build the software and the records your auditor or customer will ask to see.
If you are choosing a software development company in Canada and want a straight answer on what your project needs, we offer a free 20-minute call. You can read how we work and book the call on our software development and compliance page.