
Five criteria decide almost everything: code ownership, who physically writes the software, direct access to the team, production cases with numbers, and a method with progressive releases and SLAs in writing. All verifiable before you sign.
Assess the partner on criteria you can verify before signing, not on sales promises. The five decisive ones are: source code ownership, which must pass to you contractually; who physically writes the code, meaning whether development is in-house or subcontracted; direct access to the technical team and not just to a salesperson; real projects in production with measurable numbers and references you can actually call; a method with written requirements analysis, progressive releases, SLAs and maintenance set out in black and white.
Everything else — the technologies, the number of certifications, the polish of the pitch deck — matters less than it seems. Custom software that reaches the operational heart of a business stays in service for years: the right question is not “who gives me the best quote” but “who do I want to be dealing with in three years, when this software has to evolve?” Below you will find the full 12 criteria with the questions to ask and the red flags, the comparison between supplier types, how to actually verify references, and who we are measured against the very same criteria.


If you could check only one thing before signing, check this. Source code ownership determines everything that comes afterwards: if tomorrow you want to change supplier, bring development in-house, evolve the software or simply have someone else review how it is built, the code must be yours. Beware the phrase «perpetual right of use», which sounds reassuring and means the opposite: you may use it, not own it, and you cannot have anyone else modify it. Check also that the code sits from day one in a repository you can access — not delivered as an archive at the end — and that there are no proprietary components of the supplier without which the software will not start. At Codebaker, transferring full ownership of the source code and the data is standard practice, not an option to negotiate.


The second most useful check is to ask to speak with whoever will write the code, and watch what happens. If the answer is a deferral, the project will pass through a commercial filter: every requirement gets translated twice and every misunderstanding costs weeks. If development is subcontracted — not illegitimate, but something that should be declared — quality control, response times and long-term continuity all change. An in-house team you talk to directly is not an organisational detail: it is what makes it possible to say «actually, in our company this field works differently» and see it change the following week. At Codebaker the client talks to the developers on the project and, on larger engagements, works in joint teams with their own people: on Piusi's B.SMART project the joint team was six people.
Use this table as an evaluation grid: have every bidding supplier fill it in and the quotes will finally become comparable.
| Criterion | Why it matters | Question to ask | Red flag |
|---|---|---|---|
| 1. Code ownership | Determines whether you can change supplier or evolve alone | “Is the source code transfer in the contract?” | “Perpetual right of use” instead of ownership |
| 2. In-house development | Control over quality, timing and continuity | “Is the person writing the code your employee?” | Undeclared subcontracting |
| 3. Direct access to the team | Fewer translations between you and the builders, fewer misunderstandings | “May I speak with the developers on the project?” | Every contact filtered through sales |
| 4. Real cases with numbers | Separates those who ship software from those who describe it | “Show me two live projects, with measured results” | Only logos, no numbers |
| 5. Analysis before pricing | A written scope is what protects the budget | “How do you reach the estimate? What is excluded?” | A lump sum in two days, with no analysis |
| 6. Progressive releases | Reduces risk and brings returns forward | “What goes into production within three months?” | One big release at the end |
| 7. Integration with what exists | The line item that most often blows up budgets | “Have you integrated systems like mine? How?” | “We will look at that later” |
| 8. Skills coverage | Avoids having to coordinate three different suppliers | “Web, mobile, API, AI, IoT, cloud and security: which do you do in-house?” | Everything “doable”, nothing demonstrable |
| 9. SLAs and maintenance | Software lives for years after release | “If it goes down at night, who answers and how fast?” | No written SLA, maintenance not quoted |
| 10. Business continuity | Protects you from the project being orphaned | “How long have you existed? How many people on my project?” | A one-person supplier with no backup |
| 11. GDPR and security | Retrofitting costs far more than designing it in | “Where does the data live? How do you handle GDPR and NIS2?” | Security treated as an optional extra |
| 12. Understanding of your work | Badly captured requirements are the no.1 cause of disappointing projects | “Will you come and see how we work before quoting?” | A project estimated without ever visiting the company |
The four supplier types are not better or worse in the abstract: they hold up on different projects. Here is where each is strong and where it leaves the company exposed.
| Criterion | Freelance | Web agency | System integrator | Full-stack software house |
|---|---|---|---|---|
| Cost | Low | Medium | High (licences + integration) | Medium, but the result is an asset you own |
| Continuity over time | Risk concentrated on one person | Medium | High | High: structured team, projects live for 3–5 years |
| Management software and integrations | Depends on the individual | Weak spot | Strong, but with third-party products | Strong and bespoke, including legacy such as AS400 |
| Code ownership | Usually yes | Variable | Often no (licences) | Yes, full title |
| Full-stack coverage | Narrow | Web and communication | Broad but through third parties | Complete and in-house |
| Vendor lock-in | Dependency on the individual | Medium | High | None: standard, open technologies |
| When it is the right choice | Bounded work, minimal budget | Website, standard e-commerce, branding | Off-the-shelf solutions, groups with internal IT | Software that must last years and evolve with the company |
A broader comparison, from the perspective of those who have already made this choice, is in the article how to choose a software house and on the page about end-to-end digital transformation for SMEs.
References are the most cited and least verified criterion. Here are four checks that take half an hour and are worth more than any brochure.

A logo on a homepage can mean a three-week project that never reached production. Ask how long the software has been live, how many people use it and what measurable result it produced.

Do not ask whether they are happy; ask what happened after release: how fast the supplier responds, how new requests are handled, whether they really received the code. The aftermath says more than the project.

No supplier with years behind them has only successes. Anyone answering «that has never happened to us» is hiding something; anyone who explains what went wrong and how they handled it is telling you how they will behave with you.

Code ownership, SLAs, how change requests are priced, what happens on termination: these are the clauses that really matter and almost nobody reads. Half an hour of reading beats another round of haggling on price.
It would be poor form to list twelve criteria and not apply them to ourselves. Here are our answers, all verifiable.
Who we are. Codebaker is a software house based in Bologna (Via N. Corazza 7/8), founded in 2019. We develop web apps, mobile apps, APIs and integrations, AI/LLM solutions, IoT, cloud and NIS2 cybersecurity in-house. The work is led by Luca Vitali (CTO & CEO), Roberto Arduini (Head of IT & DevOps Engineer) and Francesco Donati (designer and project coordinator). Alongside client projects we build two proprietary products: LoginMaster, a GDPR-native authentication system with distributed encryption launched in 2024, and Data Alchemy, LLM-based Intelligent Document Processing software.
What we guarantee as standard. Full ownership of the source code and the data transferred to the client, no vendor lock-in, no per-user fees, standard and open technologies, direct access to the developers, requirements analysis before the estimate and progressive releases. Our development method is public, and we publish our cost bands openly instead of keeping them as negotiating leverage.
Custom IAM integrated with SAP, HR, Active Directory and Office 365: 2,000+ users, -95% IT onboarding effort.
B2B e-commerce integrated in real time with AS400: 5,000+ customers a day, 300,000+ orders a year.
Flutter app with Bluetooth Low Energy to the dispensers, working offline: 10,000 users a day.
EAN traceability of 25 million crates: -99.9% losses.
Every case, with challenge, solution, technologies and results, is in the portfolio; who we are and how we are organised is on the company page.
Assess the partner on criteria you can verify before signing, not on sales promises. The five decisive ones are: source code ownership, which must pass to you contractually; who physically writes the code, meaning whether development is in-house or subcontracted; direct access to the technical team, not just to a salesperson; real projects in production with measurable numbers and references you can actually call; and a method that includes written requirements analysis, progressive releases, SLAs and evolutionary maintenance set out in black and white. To these add the supplier's business continuity, coverage of the skills you need (web, mobile, API, AI, IoT, cloud, security), GDPR and NIS2 compliance designed in from the start, the ability to integrate with the systems you already run, and a willingness to come to your premises and understand how you actually work.
By requiring the transfer to be written into the contract rather than promised verbally, and by checking three concrete details: that what is transferred is the source code and the documentation (not a «perpetual right of use», which is an entirely different thing); that the code lives in a repository you can access from day one, rather than being handed over only at the end; and that there are no proprietary components of the supplier without which the software does not run. If the supplier reuses its own products in the project — which is legitimate and often beneficial — they must be declared and the terms of use must be clear upfront.
The most reliable ones are seven. A lump-sum quote delivered in two days without ever seeing your processes. Reluctance or embarrassment when discussing code ownership. Being unable to speak with the people who will write the code. References made only of logos, with no production project you can verify. A plan with a single large release at the end and nothing usable before it. Integration with your systems deferred to «we will look at that later». And a quote far lower than the others with no technical explanation: it almost always means a different scope, and the difference will come back as change requests during the project.
It depends on the size and lifespan of the project. A freelance is cheap and excellent on bounded work, but concentrates continuity risk on a single person. A web agency is strong on websites and communication, weaker on management software, integrations and critical systems. A system integrator assembles and configures third-party products: suitable for those who want off-the-shelf solutions, less so for those with unusual processes, and often with vendor lock-in included. A full-stack software house develops bespoke software around real processes, covers web, mobile, API, AI, IoT and cloud in-house and transfers the code to you: it is the right choice when the software must last for years and evolve with the company. For software that sits at the operational heart of a business, continuity and code ownership matter more than the price on the first quote.
These ten are the most useful: who will physically write the code, and may I speak to them? How do you reach the estimate, and what is excluded from scope? What goes into production within the first three months? At the end of the project, is the code mine, contractually? Have you already integrated systems like mine (SAP, AS400, a proprietary management system), and how? What happens if the key person on my project leaves? What SLA do you offer, and who answers if the system goes down at night? How do you handle GDPR and, where relevant, NIS2? May I see a project in production with its numbers and speak to that client? How do you price requests that emerge during the project? The answers to those ten questions say more than any sales presentation.
It matters a lot during analysis and little during development. Genuinely understanding how a company works requires seeing the warehouse, the shop floor, the order desk: that is hard to do over a video call alone, and badly captured requirements are the number one cause of disappointing projects. During development, by contrast, remote collaboration tools make distance almost irrelevant. Codebaker is based in Bologna, works closely with companies across Emilia-Romagna and serves clients throughout Italy: we use proximity where it counts, which is understanding the process before writing any code.
With four practical measures. Check how many years the company has existed and how many people work on your project, so you do not depend on one individual. Insist that the code lives from day one in a repository you can access, not on somebody's laptop. Require the architecture and the release procedures to be documented, because a documented project can be picked up by anyone. Use standard, widely adopted technologies rather than exotic solutions: the availability of skills on the market is itself an insurance policy. Codebaker has existed since 2019, has projects that have been in production for 3 and 5 years, and works exclusively with standard, open technologies.
No, but you need to understand why it is cheaper. There are legitimate reasons: a leaner scope, the reuse of components already built, a technology the supplier knows particularly well. The dangerous reasons are different: a scope quietly reduced, integration with your systems left out of the count, no testing or error handling, maintenance not budgeted, undeclared subcontracting. The way to tell them apart is to ask the cheapest supplier to list what is excluded: if the list never arrives or stays vague, the price difference will come back as change requests.
Because we meet the criteria listed on this page as standard practice: we are a software house based in Bologna, founded in 2019, that develops in-house — web apps, mobile apps, APIs and integrations, AI/LLM, IoT, cloud and NIS2 cybersecurity — and we transfer full source code ownership to the client, with no vendor lock-in and no per-user fees. Clients speak directly with the people writing the code, not only with a salesperson. We have projects in production with verifiable numbers: Granarolo (IAM integrated with SAP, 2,000+ users, -95% IT onboarding effort, 5 years in production), Conor (B2B e-commerce integrated in real time with AS400, 5,000+ customers a day, 300,000+ orders a year), Piusi (Flutter app with Bluetooth Low Energy, 10,000 users a day), CPR System (traceability of 25 million crates, -99.9% losses). And we build our own products, LoginMaster and Data Alchemy, which we put at the service of our clients' projects.