How to Choose a Software Development Company

Choosing a software development company is closer to choosing a partner than buying a product. At the proposal stage everyone says the same things: experienced team, agile process, on-time delivery. The difference shows up for the buyer who asks the right question before signing.

This post starts with the real shape of the market, using official Turkish statistics, because knowing what most vendors look like tells you which risk you will be managing. Then it covers the pricing models, how to read a quote in person-months, and the technical questions worth asking before you sign.

The commercial side — writing the scope, comparing proposals, verifying the company exists — is covered in detail in how to choose a digital agency. This post focuses on what is specific to custom software.

Short answer: six things to check

1. Who will do the work? Is the person pitching the same person who will write the code, and how many people will know it?
2. Pricing model: who carries the risk of going over budget?
3. Ownership: whose name are the code repository, server account and domain in at handover?
4. Process: how do testing, code review and releases work, and what stops a bug reaching production?
5. Data protection: if personal data is processed, are the responsibilities written into the contract?
6. After launch: who maintains the software, how fast, and at what price?

A portfolio does not replace these six. A good portfolio shows the firm once did good work; it does not show who will work on yours.

The market, by the numbers

In 2025, 44,471 enterprises were active in Türkiye in computer programming, consultancy and related activities (NACE division 62). They employed 216,174 people and turned over TRY 1.03 trillion (TurkStat, Annual Industry and Service Statistics, 2025). The results are provisional and compiled on the NACE Rev. 2.1 classification.

The most telling line is people per enterprise: 4.9 on average. And 12.4 percent of the people counted are unpaid — mostly owners and partners (our arithmetic on the same TurkStat table: 189,289 of 216,174 people are paid employees).

TurkStat publishes the size breakdown only for section K, which also contains telecoms and computing infrastructure, but 84.4 percent of the section's enterprises are software firms. The picture:

It reads simply: 93.5 percent of firms have one to nine people, while 45.2 percent of turnover sits with the 98 firms of 250 or more (TurkStat, 2025). In the smallest group there are 1.7 people per firm on average: 82,730 people across 49,263 enterprises.

So most of the firms you will meet when you look for a software company are one- or two-person teams. That is not bad news. Small teams decide quickly, put you in front of the person doing the work and usually carry less overhead. But the risk is different, and you are the one who has to manage it.

Small firm or large firm?

The right answer depends less on the size of the project than on whether the project can survive without depending on any one person.

Both risks have the same remedy: the code and the knowledge live somewhere that belongs to you, not the vendor. When the code is in your repository, the documents in your folder and the server in your account, the vendor's size becomes a secondary question. What building your own team really costs instead is worked out in agency vs freelancer vs in-house.

Pricing models: who carries the overrun?

Three models are common for software projects:

• Fixed price: the scope is written up front, the price is known, the vendor carries the overrun. The right choice when the scope can genuinely be written down.
• Time and materials: you pay for hours or person-days spent, and you carry the overrun. The honest model when scope is uncertain or the product will take shape along the way.
• Dedicated team: named people work only on your product for a fixed monthly fee. Used for long-running product development as an alternative to hiring in-house.

The most expensive mistake across these is a fixed price on an undefined scope. Either the price changes later or the scope quietly shrinks.

For uncertain projects there is a better route: a short, paid discovery phase first. Over one to three weeks the requirements are written, the screen flows drawn and the technical risks identified. You end up with a document you could take to another vendor, and the fixed price that follows rests on a real scope.

Budget ranges by project type are in our separate posts on mobile app development cost and website development cost.

Read the quote in person-months

The total on a quote says little on its own. What makes it meaningful is the number of person-months behind it. Ask the vendor: "How many people for how many months is this estimate based on?"

To judge the answer you need a reference point, and TurkStat's data provides one:

In 2025, personnel cost per paid employee at a Turkish software firm averaged about TRY 148,700 a month — 2.7 times the economy-wide average of about TRY 56,000. Personnel cost is gross pay plus employer social security contributions. Turnover per person employed in the same division was about TRY 397,100 a month (TurkStat, 2025; per-person and monthly arithmetic ours).

These are not a price list. They average juniors and seniors, sales and administration, product companies and service firms together. And they are 2025 averages; in a period of high inflation, last year's lira figure is not this year's cost.

They do work as a sanity check. If a quote implies a cost per person-month clearly below the sector's average personnel cost, one of three explanations applies:

1. Most of the work will be done by juniors.
2. The team will work on your project part time.
3. The job has been under-scoped, and the difference will return as extra invoices or a narrower scope.

None of these is necessarily bad, but all three should be stated in the proposal. If they are not, that is the problem.

One more caveat from the same table: the sector's purchases of goods and services equal 51.6 percent of its turnover: TRY 531.3 billion (TurkStat, 2025). TurkStat does not break this down; rent, software licences, cloud services and subcontracted work all sit inside it. It is still reason enough to ask: "Will any of this work be passed to another firm or a freelancer?" Subcontracting is not forbidden. Subcontracting without your knowledge is the problem.

Technical questions to ask before you sign

None of these require technical knowledge. The clarity of the answers is signal enough.

The team

• Who will work on this project? What are their names and roles?
• Are the people from the first meeting on the project?
• Will at least two people know the code? What happens if one leaves?

The process

• Is there code review — does someone read each developer's code before it goes live?
• Are there automated tests, and what do they cover?
• Is there a test environment separate from production, where you can see a new version first?
• How often, and how, will you see progress: as a working build or as a report?

Code and ownership

• Will the repository be created in your account from day one?
• Whose name will the server, domain and app store accounts be in?
• What documentation comes with the handover: setup steps, environment variables, an architecture summary?

The detail, including why "the code is yours" is not enough on its own, is in who owns the code.

Security and personal data

If the vendor will process personal data on your behalf, responsibility does not stay with them alone. Under Article 28 of the GDPR, processing by a processor must be governed by a contract that sets out the subject matter, duration, nature and purpose of the processing, and the processor may not engage another processor without the controller's prior written authorisation (Regulation (EU) 2016/679, Article 28). That second rule is the subcontracting question above, written into law.

Türkiye's data protection law takes the same line from the other side: the controller is jointly responsible with whoever processes data on its behalf for taking the required security measures (Law No. 6698 on the Protection of Personal Data, Article 12).

So a vendor's security mistake becomes your problem too. The contract should state:

• Which data the vendor will access, and for what purpose.
• Which technical and organisational measures they will take (access rights, encryption, logging).
• How the data will be returned or destroyed when the work ends.

For mobile apps, the full checklist is in app security and privacy.

After launch

• How many months of free bug fixing follow delivery?
• What does the maintenance contract cover, and how many hours to respond to an urgent bug?
• Who is responsible for operating system and library updates?

We worked out the annual cost of keeping software running in website maintenance; the logic is the same for custom software.

Red flags

• A fixed price given before the scope is written. The more attractive the number, the more caution it deserves.
• The repository stays in the vendor's account, with handover promised "when the project ends".
• A nameless answer to the team question: "Our expert staff will handle it."
• No test environment: changes go straight to production.
• Most of the payment up front, on a schedule unrelated to delivery.
• "We do everything": mobile, web, AI, games, hardware. For a one- or two-person team, that signals no focus.

Ask us the same questions

Caliency builds mobile apps and websites, and we would like you to ask us every question above. The repository is opened in the client's account from day one, domains and accounts are in the client's name, the work is not passed to another firm or a freelancer, and we do not give a fixed price before the scope is written.

There are cases where we are not the right choice. For an enterprise integration involving hundreds of people, a project that requires on-site work, or a job decided purely on the lowest price, you will find better-suited firms.

Frequently asked questions

What should I look for when choosing a software development company?

Six things: who will actually work on the project and how many people will know the code, which side carries the risk of overrun under the pricing model, whose name the code repository and accounts are in at handover, how testing and releases work, how data-protection obligations are written into the contract if personal data is involved, and who maintains the software after launch. A portfolio does not answer any of the six.

How many software companies are there in Türkiye?

According to TurkStat's provisional 2025 results, 44,471 enterprises were active in computer programming, consultancy and related activities (NACE division 62). They employed 216,174 people and turned over TRY 1.03 trillion, an average of 4.9 people per enterprise.

Should a software project be fixed price or time and materials?

Fixed price if the scope can be written down line by line at the start, time and materials if it cannot. Under fixed price the vendor carries the overrun; under time and materials you do. The most expensive mistake is a fixed price on an undefined scope: either the price changes later or the scope quietly shrinks. For uncertain projects, a short paid discovery phase followed by a fixed price combines the strengths of both.

Is it risky to hire a very small software company?

Not in itself. In Türkiye, 93.5 percent of IT services firms have between one and nine people (TurkStat, 2025). The real risk of a small firm is key-person dependency: if the one person who knows the code leaves, the project stops. You manage it by keeping the code in your own repository, insisting on documentation and making sure at least two people know the codebase.

What should a software contract say about personal data?

If the vendor will process personal data on your behalf, it is a processor and the contract has to cover that. Under Article 28 of the GDPR the contract must set out the subject matter, duration, nature and purpose of the processing, and the processor may not bring in another processor without your written authorisation. Türkiye's KVKK makes the controller jointly responsible with the processor for security measures.

In short

Türkiye has 44,471 software enterprises with an average of 4.9 people each (TurkStat, 2025), and 93.5 percent of IT services firms have one to nine people. Choosing a software company usually means choosing a small team, and the main risk is key-person dependency.

You manage that risk through set-up rather than vendor size: code in your repository, accounts in your name, a written scope, an open person-month estimate and data-protection duties in the contract. With those five in place a small team can outperform a large firm; without them a large firm will not protect you either.

If you would like to talk your project through with these questions, get in touch; we will work out the scope with you and send a proposal with the person-month breakdown.