What to ask an IT provider before you sign

Most owners compare IT and web providers on a spreadsheet: price per user, price per month, maybe a feature list. Then something breaks, and they find out what the contract really says. The gap between two quotes usually hides differences in who does the work, how fast problems actually get fixed, and what happens when you want to leave.

I sell some of these services, so read this with that in mind. Every question below is one I expect to be asked myself, and you should ask it of anyone you are considering.

Who does the work

• Who exactly will work on my account? Get names. Ask whether it is the same person every time or whoever is next in the queue.
• How many clients does each technician carry? A provider that will not answer this is telling you something.
• Is any of the work subcontracted or sent offshore? That is not automatically bad. Not knowing is.
• What happens when my usual person is out? There should be documentation someone else can follow, not tribal knowledge.
• Where does AI touch my work and my data? Ask which tools are used, what data goes into them, and who reviews the output before it reaches you.

Who owns what

• Is my domain registered in my name, on my account? This is the single most important question on the list. Losing control of a domain is how businesses lose their website and email at the same time.
• Do I get admin access to everything? Hosting, website, email, DNS, backups and any software licenses. You should never need a vendor's permission to get into your own systems.
• Who owns the website code and content? Some builders keep the site on a platform you cannot move. Ask before you sign, not when you want to leave.
• Where is the documentation, and do I get a copy? Passwords in a shared vault you control, a written list of systems, and how they connect.

When something breaks

• What do you commit to in writing: response or resolution? A fast response means someone acknowledged your ticket. Resolution means it is fixed. They are very different promises.
• How do I reach a person for an urgent problem? A ticket number in a queue is not the same as a direct line.
• What happens when you miss a target you committed to? If the answer is nothing, the target is marketing.
• Can you show me your actual track record on those targets? Ask for it the same way you would ask a contractor for references.

Security basics they should already do

• Do you use multi-factor sign-in on every account that touches my systems? Their own admin accounts are a path into yours.
• Are my backups tested? A backup nobody has ever restored is a hope, not a backup. Ask when the last test restore happened.
• Will my email pass SPF, DKIM and DMARC checks? These three settings decide whether your invoices reach inboxes and whether someone can send email pretending to be you.
• Who renews my security certificate and domain, and how will I know it happened? Expired certificates and lapsed domains are avoidable outages.
• Will you put security findings in writing? "Everything looks good" on a phone call is not a finding.

The contract and the exit

• What is not included? Get the list of what costs extra. That is where surprise invoices come from.
• How are scope changes handled? You should see a written change and its cost before the work starts.
• How long is the term, and what does it take to cancel? Month to month and multi-year are both legitimate. Auto-renewal you did not notice is not.
• If I leave, what do I get and how fast? Logins, documentation, files and a handoff call. A good provider plans your exit on day one.
• Can I see work you have done, and talk to someone you did it for? Live sites and real references beat a logo wall.

The cheapest provider is the one you never have to fight to get your own logins back from.

How I answer these

For what it is worth, here is where I stand on the ones above. You get me, the same person every time, not a queue. You own your domain, your site and every login, and I document the setup so someone else could pick it up later. Requests are handled as quickly as possible, in the order they come in. Care plans come with a written note every month. Live client work you can load today is on Our work.

If you are comparing ongoing help, see Run for care plans. If the bigger question is who should own technology decisions at all, read When to hire a fractional CTO vs. full-time or look at Fractional CTO under Advisory.