Skip to content
TrustList
Due diligence

Due diligence on a supplier in another country

The questions that stop holding the moment a supplier is somewhere else: which entity signs, whose courts hear it, where the data lives, whether the IP assignment is valid under their law, what the money really costs, and how the relationship ends.

23 questions13 deal-stoppersv1.0 · reviewed 20 September 2026

Distance is rarely what goes wrong. What goes wrong is that assumptions which hold quietly inside one jurisdiction — about who you are contracting with, which court would hear a dispute, who owns what you paid for, where your data ends up — stop holding across a border, and nobody notices until one of them is needed. This list is built to be worked through in order: the first two sections are factual and can be asked in a first call, the middle three belong with a proposal and before a contract, and the last two are for the people who would actually do the work.

Which entity signs, and whose courts

The company you met may not be the company on the invoice. That is often how tax and employment law force a group to be structured, and it is still something you need in writing before you rely on it.

  1. What is the full registered name, registration number and country of the entity that will sign?

    Deal-stopper

    A group commonly sells through one entity and delivers through another. The one that signs is the one that owes you the work, and it may sit in a jurisdiction with different recourse from the one you thought you were buying from.

    Ask for: The registration number, checked by you on that country's own company register.

    Red flags

    • The signing entity is not named until the contract arrives
    • The entity is registered somewhere neither party has an office
    • The entity was incorporated more recently than the track record being claimed
  2. Does the signing entity employ the people doing the work, and if not, what is the arrangement between them?

    Deal-stopper

    If delivery sits with a separate company or with contractors, your contractual protections have to reach through that chain — including confidentiality and the assignment of what they produce.

    Ask for: A written statement of the delivery arrangement, plus confirmation that subcontractors are bound by equivalent terms.

    Red flags

    • Vague answers about who employs the team
    • Subcontracting permitted without notice or consent
    • No flow-down of confidentiality or IP terms
  3. Which law governs the contract, which courts have jurisdiction, and is arbitration nominated?

    Deal-stopper

    A clause naming a jurisdiction you would never realistically litigate in is, in practice, a clause saying you will not litigate. Arbitration can be faster and quieter, and can also cost enough to be a deterrent by design.

    Ask for: The governing-law and jurisdiction clause, read before signature, with the arbitration seat and rules if named.

    Red flags

    • Governing law in a third country unconnected to either party
    • Arbitration with costs that exceed a realistic claim
    • The clause is left blank or marked to be agreed

Where your data will actually live

"Which region is it hosted in?" gets a region name. The question is which countries the data is stored in, transits, and is reachable from — including by the supplier's own staff.

  1. In which countries will our data be stored, processed and accessible from, including by support staff?

    Deal-stopper

    Otherwise-compliant arrangements are routinely undone by an engineer in a third country holding production access. That can be a legitimate way to run support; it belongs in the answer rather than in a later discovery.

    Ask for: A written list of storage, processing and access locations, and the roles that hold access.

    Red flags

    • Only a region is named, never a country
    • Support access is not mentioned at all
    • The answer changes between the sales call and the contract
  2. Which transfer mechanism covers moving our data out of our jurisdiction, and is it current?

    Deal-stopper

    A buyer in the UK or the EEA has a transfer regime to satisfy, and the instrument that satisfies it has changed more than once. Naming it is a five-second answer for a supplier that has one.

    Ask for: The named mechanism — an adequacy decision, standard contractual clauses or the current equivalent — with the signed document.

    Red flags

    • "We are GDPR compliant" with no mechanism named
    • Clauses signed years ago and never revisited
    • No data processing agreement offered until asked
  3. Who are the sub-processors, and what notice do we get before that list changes?

    Important

    The supplier's own supply chain becomes yours. A list with no change-notice commitment is a list that can be rewritten after you sign.

    Ask for: The current sub-processor list and the notice period for additions.

    Red flags

    • No list maintained
    • Changes allowed without notice
    • Notice given but with no right to object
  4. May our inputs or outputs be used to train any model, and is that opt-in or opt-out?

    Deal-stopper

    The answer is increasingly "yes, unless you opt out", and the opt-out is often a setting rather than a clause — which means it can be changed by someone who has never read your contract.

    Ask for: The clause or the setting, in writing, plus confirmation that it binds sub-processors.

    Red flags

    • Training use is governed by a product setting rather than the contract
    • Exclusions apply only to some jurisdictions
    • No answer for material processed by subcontractors

Who owns the work, under whose law

The assignment clause is the one most often copied from a template written for another country. Whether the words transfer anything depends on the governing law and, for some categories, on the law where the creator sits.

  1. Does the IP assignment cover subcontractors and individual contractors, not only employees?

    Deal-stopper

    Work-for-hire doctrines differ by country, and material produced by a contractor frequently does not vest in the firm that engaged them unless it has been assigned expressly.

    Ask for: The assignment clause plus the flow-down terms for anyone outside the signing entity.

    Red flags

    • Assignment covers "our employees" only
    • No flow-down to subcontractors
    • Moral rights not addressed where local law recognises them
  2. Does ownership transfer on creation or on payment, and what happens to work in progress if we stop mid-invoice?

    Deal-stopper

    An assignment conditional on full payment leaves you with nothing if the relationship ends during a dispute — which is exactly when you most need the code.

    Ask for: The trigger stated in the clause, and the position on partially paid work.

    Red flags

    • Transfer on final payment with no escrow or partial position
    • Silence on work in progress
    • Supplier retains a right to reuse client-specific work
  3. What is carved out as the supplier's pre-existing or reusable material, and how is it licensed to us?

    Important

    Reusable components are normal and usually good value. What matters is that the licence is broad enough, perpetual enough and transferable enough to keep operating the thing you paid for — including if you later change supplier.

    Ask for: The background-IP schedule and the licence terms attached to it.

    Red flags

    • Broad carve-out with a narrow licence
    • Licence terminates with the contract
    • Licence is not sublicensable to a future supplier
  4. Can you produce the open-source licence inventory for what you will deliver?

    Important

    Producing one is routine and automated. A refusal usually means nobody has looked, and a copyleft licence deep in a dependency tree should be your decision rather than your discovery.

    Ask for: A generated dependency and licence inventory for the delivered build.

    Red flags

    • No inventory exists
    • Inventory produced only on request and never updated
    • Copyleft components in a distributed product with no analysis

The hours you will actually share

Overlap is sold in hours and experienced in days. Ask the people who would be assigned, not the account manager.

  1. What hours will the assigned team actually keep, and what is the escalation path outside them?

    Important

    A question asked at the end of your day and answered at the end of theirs turns a two-step clarification into three calendar days.

    Ask for: The working pattern in writing, the on-call arrangement, and a named escalation contact.

    Red flags

    • Overlap described only as a number of hours
    • No escalation path outside working hours
    • The account manager answers for the delivery team
  2. Which public holidays apply to the delivery team, and how is that reflected in the plan?

    Worth asking

    National holiday calendars differ by weeks. A delivery plan that ignores them is a plan with those weeks missing.

    Ask for: The holiday calendar for the delivery location, mapped against the milestones.

    Red flags

    • No holiday calendar provided
    • Milestones fall inside a known national holiday period
    • Cover during holidays is unspecified
  3. What response is committed for a production incident and for a decision that blocks work?

    Deal-stopper

    Those are the only two cases where the time zone genuinely costs money. Everything else can wait a day.

    Ask for: Written response times for both cases, with the remedy if they are missed.

    Red flags

    • Response times stated only as "best efforts"
    • No distinction between an outage and a question
    • No remedy of any kind for a missed commitment

What the money really costs

The rate is not the cost. Currency, transfer fees and tax treatment routinely move the real figure by more than the negotiation did.

  1. Which currency are we invoiced in, and who carries the exchange-rate movement?

    Important

    A rate fixed in a currency other than yours is a rate that changes every month, and on a multi-year engagement that movement can exceed the discount you negotiated.

    Ask for: The invoicing currency and any rate-adjustment clause, in the contract.

    Red flags

    • Currency not stated in the proposal
    • A clause allowing unilateral re-pricing on currency movement
    • Conversion at a rate the supplier chooses
  2. Is withholding tax or reverse-charge treatment expected, and who has planned for it?

    Important

    In several common arrangements one side must withhold a percentage and remit it locally. If nobody planned for it, the supplier receives less than expected and raises it as a dispute at the worst moment.

    Ask for: A written position on withholding and VAT or equivalent treatment for this route.

    Red flags

    • Neither side has considered it
    • The contract requires you to gross up without a cap
    • Tax residency certificates promised but never produced
  3. What can change the price: indexation, annual uplift, team size, or a scope boundary?

    Important

    A scope boundary defined loosely enough to cross by accident is the most common source of an invoice nobody expected.

    Ask for: The change-control clause and any indexation formula.

    Red flags

    • Uncapped annual uplift
    • Change control that does not require written approval
    • Scope defined only by reference to a sales deck

References from your own market

Every supplier can produce a happy client. You want one who bought from the same distance you are buying from.

  1. Can you name a client in our country, in our sector, at our size — preferably one that has finished?

    Deal-stopper

    A reference who managed the same time zone, currency and contract structure is the only one whose experience predicts yours.

    Ask for: A named contactable reference, and permission to ask them anything.

    Red flags

    • References only in the supplier's home market
    • Only current clients offered, never a completed engagement
    • A reference call chaperoned by the account manager
  2. Were the named reference projects delivered by the team that would work on ours, and is that team still here?

    Deal-stopper

    The single largest risk in services buying is that the people in the pitch are not the people who turn up, and staff turnover is higher than any firm volunteers.

    Ask for: Names and seniority of the proposed team, and their role on the referenced work.

    Red flags

    • No individuals named before signature
    • The delivery team is "to be assigned"
    • The referenced work predates most of the current staff
  3. Did you ask the reference what was worse than expected, and how long the first serious problem took to resolve?

    Important

    "It went well" in eleven words is a briefed reference. What was harder than expected is the answer that tells you what your engagement will feel like.

    Ask for: Your own notes from the call, not a written testimonial.

    Red flags

    • Reference cannot recall any difficulty
    • Written testimonial offered in place of a call
    • Reference is a reseller or partner rather than a client

How it ends

Write the ending at the beginning, while everyone is still agreeable.

  1. What is handed over, in what format, by when — and who pays for the handover?

    Deal-stopper

    Handover is work. If it is unpaid it is also unenthusiastic, and it happens at exactly the moment goodwill is lowest.

    Ask for: An exit schedule listing source code, credentials, documentation, data exports and account ownership, with a timetable and a price.

    Red flags

    • No exit schedule at all
    • Handover priced at exit rather than agreed up front
    • Supplier retains ownership of accounts or domains
  2. What are the deletion terms, and what evidence of deletion will we receive?

    Deal-stopper

    "We have deleted it" is not a fact you can audit after a relationship has ended badly.

    Ask for: A deletion commitment with a deadline and a certificate or log as proof.

    Red flags

    • Deletion promised with no timetable
    • Backups excluded indefinitely
    • No evidence of deletion offered
  3. If people were assigned to us effectively full-time, does local employment law give them any claim connected to our work, and whose problem is that?

    Important

    Long-running dedicated-team arrangements can create obligations in the supplier's jurisdiction that neither side priced. It is better to know which side carries them before the arrangement ends.

    Ask for: A written allocation of that risk in the contract.

    Red flags

    • Neither side has considered it on a multi-year dedicated team
    • The contract silently passes the risk to the buyer
    • Indemnity offered by an entity with no assets

This checklist is general guidance, not legal, security or financial advice, and it does not replace your own advisers on anything contentious. It was last reviewed on 20 September 2026. Tell us if something here is wrong or missing.