# Due diligence on a supplier in another country The questions that stop holding the moment a supplier is somewhere else: which entity signs, whose courts hear it, where the data lives, whether the IP assignment is valid under their law, what the money really costs, and how the relationship ends. _Version 1.0 · last reviewed 20 September 2026 · /due-diligence/cross-border-supplier_ Distance is rarely what goes wrong. What goes wrong is that assumptions which hold quietly inside one jurisdiction — about who you are contracting with, which court would hear a dispute, who owns what you paid for, where your data ends up — stop holding across a border, and nobody notices until one of them is needed. This list is built to be worked through in order: the first two sections are factual and can be asked in a first call, the middle three belong with a proposal and before a contract, and the last two are for the people who would actually do the work. ## Which entity signs, and whose courts The company you met may not be the company on the invoice. That is often how tax and employment law force a group to be structured, and it is still something you need in writing before you rely on it. - [ ] **What is the full registered name, registration number and country of the entity that will sign?** _(Deal-stopper)_ - Why: A group commonly sells through one entity and delivers through another. The one that signs is the one that owes you the work, and it may sit in a jurisdiction with different recourse from the one you thought you were buying from. - Ask for: The registration number, checked by you on that country's own company register. - Red flags: The signing entity is not named until the contract arrives; The entity is registered somewhere neither party has an office; The entity was incorporated more recently than the track record being claimed - Answer: - [ ] **Does the signing entity employ the people doing the work, and if not, what is the arrangement between them?** _(Deal-stopper)_ - Why: If delivery sits with a separate company or with contractors, your contractual protections have to reach through that chain — including confidentiality and the assignment of what they produce. - Ask for: A written statement of the delivery arrangement, plus confirmation that subcontractors are bound by equivalent terms. - Red flags: Vague answers about who employs the team; Subcontracting permitted without notice or consent; No flow-down of confidentiality or IP terms - Answer: - [ ] **Which law governs the contract, which courts have jurisdiction, and is arbitration nominated?** _(Deal-stopper)_ - Why: A clause naming a jurisdiction you would never realistically litigate in is, in practice, a clause saying you will not litigate. Arbitration can be faster and quieter, and can also cost enough to be a deterrent by design. - Ask for: The governing-law and jurisdiction clause, read before signature, with the arbitration seat and rules if named. - Red flags: Governing law in a third country unconnected to either party; Arbitration with costs that exceed a realistic claim; The clause is left blank or marked to be agreed - Answer: ## Where your data will actually live "Which region is it hosted in?" gets a region name. The question is which countries the data is stored in, transits, and is reachable from — including by the supplier's own staff. - [ ] **In which countries will our data be stored, processed and accessible from, including by support staff?** _(Deal-stopper)_ - Why: Otherwise-compliant arrangements are routinely undone by an engineer in a third country holding production access. That can be a legitimate way to run support; it belongs in the answer rather than in a later discovery. - Ask for: A written list of storage, processing and access locations, and the roles that hold access. - Red flags: Only a region is named, never a country; Support access is not mentioned at all; The answer changes between the sales call and the contract - Answer: - [ ] **Which transfer mechanism covers moving our data out of our jurisdiction, and is it current?** _(Deal-stopper)_ - Why: A buyer in the UK or the EEA has a transfer regime to satisfy, and the instrument that satisfies it has changed more than once. Naming it is a five-second answer for a supplier that has one. - Ask for: The named mechanism — an adequacy decision, standard contractual clauses or the current equivalent — with the signed document. - Red flags: "We are GDPR compliant" with no mechanism named; Clauses signed years ago and never revisited; No data processing agreement offered until asked - Answer: - [ ] **Who are the sub-processors, and what notice do we get before that list changes?** _(Important)_ - Why: The supplier's own supply chain becomes yours. A list with no change-notice commitment is a list that can be rewritten after you sign. - Ask for: The current sub-processor list and the notice period for additions. - Red flags: No list maintained; Changes allowed without notice; Notice given but with no right to object - Answer: - [ ] **May our inputs or outputs be used to train any model, and is that opt-in or opt-out?** _(Deal-stopper)_ - Why: The answer is increasingly "yes, unless you opt out", and the opt-out is often a setting rather than a clause — which means it can be changed by someone who has never read your contract. - Ask for: The clause or the setting, in writing, plus confirmation that it binds sub-processors. - Red flags: Training use is governed by a product setting rather than the contract; Exclusions apply only to some jurisdictions; No answer for material processed by subcontractors - Answer: ## Who owns the work, under whose law The assignment clause is the one most often copied from a template written for another country. Whether the words transfer anything depends on the governing law and, for some categories, on the law where the creator sits. - [ ] **Does the IP assignment cover subcontractors and individual contractors, not only employees?** _(Deal-stopper)_ - Why: Work-for-hire doctrines differ by country, and material produced by a contractor frequently does not vest in the firm that engaged them unless it has been assigned expressly. - Ask for: The assignment clause plus the flow-down terms for anyone outside the signing entity. - Red flags: Assignment covers "our employees" only; No flow-down to subcontractors; Moral rights not addressed where local law recognises them - Answer: - [ ] **Does ownership transfer on creation or on payment, and what happens to work in progress if we stop mid-invoice?** _(Deal-stopper)_ - Why: An assignment conditional on full payment leaves you with nothing if the relationship ends during a dispute — which is exactly when you most need the code. - Ask for: The trigger stated in the clause, and the position on partially paid work. - Red flags: Transfer on final payment with no escrow or partial position; Silence on work in progress; Supplier retains a right to reuse client-specific work - Answer: - [ ] **What is carved out as the supplier's pre-existing or reusable material, and how is it licensed to us?** _(Important)_ - Why: Reusable components are normal and usually good value. What matters is that the licence is broad enough, perpetual enough and transferable enough to keep operating the thing you paid for — including if you later change supplier. - Ask for: The background-IP schedule and the licence terms attached to it. - Red flags: Broad carve-out with a narrow licence; Licence terminates with the contract; Licence is not sublicensable to a future supplier - Answer: - [ ] **Can you produce the open-source licence inventory for what you will deliver?** _(Important)_ - Why: Producing one is routine and automated. A refusal usually means nobody has looked, and a copyleft licence deep in a dependency tree should be your decision rather than your discovery. - Ask for: A generated dependency and licence inventory for the delivered build. - Red flags: No inventory exists; Inventory produced only on request and never updated; Copyleft components in a distributed product with no analysis - Answer: ## The hours you will actually share Overlap is sold in hours and experienced in days. Ask the people who would be assigned, not the account manager. - [ ] **What hours will the assigned team actually keep, and what is the escalation path outside them?** _(Important)_ - Why: A question asked at the end of your day and answered at the end of theirs turns a two-step clarification into three calendar days. - Ask for: The working pattern in writing, the on-call arrangement, and a named escalation contact. - Red flags: Overlap described only as a number of hours; No escalation path outside working hours; The account manager answers for the delivery team - Answer: - [ ] **Which public holidays apply to the delivery team, and how is that reflected in the plan?** _(Worth asking)_ - Why: National holiday calendars differ by weeks. A delivery plan that ignores them is a plan with those weeks missing. - Ask for: The holiday calendar for the delivery location, mapped against the milestones. - Red flags: No holiday calendar provided; Milestones fall inside a known national holiday period; Cover during holidays is unspecified - Answer: - [ ] **What response is committed for a production incident and for a decision that blocks work?** _(Deal-stopper)_ - Why: Those are the only two cases where the time zone genuinely costs money. Everything else can wait a day. - Ask for: Written response times for both cases, with the remedy if they are missed. - Red flags: Response times stated only as "best efforts"; No distinction between an outage and a question; No remedy of any kind for a missed commitment - Answer: ## What the money really costs The rate is not the cost. Currency, transfer fees and tax treatment routinely move the real figure by more than the negotiation did. - [ ] **Which currency are we invoiced in, and who carries the exchange-rate movement?** _(Important)_ - Why: A rate fixed in a currency other than yours is a rate that changes every month, and on a multi-year engagement that movement can exceed the discount you negotiated. - Ask for: The invoicing currency and any rate-adjustment clause, in the contract. - Red flags: Currency not stated in the proposal; A clause allowing unilateral re-pricing on currency movement; Conversion at a rate the supplier chooses - Answer: - [ ] **Is withholding tax or reverse-charge treatment expected, and who has planned for it?** _(Important)_ - Why: In several common arrangements one side must withhold a percentage and remit it locally. If nobody planned for it, the supplier receives less than expected and raises it as a dispute at the worst moment. - Ask for: A written position on withholding and VAT or equivalent treatment for this route. - Red flags: Neither side has considered it; The contract requires you to gross up without a cap; Tax residency certificates promised but never produced - Answer: - [ ] **What can change the price: indexation, annual uplift, team size, or a scope boundary?** _(Important)_ - Why: A scope boundary defined loosely enough to cross by accident is the most common source of an invoice nobody expected. - Ask for: The change-control clause and any indexation formula. - Red flags: Uncapped annual uplift; Change control that does not require written approval; Scope defined only by reference to a sales deck - Answer: ## References from your own market Every supplier can produce a happy client. You want one who bought from the same distance you are buying from. - [ ] **Can you name a client in our country, in our sector, at our size — preferably one that has finished?** _(Deal-stopper)_ - Why: A reference who managed the same time zone, currency and contract structure is the only one whose experience predicts yours. - Ask for: A named contactable reference, and permission to ask them anything. - Red flags: References only in the supplier's home market; Only current clients offered, never a completed engagement; A reference call chaperoned by the account manager - Answer: - [ ] **Were the named reference projects delivered by the team that would work on ours, and is that team still here?** _(Deal-stopper)_ - Why: The single largest risk in services buying is that the people in the pitch are not the people who turn up, and staff turnover is higher than any firm volunteers. - Ask for: Names and seniority of the proposed team, and their role on the referenced work. - Red flags: No individuals named before signature; The delivery team is "to be assigned"; The referenced work predates most of the current staff - Answer: - [ ] **Did you ask the reference what was worse than expected, and how long the first serious problem took to resolve?** _(Important)_ - Why: "It went well" in eleven words is a briefed reference. What was harder than expected is the answer that tells you what your engagement will feel like. - Ask for: Your own notes from the call, not a written testimonial. - Red flags: Reference cannot recall any difficulty; Written testimonial offered in place of a call; Reference is a reseller or partner rather than a client - Answer: ## How it ends Write the ending at the beginning, while everyone is still agreeable. - [ ] **What is handed over, in what format, by when — and who pays for the handover?** _(Deal-stopper)_ - Why: Handover is work. If it is unpaid it is also unenthusiastic, and it happens at exactly the moment goodwill is lowest. - Ask for: An exit schedule listing source code, credentials, documentation, data exports and account ownership, with a timetable and a price. - Red flags: No exit schedule at all; Handover priced at exit rather than agreed up front; Supplier retains ownership of accounts or domains - Answer: - [ ] **What are the deletion terms, and what evidence of deletion will we receive?** _(Deal-stopper)_ - Why: "We have deleted it" is not a fact you can audit after a relationship has ended badly. - Ask for: A deletion commitment with a deadline and a certificate or log as proof. - Red flags: Deletion promised with no timetable; Backups excluded indefinitely; No evidence of deletion offered - Answer: - [ ] **If people were assigned to us effectively full-time, does local employment law give them any claim connected to our work, and whose problem is that?** _(Important)_ - Why: Long-running dedicated-team arrangements can create obligations in the supplier's jurisdiction that neither side priced. It is better to know which side carries them before the arrangement ends. - Ask for: A written allocation of that risk in the contract. - Red flags: Neither side has considered it on a multi-year dedicated team; The contract silently passes the risk to the buyer; Indemnity offered by an entity with no assets - Answer: --- General guidance, not legal, security or financial advice. It does not replace your own advisers. Maintained by TrustList.