Vetting a Website Vendor: What to Verify Before You Pay

Why the advance is the moment to check

Before you pay the advance, you hold more bargaining power than you will have at any point afterwards. The vendor wants the job, so questions get answered. After the payment, each unanswered question becomes a favour you are asking for. A good deal of what goes wrong with a web vendor can be seen in advance if you check four things: who they legally are, who will own what, what the paper says, and what other people can confirm.

This guide takes them in that order, then gives a list of red flags and 15 questions to put in one WhatsApp message. Tax, registry and platform facts are linked to their sources and stand as of 3 October 2026. Dwize facts come from its trust, pricing, contact and custom pages. At the end we apply the list to ourselves.

Check one: who they legally are

Every GST-registered business has a 15-character GSTIN. The GST Council’s registration flyer explains its anatomy: the first two digits are the state code, the next ten are the PAN of the legal entity, the next two are an entity code and the last is a check digit. You can look any GSTIN up without logging in at the taxpayer search on the GST portal. The portal’s own welcome kit for new businesses lists what the search returns and says one purpose is to avoid dealing with vendors who use fake GSTINs.

Ask the vendor for the GSTIN in writing, search it, and compare the result with what you have been told.

Two clarifications keep this check honest. A missing GSTIN is not proof of bad faith. Suppliers of services under ₹20 lakh of turnover are not required to register in most states, so a freelancer may legitimately have none. Then the bill carries no GST and gives you no credit, and you should lean harder on the other checks. Likewise a Udyam certificate shows size class and little more: the Udyam portal calls registration free, paperless and based on self-declaration, though it also lets you verify a certificate.

Then check that the office exists. Ask for a video call from it, or visit if the vendor is in your city. A Bikaner phone number with a Bengaluru GSTIN is possible and often innocent. It is simply a question to ask.

Check two: who will own what

Ownership is the point where a vendor’s interests and yours differ most, and the place where a quote is usually silent. Here is the list to complete before you pay.

A few of those rows deserve their sources. The .IN registry’s FAQ tells owners to check that they or an authorised representative of their organisation is named as the registrant. It says the registry cannot edit records directly for registrants, so changes go through the registrar, and that registrars are contractually required to give the authorisation code on the registrant’s request. The registry’s WHOIS lookup is linked from the same page. Google says a Business Profile can have several owners but only one primary owner, and managers cannot add or remove users. Search Console needs at least one verified owner, so make sure you are listed as an owner. Nobody needs your Google password to set any of this up. They can invite you or you can invite them.

For apps, Apple’s enrolment rules say an organisation must be a legal entity and that its legal name is shown as the seller on the App Store. Apps can move between accounts, but Apple’s app transfer is started by the account holder and has conditions, and Google Play’s transfer needs both accounts to be active and the original account’s apps to comply with policy. A transfer is possible, then, but it is far easier to publish under the right name on day one.

The last row is the one that surprises people. Under the Copyright Act, 1957, the author of a work is its first owner (section 17). The exceptions cover employers, government and people who commission certain works such as photographs. An assignment is valid only if it is in writing and signed by the assignor (section 19). It must identify the work and the rights assigned. If it states no period, it is deemed to last five years, and if it states no territory, it is presumed to cover India. So a website paid for in full may still belong, in law, to whoever wrote it unless an agreement says otherwise, and an assignment that is silent on duration is shorter than most owners assume. This is the statute as published and not legal advice. For anything beyond a standard website, have a lawyer read the ownership clause.

Dwize’s published position, from its pricing page, is that your brand, domain, content, customer data and agreed exports remain yours, and that Dwize retains the underlying platform code unless a Suite contract says otherwise. That is a clear line with a trade-off in it, and you should hold any vendor to a line that clear.

Check three: what the paper must say

Scope and exclusions come first, in a list with counts. Dwize’s process is a useful yardstick: the written scope names the package, pages, language, copy, revisions, SEO foundations, analytics, business profile and pass-throughs before payment. Then the paper should answer four more things.

On support and renewal, it should say what is covered after launch, for how long, and what year two costs. Dwize writes renewal price, scope and terms before the next Care Year decision (covenant 01).

On exit, it should say what you receive, in what form and by when, if you leave in month one or at the end. Dwize handles the exit path in writing if the fit is wrong in the first 30 days (covenant 07), and says brand, domain, content, customer data and agreed exports remain portable at year-end (covenant 08).

On change, it should say who prices an out-of-scope request, and whether that happens before or after the work. Dwize’s Care Year includes 12 content updates, each live within 2 business days, with out-of-scope work quoted separately.

On data, start from the fact that if the site or app collects enquiries, bookings or customer details, the DPDP Act, 2023 applies to you as the party that decides why the data is collected. Section 8 says the data fiduciary stays responsible even when a processor does the work, may engage a processor only under a valid contract, must take reasonable security safeguards, and must cause the processor to erase data when the purpose is served. The Rules were notified in the Gazette on 13 November 2025 with an eighteen-month phase-in, which runs out around mid-May 2027, so a twelve-month agreement signed now will run past it. Ask the vendor what personal data the system will hold, where, who on their side can reach it, what they will do at exit, and how quickly they will tell you of a breach.

Keep the WhatsApp thread. It is easy to give an “ok, go ahead” and forget it, and it is the record of what was promised.

Check four: what other people can confirm

Ask for two references in a business of your size and kind whom you can call. Ask them four things: who owns their domain, who answers when something breaks, what extras cost them, and how long their first change took. Then open the vendor’s portfolio sites and check who is shown as the registrant and who maintains them now. A page of logos with no names tells you less than one phone call.

Dwize is a young company, founded in 2026. Its trust page says customer references appear only when attribution is permitted, and that case studies will be added after explicit approval. So today the evidence on offer is public identity and not a client wall: a legal name, a GSTIN you can verify, published GST-inclusive prices and eight written covenants. Weigh that as you would weigh it for anyone new.

Red flags

• The quote carries no legal name or GSTIN, and payment is requested into a personal account under another name.
• The domain is registered in the vendor’s name or email “for convenience”.
• Hosting, code or app-store accounts exist only under the vendor’s login, and the contract is silent on export.
• Scope reads “as required”, “unlimited” or “everything included”.
• Maintenance is mentioned but not priced.
• A large advance is tied to no milestone, deliverable or date.
• A Diwali discount expires tonight, before you can check anything.
• Answers change between calls, and the vendor would rather not write them down.
• You are asked for your Google, Apple or bank login instead of being invited to add the vendor as a user.

Fifteen questions before you pay an advance

Send these in one message and wait for written answers. The right-hand column is what a good reply looks like.

Apply the list to Dwize first

On its published pages, Dwize already answers questions 1, 2, 4, 7, 8, 9, 10, 11, 14 and 15, in outline at least. The trust page gives the legal entity DWIZE OFFICE SOLUTION, the GSTIN 08FPPPR8719E1Z5, and a registered office in Bikaner, Rajasthan, with a link to the GST portal. Search the GSTIN there and compare the legal name before you read another sentence of ours. The pricing page lists the pass-throughs at cost and the ownership terms. The Care Year page carries the covenants. On question 4, domains are registered in your business’s own name, including the Go custom-domain add-on. Questions 3, 5, 6, 12 and 13 belong in your own written scope, so put them to us as you would to anyone, through the contact page or WhatsApp, and expect answers in writing.