I’d ask each company for two recent references, a security checklist, and a rough architecture outline, not just a portfolio screenshot. I also skim third‑party feedback when I can, I ended up reading https://shiftsmart.pissedconsumer.com/review.html while vetting vendors.