Direct answer: Vetting a software company for manufacturing means scoring 20 capability points across five gates — domain fit, integration, delivery, security and commercial terms — then verifying 10 evidence artifacts before you release a purchase order. Score each point 0–2, treat every claim as unproven until you see an artifact, and block approval if ownership, security or legal-existence checks fail.
A polished demo can hide a vendor that has never touched a plant system.
This guide gives you a scoring checklist and an evidence register you can plan to run in two to four weeks, whether your unit sits in a GIDC estate in Vadodara or the Pithampur belt near Indore. It is written for owners and operations managers, not procurement departments. For general hiring criteria beyond the plant context, see our guide to choosing software companies in India; this article goes deeper on manufacturing-specific risk.
Why Manufacturing Vetting Is Different
Manufacturing software rarely runs alone. A production app may read work orders from an ERP (enterprise resource planning) system, exchange events with an MES (manufacturing execution system), and pull machine data from PLCs (programmable logic controllers) or SCADA (supervisory control and data acquisition) — the operational technology (OT) on your floor. If one link fails mid-shift, records drift and traceability breaks.
That changes what you must verify: failure behavior, record ownership and shop-floor usability matter more than a slick interface. JUHENZA's own production dashboards and ERP integrations work starts from this event-and-exception view of the plant.
Local context matters too. Units around Makarpura or Savli in Vadodara, and Pithampur or Sanwer Road in Indore, often run mixed-vintage machines, Tally or an older ERP, and multi-shift teams. Ask every vendor how they will walk the process, interview operators and support go-live across shifts — onsite or through a live video walkthrough.
How to Score the Checklist
Score each of the 20 points below: 0 = absent or vague, 1 = explained but unverified, 2 = backed by evidence you have actually seen. Maximum: 40. The 10 evidence checks are pass/fail.
Suggested decision rules — these are recommendations to adapt, not an industry standard:
- Approve: 32+/40, all 10 evidence checks pass, and no zero in Gates D or E.
- Pilot first: 24–31, or any evidence check still pending — commission a small paid pilot before the full build.
- Decline: below 24, or a failed legal-existence, ownership or security check.
Record the score, the evidence and the reviewer beside each line so the decision is defensible later.
The 20-Point Checklist for Vetting a Software Company for Manufacturing
Gate A — Manufacturing domain fit
- Comparable process experience. Ask for a project matching your production type — discrete fabrication, batch process or continuous — not a generic "manufacturing" logo wall.
- Shop-floor vocabulary. Can they discuss work orders, routings, bills of materials, batch IDs and shift handovers without reaching for a glossary?
- Buy-versus-build honesty. A good partner will tell you when a configurable ERP module beats custom code, and say so before quoting.
- Plant discovery before quoting. They should insist on walking the process and interviewing operators — onsite or by live video — before fixing scope.
Gate B — Integration and reliability
- System-of-record map. Who owns item masters, stock and work-order status: the ERP, the MES or the new app? One owner per record, written down.
- Integration mechanics. Ask how they handle API limits, retries and idempotency — resubmitting a failed transfer without creating duplicates. Our API and integration consulting starts with exactly this mapping.
- Failure behavior. What happens when connectivity or the ERP drops mid-shift? Expect buffering, reconciliation and operator-visible status, not "it won't fail." See our guide to failed syncs and duplicate records.
- Legacy respect. The plan should coexist with Tally, older ERPs and machine controllers — using boundaries like those in the ISA-95 standard for enterprise–control integration — rather than rip-and-replace.
Gate C — Delivery, testing and adoption
- Written scope and acceptance checks. Deliverables, exclusions and observable pass/fail tests agreed before code; a software project planning checklist keeps quotes comparable.
- Named delivery team. The seniors in the sales meeting must be the seniors building. Subcontractors disclosed, time allocations stated.
- Production-like testing. User acceptance testing (UAT) with anonymized real records, plus failure-path tests: duplicate events, dropped connections, wrong scans.
- Operator usability and training. Shared terminals, gloves, barcode scans, local-language instructions and a shift-wise training plan. Pilot one line before the whole plant.
Gate D — Security, data protection and compliance
- Access control. Role-based permissions, multi-factor authentication, least-privilege access to production data, and a named list of who can touch what.
- Data protection duties. If the system handles personal data — employees, customers, visitors — ask how the contract allocates duties under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, whose obligations phase in through May 2027 (as of November 2026). Our DPDP compliance for apps explainer covers app-level questions. This is general information, not legal advice.
- Verifiable security claims. If ISO/IEC 27001 certification is claimed, ask for the certificate number, issuing body, scope and expiry — then verify with the issuer. A small studio without certification can still pass with documented controls and a tested backup-restore routine.
- AI-use disclosure. Ask whether AI coding tools will touch your code, what data leaves your boundary, and how generated code is reviewed and tested before release.
Gate E — Commercial terms, ownership and continuity
- Itemized quote and running costs. Separate build cost from hosting, licences and support; list assumptions, exclusions and the change-request rule.
- Ownership in writing. Source code, documentation and production data rights assigned to your business, with a third-party licence list. Have a lawyer review the clauses.
- Account control and exit. Your business owns the repository, cloud and domain accounts from day one; data exports in usable formats; a handover another team could run.
- Support and continuity. Warranty separate from paid support; response and restoration targets by severity; a named backup for every key person.
The 10 Evidence Checks Before You Approve the Project
Answers are cheap; artifacts are not. Demand these ten, verify each yourself, and log pass/fail against the vendor's name.
| # | Evidence | How to verify | Red flag |
|---|---|---|---|
| E1 | Legal existence | Match the contracting entity against MCA company master data (CIN, status, directors) and GST registration. | Refuses to share CIN; contract from an unrelated entity |
| E2 | A live comparable system | Screen-share in a working environment; trace one record end-to-end. | Only mockups or edited videos |
| E3 | A reference you contact | Reach the client through their official channel; ask what went wrong and how it was handled. | Written testimonials only |
| E4 | A sanitized work sample | Repository excerpt or architecture note reviewed by your technical adviser. | "Everything is confidential" |
| E5 | Test and acceptance pack | Sample test plan, defect log and release checklist from a past project. | "Developers test their own code" |
| E6 | Security summary | Controls document; certificate details verified with the issuer; restore-test evidence. | Expired or out-of-scope certificate |
| E7 | Itemized proposal and draft contract | Scope, exclusions, milestones, change rule, IP and exit terms all present. | One-line lump-sum quote |
| E8 | Named-team roster | Roles, time allocation, employees versus subcontractors, backup names. | "Team assigned after signing" |
| E9 | Support sheet | Severity tiers, response versus restoration targets, coverage hours, escalation contact. | "We're always available" |
| E10 | Paid micro-pilot output | A one-to-two-week bounded task on one anonymized workflow; you keep the output. | Refuses any small paid trial |
E1, E7 and E8 should be non-negotiable before any purchase order. E10 is optional for tiny projects, but it is the strongest predictor on this list.
Worked Example: A Vadodara Fabrication Unit (Illustrative)
This is a planning scenario, not a client result. A 120-person fabrication unit in Makarpura GIDC wants production tracking synced to its accounting system. Vendor A scores 36/40 on answers but fails E2 (staging demo only) and E8 (no roster): hold. Vendor B scores 30/40, passes every evidence check, and delivers a two-week paid pilot syncing one work-order flow — including a duplicate-event test the plant engineer watches. Approval goes to Vendor B, phase by phase. The lesson: evidence outranks eloquence. A pharma ancillary in Pithampur would add document-control and audit-trail questions to Gate D before the same decision.
What We Verified — and What We Cannot Claim
This checklist is desk research: it synthesizes published vendor-selection guidance and the planning patterns JUHENZA documents on its own site. We have not run a formal vendor audit you can cite here.
What you can inspect today is our published pharma report-automation case study, which states scope and engineering decisions without implying client endorsement.
Common Mistakes, Limits and When to Call a Specialist
Mistakes: buying the demo, comparing lump sums without normalizing scope, treating "Agile" or "ISO" labels as proof, repeating unverified failure statistics in board notes, and skipping operator interviews.
Limits: no checklist guarantees delivery. Apply it proportionately — a five-person studio can be excellent without formal audit reports if its controls are documented and tested. This guide is general information, not legal advice.
Specialists: a lawyer for IP, data-protection and contract terms; an automation or OT engineer if PLCs or SCADA are in scope; a chartered accountant for vendor financial health; an independent technical adviser if nobody in-house can review E4.
Frequently Asked Questions
How do I verify a software company in India is genuine?
Check the entity on the MCA portal (CIN, status, registered office), confirm GST registration, and speak to a reference you sourced independently. Registration proves existence, not engineering quality.
Who should own the source code and production data?
Your business, through a written assignment covering code, documentation and data, plus a list of third-party licences and their terms. Payment alone does not settle every rights question; have counsel review the clauses.
Does the vendor need to be based in Vadodara or Indore?
No. What matters is availability for plant visits or live walkthroughs, working-hour overlap with your shifts, and a support plan for go-live. A remote-first team can pass every check in this guide.
How much should we pay upfront?
Keep advances modest and tied to defined deliverables and milestones, with acceptance checks at each stage. Avoid large unsecured prepayments; the micro-pilot (E10) is a safer first commitment than a big advance.
Is ISO 27001 certification mandatory for a small vendor?
No. If it is claimed, verify the certificate's number, scope, issuer and expiry. Documented access control, patching, backups and a tested restore can be proportionate evidence for a small studio.
Fixed price or time-and-materials for a plant project?
A bounded pilot suits fixed price. Evolving scope suits time-and-materials with a spending cap and written change approval. Compare proposals on identical scope before comparing rates.
What if the vendor shuts down mid-project?
Own the repository, cloud accounts and documentation from day one, keep exports current, and rehearse a handover. Continuity clauses help, but practical access matters more than promises.
Approve on Evidence, Not Enthusiasm
Run the 20 points on every shortlisted vendor, then the 10 evidence checks on the leader. If you want a scoped, reviewable proposal for a production or integration project, share your project brief with JUHENZA — we respond with questions, assumptions and boundaries before a price.
References
- Ministry of Electronics and Information Technology (MeitY) — Digital Personal Data Protection Rules, 2025 and enforcement timeline (notified November 2025).
- Ministry of Corporate Affairs (MCA) — company master data service.
- International Society of Automation (ISA) — ISA-95 Series of Standards: Enterprise-Control System Integration (Part 1, 2025 edition).
Regulatory mentions are informational, current as of November 2026, and not legal advice; consult a qualified lawyer for your project.