Excellent point on security not being an add-on. In Canada with PIPEDA compliance, data residency and secrets management questions should come up in the first call, not after launch. Would add one more evaluation tip: ask for Architecture Decision Records from past projects. It instantly shows whether a team makes thoughtful tradeoffs (modular monolith vs microservices, Postgres vs Mongo) or just follows trends