Three Retool agencies sent proposals, and all three look the same. Each has a portfolio, a partner badge, and a demo that went well. Your security team wants evidence, procurement wants a comparison, and the operations team wants a date.
The pitch will not separate them. What separates them is what each can show you on paper before you sign: how they design, secure, integrate, and hand over a Retool app.
Three ways buyers usually decide
On the demo. A demo shows the agency can build screens quickly in Retool. It says little about what happens when the app meets your identity provider, your audit requirements, or your fifth integration.
On references. A reference call tells you the last client was happy. Ask what the reference's app does, how many systems it touches, and who maintains it today. A happy client with a simpler app is weak evidence for a harder one.
On artifacts and a pilot. You ask for the documents an agency produces on every engagement. Then you run a short, paid piece of work with agreed success measures. This takes longer to set up, and it is the only one of the three that tests the work itself.
What to ask for
Ask for artifacts, and read them before the call.
Architecture
A redacted architecture diagram from a recent Retool project, with data flow and access boundaries marked. Ask how they version Retool apps, how they separate development from production, and what their recovery targets are.
Security and compliance
How they connect Retool to your identity provider through SSO, how roles map to your directory, and how audit logging is set up. If you operate under GDPR, ask how they handle a data subject request inside a Retool app. Ask for their data processing agreement template.
Integration depth
A sample integration specification with error handling and retries. Ask which of your systems they have connected before, and what they do when an API they depend on is late or changes.
Code quality and review
How changes reach production. Source control, branch strategy, and who reviews what before release. Ask how they test a Retool app, and what they do with medium or high findings from a security review.
Engagement model
How often you see working software, who your single point of contact is, and how bad news reaches you. Ask what happens when your requirements change mid-build, and what a clean exit looks like.
What good answers sound like
Good answers name systems and show documents. Here is one: "We connect Retool to Okta through SSO and map roles to your directory groups. Every write is logged with actor and before and after state." An answer like "we follow best practice" names nothing you can check.
At Saxo Bank, Launchpad connected three tools the creative team already used: Zuuvi for asset previews, Bynder for approved assets, and Podio for project tasks. Each integration synced in both directions. The platform handles 970 creative submissions and 5,800 format variations a year. Time to market fell 78.3%, and review cycles fell 86.1%, from 8.1 days to 1.1.
That is the level of detail to expect from any agency's case work: named systems, volumes, and a before and after.
Questions for the vendor call
Can you share a redacted architecture diagram from a recent enterprise Retool project?
How do you handle a GDPR data subject request inside a Retool app?
Show us an integration specification with error handling and retry logic.
How do you measure performance after launch, and what triggers an alert?
What happens when our requirements change mid-engagement?
Can the first piece of work be a paid pilot with success measures and an exit?
How does our team learn to maintain the app, and who owns the code and the schema?
A freelancer or an agency?
Some projects do not need an agency. A small tool with one data source, no audit requirement, and a patient timeline suits a good freelancer. The questions above still apply, scaled down. Retool certified partner or freelancer covers that choice in more depth.
An agency earns its cost when the app touches three or more systems or sits under GDPR or financial services rules. It also earns it when the app has to run without its original builder.
Our view
We recommend judging agencies on artifacts and a paid pilot, because both test the work rather than the pitch. Ask for the documents, read them with your security lead, and give the strongest candidate a scoped first piece with an exit.
Your product owner should run that pilot and make the call. The agency that makes their job easier during the pilot is usually the one to hire.
