How to Background-Check an IT Provider in Texas

Start with the Texas Comptroller's Franchise Tax Account Status search. You can look up a company by name, by EIN, or by SOS file number, and it'll tell you whether the entity is in good standing, forfeited, or involuntarily terminated. A forfeited franchise tax status is a real red flag. It usually means the company stopped filing or stopped paying state taxes, and in Texas, a business whose charter is forfeited can lose its right to sue or defend itself in court. If you're about to sign a multi-year services agreement, you want to know the other party to that contract is actually in good legal standing to enforce it.

This step takes about ninety seconds. There's no excuse to skip it.

Next, confirm the entity's formation date, entity type, and registered agent through SOSDirect, the Texas Secretary of State's search portal. Searches run about a dollar each, which is cheap insurance against signing with a company that's barely a year old, operates under three different DBAs, or lists a registered agent address that's actually a UPS Store mailbox in another state.

What you're looking for: does the formation date match the story they told you in the sales call? If they said "we've been doing this for fifteen years" but the entity was formed eighteen months ago, ask why. Sometimes it's a legitimate reorg or a rebrand. Sometimes it's a provider that folded under a different name after a bad outcome with a previous client and is now operating fresh.

Any provider that touches your network should carry general liability and, ideally, technology errors and omissions or cyber liability coverage. Don't take "yes we're insured" at face value. Ask for a certificate of insurance (COI) naming your business, and call the carrier listed on it to confirm the policy is active. This is standard practice when you lease commercial space or hire a contractor to work on your building; it should be standard practice for the vendor managing your firewall and your Microsoft 365 tenant too. If you want more detail on what coverage actually matters for a cybersecurity vendor relationship, our cybersecurity services page breaks down what a modern COI should include beyond the boilerplate liability minimums.

References are easy to game if you ask soft questions. "Are you happy with them?" gets you a yes every time. Ask instead:

• "Walk me through the last time you had a real outage. How fast did someone pick up the phone, and how fast was it actually fixed?"
• "Did they ever miss an SLA commitment, and what did they do about it?"
• "Have you ever switched away from them, or watched a client of theirs switch? What did that exit look like, document handoff, data export, access revocation?"

That last question matters more than people think. A provider that makes offboarding painful, that drags its feet on exporting your data or revoking its own admin access, is telling you something about how it operates day to day, not just at the exit. If you're currently stuck with a provider like that, our guide on switching IT providers walks through how to get out cleanly.

A uniform wall of five-star reviews with no detail, no dates clustered naturally over time, and no mention of specific technicians or incidents is a signal, not proof of quality. Under 16 CFR Part 465, fake and purchased reviews are illegal, and the FTC has been actively enforcing against review manipulation. That doesn't mean every five-star review is fake. It means a perfect, undifferentiated review profile should prompt a question, not end one. Look for reviews that mention a specific problem getting solved, a specific person, a specific timeline. Those read like real experiences. Generic praise with no texture reads like something written to check a box.

Print this before your next vendor meeting, or keep it open on a second monitor during the call:

• Entity name and SOS file number confirmed on Comptroller franchise tax search: pass/fail
• Formation date and registered agent confirmed on SOSDirect: pass/fail
• Certificate of insurance obtained and carrier verified by phone: pass/fail
• Two reference calls completed, outage-response and exit-experience questions asked: pass/fail
• Reviews checked for specificity and natural variation in dates: pass/fail
• Compliance experience confirmed if you're regulated, ask directly about HIPAA or the FTC Safeguards Rule depending on your industry

If a provider balks at any of these requests, that's information too. A legitimate, established managed IT services provider should be able to produce a COI and a couple of references without a week of delay.

This routine confirms the provider is a real, solvent, insured business with a track record you can verify. It doesn't tell you whether their technical approach fits your environment, whether you need a fully outsourced model or a co-managed IT arrangement alongside your existing staff, or whether a virtual CIO relationship makes more sense than a straight break-fix contract. Background checking weeds out the obviously unqualified and the outright risky. The deeper evaluation, comparing SLAs, response times, and technical fit, still has to happen separately. Our guide on choosing an MSP in Houston covers that second layer of evaluation in more depth.

How long does a full background check IT provider routine actually take?

Realistically about thirty minutes if you have the provider's legal name and can get two references on the phone same-day. The Comptroller search and SOSDirect lookups each take a couple of minutes. The reference calls are where the real time goes, and they're worth it.

What if the provider is new and doesn't have long-standing references?

New doesn't automatically mean risky. Ask instead about the founders' prior experience, whether they've worked at other MSPs, and request references from their current clients even if the client relationships are short. A six-month reference that answers your outage-response question honestly is still useful.

Is a forfeited franchise tax status always disqualifying?

Not always, sometimes it's a paperwork lag that gets resolved quickly, but it's worth asking about directly and getting a specific timeline for resolution before you sign a multi-year agreement.

Should I background check a provider I'm already using?

Yes, especially if you've never done it. It costs almost nothing and it's a reasonable periodic check, the same way you'd re-verify insurance on a long-term vendor relationship.

Want a second opinion on a provider you're evaluating, or a straight assessment of your current setup? Request a free IT assessment or contact LayerLogix and we'll walk through it with you.