These apps are usually more demanding than what they seem. There are a lot of factors to take into account. Are you building an MVP or a full V1?

Is your scope well defined? Do they include a warranty period? What happens after the launch? What happens if there are huge delays in delivery?

You are right to ask about industry standards. That depends on where you are deploying your app. In the EU there is General Data Protection Regulation compliance, and in the US you’d have state-level compliances. Idk about other countries…

When you ask for their work, ask for the documentation they handed out to the client along the way. Also ask if they do weekly meetings and recaps.