Should a Custom AI Development Company in USA Get Production Access?

[RemoteState]

Okay putting everything on pause for a sec because this just happened and I need a gut check from people who've actually been through it.

Three days into contract talks with a custom AI development company for an anomaly detection thing we need, and they just asked for full production access. Before we've even signed anything. Their reasoning was they "need to see the live data flow to scope it properly" which, sure, maybe that's normal? But handing over prod access with no signed contract feels way too early to me. Am I overreacting here?

Never hired a custom AI development company in USA before so I truly have nothing to compare this to. Could be totally prepared for all I know.

Digging Into Whether This Is Normal​

around a bit and poked through some threads on how custom AI development services deals usually handle this stuff. Here's what I'm piecing together so far:

• Most decent teams start with read only access or a staging setup, not full prod, and definitely not before contracts are locked in
• If a custom AI development company needs full write access just to scope a project, that honestly says more about their process than it does about the project
• There should be a real security protocol here. NDA, defined boundaries, who exactly touches what. Not a random ask over email like it's no big deal
• A serious custom AI development company in USA should be able to explain why sample data or a sandbox wouldn't work just as well for scoping
• Contracts for custom AI services development need to spell out access levels clearly, who gets in, for how long, all of it
• A lot of teams can scope this stuff fine using anonymized or synthetic data. Worth asking if that's even an option before giving up anything real

Where I'm At​

Told them straight up, staging environment first, we'll talk prod access after that. Still waiting to hear back. If anyone's dealing with this exact situation with a custom AI development company, truly want to know how it went. Did you push back? Did they walk? Kind of need to know what normal looks like here before we go further.