Ask who does the work, exactly what ships each month, which accounts you will own, what the cancellation terms are, and for two current clients in your industry you can call. Vague answers to any of those are the answer.
Lead with the people question. Who will actually be in my account, are they employees or subcontractors, where are they, and will I talk to them or only to an account manager. Most bad SEO engagements are not scams, they are accounts handed to someone junior or outsourced with no context about your business. If the person on the sales call will never touch the work, ask to meet whoever will before you sign.
Then pin down the deliverables in writing. How many new pages a month. How much content and who writes it. Is my website included, and what does a site edit cost. Who manages the Google Business Profile. What reporting do I get and when. What are the first ninety days specifically. And the ownership questions: is the domain in my name, am I owner on Analytics, Search Console, the profile and the ad accounts, and do I keep the content if I leave.
Finally ask the uncomfortable ones. What is your cancellation policy. Can I talk to two current clients in my industry, not testimonials, actual phone numbers. What happened with a client where this did not work and why. How do you handle it if I am not seeing leads by month five. If anybody guarantees a ranking, claims a special relationship with Google, or will not name a current client, you are done. Those three are disqualifying.
Send the site over. We will tell you what is broken, what you could rank for, and whether AI search knows you exist. No charge and no pitch deck.