On the first stages of cooperation trust is the most important goal to be reached. And I do understand that despite all service company's sincere words about no lucrative interest in seizing of somebody's code, prospects might still have worries.

Traditional issues to be covered on due diligence stage are the following:

1) subcontractor's way of doing business

2) references from existing clients

3) contract's conditions

4) how a subcontractor prevents leak of misappropriation of data and IPRs

Besides, I would suggest the following risk-free start with a new testing subcontractor:

1) Start with black-box testing. Maximum you risk here is one copy of your product. You can always add white-box one, when you get trust in your partner.

2) Order testing based on a trial version of your product, if you have any. You risk nothing. Depending of the duration of your product's trail version, you may get results of exploratory or even full functional testing.

3) Experienced testers are able to conduct testing without getting to know internal documentation, e.g. software requirement specifications. User manuals and list of high level requirements will be enough to start with.

Anything else haven't I foreseen in risk-free plan?