To the original poster: Please do not send any personal information to this person - or anyone else - until you have vetted the person/company. Anything you send should have a password or some other security.
I will add to Griswold's comment that the rules for determining whether service provider is an IC are objective and set out in regs, e.g number of other clients, not related to service recipient, etc. Need to review in regs; somewhat detailed.
Is this a post-termination consulting arrangement with a a former service provider? Or a standalone agreement with an independent contractor?
If a true independent contractor, they're generally exempt from 409A if the provide significant services to other unrelated parties.