Generally anytime someone asks "legit?" it is should raise a red flag. If you have to ask that is a good sign it probably isn't. A good solid company you don't have to worry about usually doesn't elicit "is this legit?". Though I am glad to see the company has responded, meaning maybe they are more likely legit or at least legit enough to care to respond and interact with potential clients.