Part of CTO consulting
Technical due diligence in one week, for investors and acquirers.
A demo does not show who owns the code, what the cloud bill does as users grow, or how much an AI tool wrote that nobody read. We find out in one week.
- One week with the scope agreed first
- A written report with the risks ranked
- Read-only we change nothing
- One call to walk you through it
What does technical due diligence check?
It checks what an investor or acquirer cannot see from outside: the architecture, the code, security, the infrastructure and the team, and how much code was AI-generated and who read it. It takes one week and ends in a written report with the risks ranked.
Who it is for
You need this if
- You are about to invest or buy, and nobody on your side has read the code.
- The deck says the platform scales, and you cannot check it.
- AI tools or contractors wrote much of it, and nobody knows who reviewed what.
- You are the founder, and want to see what investors will find first.
Included
What you get
- A written report, findings ranked by risk, each with the evidence and the fix.
- Architecture checked against the roadmap.
- Security, secrets in the history, personal data and backups.
- Tests, releases, licences, and what only one person can explain.
- The AI question, answered from the pull requests and who reviewed them.
Timeline
How technical due diligence runs
-
Before the week
Agree the scope
The questions the deal turns on, the systems, the people and read-only access.
-
During the week
Read the code
The repository and its history, the infrastructure and its bills, the pipeline and the dependencies.
-
During the week
Talk to the team
Where what they say differs from what the code shows, the report says so.
-
End of the week
The report and a call
What to fix before close, what to price in and what is sound.
Price
What technical due diligence costs
- First step
- Technical due diligence in one week, with the scope agreed first
- Then
- Priced on request, by the systems in scope
Fixing what we find is separate work, and we do not bid for it unless you ask.
Questions
Common questions about technical due diligence.
Who is it for?
Investors and acquirers, typically at seed and Series A, and founders preparing to raise.
Is it a penetration test or a compliance audit?
No. Where you need one, the report says which. It sits beside legal and financial diligence.
How do you tell how much of the code was AI-generated?
From the pull requests, the reviews and the tool configuration, not detectors. Code nobody has read is the risk, not AI-written code itself.
What if the codebase is too big for one week?
We narrow the scope to the systems the deal turns on, or quote a longer review, before the week starts.
One way forward.
Thirty minutes with a builder, not a salesperson, to work out whether we are the right team for it. If we are not, we will say so.