Core service
See the technical risk before you invest
Before you invest in or acquire a software company, you need to know the real state of the technology behind the product.
- Duration
- 1 to 2 weeks
- Model
- Fixed scope, confidential
- Output
- Investor-ready report
The questions this review answers
Technical due diligence shows what actually sits behind the product described in the pitch.
- Can the product technically reach the scale being claimed, or does it need a rewrite first?
- How large is the technical debt, and roughly how long would it take to fix?
- Does the system depend on the knowledge of a few people, and what happens if they leave?
- Are there known serious risks around security and data protection?
- Does anything in the open-source dependencies need attention from a licensing point of view?
- How will infrastructure cost change as the business grows?
Who it is for and how we work
The review is carried out on behalf of an investor, an acquiring company or a board. The report is written so that non-technical decision makers can read it: every finding comes with its business impact and remediation cost.
The work runs in confidence. Conversations with the target company’s team are kept to a minimum, and all access is read-only.
The goal is not to break a deal but to make sure it is done at the right price and on the right terms. Most findings can be fixed; what matters is knowing their cost in advance.
Scope
Included
- Architecture and scalability assessment
- Code quality and technical debt estimate
- Infrastructure, delivery and operational maturity
- Review of security practices
- Open-source licence inventory
- Knowledge concentration and key-person risk
- Infrastructure cost projection against growth
Not included
- Legal review and licensing opinion
- Financial audit
- Penetration testing
- Product and market assessment
How the review runs
- Days 1-2Access and scope. The NDA is signed, read-only access is opened and the investor’s priority questions are pinned down.
- Days 3-6Review. Code, infrastructure and processes are reviewed. Short interviews are held with the target company’s technical leads.
- Days 7-8Analysis. Findings are classified by risk level and remediation cost.
- Days 9-10Report. An executive summary and a detailed findings report are delivered, followed by a presentation to the decision makers.
What you receive
The report is written for the people making the investment decision; technical detail sits in the appendix.
Who this service is not for
- Parties looking for a favourable report to justify a deal. The report says what we found.
- Cases where the target company will not grant access. A review without seeing the code and infrastructure is little more than an estimate.
- Organisations looking to redesign the architecture. System Modernisation is a better fit for that.
Frequently asked questions
Does the target company know about the review?
Yes. Access to code and infrastructure is opened with the target company’s consent. The work is confidential, but it is never carried out without the other party’s knowledge.
Who receives the report?
The party that commissioned the work. You decide whether the report is shared with the target company.
How quickly do we get results?
A typical review takes one to two weeks. In urgent cases, a preliminary report with the priority findings can be delivered earlier.
Which technologies can you review?
Mainstream backend ecosystems, above all .NET, Go and Python; AWS, Azure, Google Cloud and self-hosted infrastructure.
Do you sign an NDA?
Yes, before work starts, with both the commissioning party and the target company.
Let’s talk about your deal timeline
In thirty minutes you describe the structure and timing of the investment; we settle the scope and duration of the review.