Technical Due Diligence Session

Buyers, investors, and acquiring companies evaluating a business with a meaningful website, codebase, or software product before a deal, as well as owners who want an independent technical read before going to market.

Codebase quality and architecture, hosting and infrastructure, security posture, third-party dependencies, domain and account ownership, and licensing. We adapt the scope to the specific business.

Most engagements take 5-10 business days from intake to the findings session, depending on the size and complexity of the codebase.

We typically work from a read-only copy of the codebase and documentation under NDA. Production access is rarely necessary.

Yes. Everything is covered by an NDA, and findings are shared only with you and whoever you authorize.

A written findings report covering technical risk, ownership issues, and estimated remediation costs, plus a live session to walk through it and answer questions.

We don't negotiate on your behalf, but we give you the specific, evidence-based points you need for your own negotiation or advisors.

We flag it immediately, not just in the final report, so you have time to act before the deal timeline forces a decision.

Due diligence looks at someone else's business before a deal: what you are about to buy or invest in, what it will cost to run and fix, and what will not transfer at closing. The digital ownership audit asks similar questions about your own business when no deal is planned, while gaps are still cheap to close. It costs from $1,000, or from $3,000 for larger businesses; the due diligence session costs $1,500 and a full review from $7,500.

No. Financial and legal due diligence verify revenue, contracts, liabilities and corporate structure. Technical due diligence covers the layer they were not built to check: the code, the infrastructure, the dependencies on vendors and people, and what a buyer would have to rebuild. Where we find gaps in ownership of code or accounts, we list them so that your lawyers know which documents to request.

We trace where the capability actually lives: in a call to an external model behind a prompt, or in proprietary data, retrieval, orchestration and evaluation built around the model. Using a third-party model is not a problem in itself. The risk is a business priced as a deep, defensible AI capability while its product is a thin layer, and we also look at what happens to the product and its margin if the model provider changes its pricing or terms.

They make parts of it faster. AI-assisted code reading helps a reviewer understand a legacy codebase in less time, which was not possible a few years ago. It does not show who owns the domain and the accounts, which former contractors still have production access, whether the data is clean or whether a licence or an API contract will transfer to a new owner. Those answers come from checking the real accounts, data and documents.

Then the conclusions about code quality and security cannot be verified, and we say so rather than guess. Ownership of the domain, the hosting and outside services can still be partly checked, but a review without the code is a weaker basis for a price. A seller who refuses to show the code to a reviewer under NDA is itself a fact worth discussing with your advisers.

Secure them before changing them. In the first 30 days transfer ownership of the domain, hosting, repositories and accounts, rotate credentials, remove former users and check the backups. Then find out which pages, integrations and data bring leads and revenue, and only after that decide what to merge, rebuild or retire. A redesign in the first months is one of the most common ways to lose what the price was paid for.