Contact us

Technical due diligence

Technical Due Diligence for Startups and Investors

A one-off review of the technology behind a company, written as a verdict you can act on. Founders use it to fix problems before a round. Investors use it to price the risk before a deal.

How the diagnostic works
  • Read-only access under NDA
  • The CTO reads the code. No automated scan
  • Fixed price agreed before work starts

What is technical due diligence?

Technical due diligence is an independent review of a company’s technology before money changes hands. A senior engineer checks the code, architecture, infrastructure, security, tech debt and the team that maintains them. The output is a written verdict on what the technology is worth keeping, what it will cost to fix and what could block the deal.

It happens before a funding round, an acquisition or a large customer contract. Either side can order it.

The full technical due diligence checklist

What does technical due diligence cover?

It covers the code and architecture, security and access, infrastructure and deployment, data and payment flows, tech debt, how the developers work, and who owns the code. Each area is judged by what it means for the deal: a risk to price in, a fix before closing, or something worth keeping.

The areas a technical due diligence report reviews
AreaWhat is checkedWhy it matters for the deal
Code and architectureStructure, data model, how parts depend on each otherDecides whether the product can grow or needs a rebuild
Security and accessAuthentication, access rules, secrets, who can reach productionBreaches and exposed data become liabilities after closing
Infrastructure and deploymentHosting, backups, monitoring, how releases reach productionShows whether the product survives an outage or a key person leaving
Data and payment flowsWhere money and personal data move, and what happens on failureSilent failures here cost money and trust
Tech debtShortcuts that slow every change, ranked by costTurns “messy code” into a number of work packages
Team and processHow the developers work, review and releaseThe team carries the product after the deal
Ownership and licencesWho owns the code, which open-source licences applyUnclear ownership can block a deal

Founder-side vs investor-side technical due diligence

Founder-side diligence is ordered by the company before a round, so problems are fixed before an investor finds them. Investor-side diligence is ordered by the buyer or fund to price risk and set conditions. The checks overlap. The audience, the timing and what happens with the findings differ.

Founder-sideInvestor-side
Who orders itThe founder or the companyThe fund, the buyer or their adviser
GoalFind and fix problems before anyone else sees themPrice the risk and set conditions for the deal
WhenBefore the round opensAfter a term sheet, before closing
Who reads the reportThe founder, then selected investorsThe investment team
OutputFix list ranked worst first, a 30/90-day plan, a short note for investorsA verdict on risks, their cost and what must happen before closing
AccessRead-only, granted by the founderRead-only, agreed with the company

What do you get from a technical due diligence report?

You get a written verdict in plain English with findings ranked by business risk, worst first. Each finding says why it matters and what to do. You also get a 30-day and a 90-day plan, a debrief call with the CTO who did the review, and a short note an investor can read.

  • An executive verdict in a few sentences, written for a non-engineer.
  • Priority findings, each with why it matters and what to do.
  • What is solid and worth keeping, so nobody proposes a rebuild by reflex.
  • A 30-day and a 90-day plan the developers can follow.
  • A debrief call with your CTO.

Is a code audit the same as technical due diligence?

A code audit is one part of it. It reads the source code for defects, security gaps and maintainability. Technical due diligence adds infrastructure, data flows, tech debt in business terms, the team, code ownership and a verdict for the deal. A secure code review fits inside both.

If your product was built with AI tools and you mainly need to know whether it is safe for paying customers, a code audit is often enough. It is the lighter option below.

Who runs the technical due diligence?

Stas Gorshenin leads diligence for investors. He has run technology due diligence on seven retail and retail-tech deals for private equity funds, covering architecture, tech debt, team and security. He has twenty-one years in retail technology, nine of them as CTO or VP Engineering, and since 2023 has worked as a fractional and interim CTO.

For startups outside retail, we propose the person on the team whose background is closest to the product. You see their profile before you agree to anything.

Meet the Fractional CTO team

How the technical due diligence process works

It starts with a call to agree the scope and the fixed price. You grant read-only access under NDA. The CTO reads the code and infrastructure themselves, with no automated scan standing in for judgement. You get the written verdict and a debrief call, and you can revoke access when it ends.

  1. Scope call

    What the deal is, who will read the report and which areas matter most.

  2. Read-only access

    Repository and infrastructure access under NDA. Nothing changes in production.

  3. Review

    Code and architecture, infrastructure, security, data and payment flows, and how the developers work.

  4. Verdict and debrief

    The written report, a debrief call and, for founders, a short note for investors.

What does technical due diligence look like in practice?

A 25-person US software company was buying a niche SaaS product whose code and production accounts sat with an outside agency. Our CTO traced who owned the code and tested whether the buyer could deploy the product alone. The gaps became two closing conditions, and the buyer held $600,000 in escrow until both were met.

  • $600,000 tied to two technical closing conditions

    The buyer kept $600,000 in escrow until it controlled the software

    A 25-person US software company was about to acquire a niche SaaS product whose code and production accounts were still controlled by an outside agency. Our CTO traced ownership of the code and tested whether the buyer could deploy the product independently. He turned the gaps into two conditions the buyer's lawyers could put in the deal: signed IP assignments and a successful deployment from accounts the buyer controlled. The buyer closed with $600,000 held in escrow until both conditions were met.

    Client name withheld.

Need a lighter check than full due diligence?

If you built the product yourself with Cursor, Lovable or Bolt and want to know whether it is safe to launch, start with the audit for AI-built apps. It starts from $199, needs no call and covers security, payments and production readiness. Full due diligence is for a deal.

Audit an AI-built app from $199

Is your situation a little different?

Diligence often surfaces a second question. Is the development quote for the fixes sound? Or the vendor who built the product is gone and someone needs to take it over. These pages cover both situations, and the hub explains the diagnostic and the four technical leaders on the team.

Frequently asked questions

Yes. Stas Gorshenin has run technology due diligence on seven retail and retail-tech deals for private equity funds, covering architecture, tech debt, team and security. For other sectors we propose the team member whose background fits the product. The scope and a fixed price are agreed on the first call.

Yes. You find problems before an investor does and fix them on your own schedule, before they become a negotiating point. The report includes a short note written for investors, so you can share the state of the technology without handing over the full findings.

Read-only access to the repository and infrastructure, under NDA. Nothing changes in production. On investor-side work, access is agreed with the company being reviewed. Your developers keep working as usual while the review runs. You can revoke access the day the review ends.

A secure code review looks for security defects in the source code. Technical due diligence includes that, then adds architecture, infrastructure, tech debt, the team, code ownership and a verdict for the deal. If you only need the security part for an AI-built app, the audit from $199 is the lighter route.

Tell us about the deal

Say which side you are on, what is being reviewed and when the decision is due. On a 30-minute call we agree the scope and propose the CTO whose background fits the product.

Prefer to talk?

Let’s talk