Book a Call
A mispriced deal or a post-close rewrite is a six-to-seven-figure mistake. Technical due diligence is a fixed fee with a delivery date — a defensible go/no-go/reprice read on the target's technology, delivered while your exclusivity window is still open.
What you walk away with
- IC/lender-ready scored report — signed by a senior technologist.
- Remediation debt — quantified in engineering-months and dollars.
- Founder-dependency and key-person read — what breaks if they walk.
- Preliminary verbal readout in 48–72 hours — so your exclusivity clock keeps moving.
What we assess — beyond the codebase
A codebase review alone is not due diligence. The report scores the target across eight dimensions — the same surface a PE fund's diligence team will probe:
Software & systems inventory
Every custom product, third-party platform, and the SaaS estate behind them — what the business actually runs on, and what it costs to run.
Architecture & infrastructure maturity
Cloud posture, CI/CD, monitoring, single points of failure — and whether it scales against your growth case.
Code quality & open-source exposure
Maintainability, test coverage, and copyleft licence contamination that changes what you actually own.
IP ownership & vendor contracts
Employment and contractor IP assignments, platform agreements, and who keeps the data when a vendor relationship ends.
Security posture & policies
Credential practice, access control, incident response, certifications — what is adopted versus what is on paper.
Data & governance
Data classification, client-data separation, and privacy obligations (PIPEDA, GDPR, HIPAA where they apply).
Operations & resilience
Backups, disaster recovery, RPO/RTO, retention — tested, or theoretical.
Team & key-person risk
Who holds the system in their head, what breaks if they walk, and whether the roadmap is credible without them.
Fixed fee, sized to the target
Standard
$7,500
- ✓One product and the infrastructure behind it
- ✓Target engineering team up to 10
- ✓Up to 4 team interviews
- ✓All eight assessment dimensions
- ✓Two weeks, deal-clock aligned
Extended
from $15,000
- ✓Multiple products, codebases, or cloud estates
- ✓11–40 engineers, or compliance-heavy scope (SOC 2 / HIPAA)
- ✓All eight assessment dimensions
- ✓Three weeks
Undisclosed codebases or products discovered mid-engagement are re-quoted before work continues. Work beyond these caps is billed at $350/hr — agreed in writing first.
Thirty minutes to confirm the target's footprint — then a fixed fee and a delivery date.
How the report holds up
- Signed, scored, and defensible — the report is written for an investment committee or lender and signed by the senior technologist who did the work.
- Priced before we start — by the target's technical footprint, not by the hour, and never as a percentage of the deal. No success fees, ever.
- Deal-clock aligned — the preliminary verbal readout lands 48–72 hours after we get access, while your exclusivity window is still open.
- Remediation in real units — technical debt quantified in engineering-months and dollars, so it feeds your model, not a footnote.
The Reyem Tech ladder
Pick the rung that matches where you are. Each step is a real, productized engagement.
Technical Due Diligence FAQs
Most engagements run one to three weeks. A focused pre-LOI review can be completed in three to five business days; a full assessment of a mid-sized codebase typically takes two to three weeks, depending on the agreed scope and the time needed to receive requested access and materials. Kickoff and delivery meetings are included. Additional team interviews may be separately scoped in exceptional cases, but are not guaranteed. We flag access or material blockers during the engagement.
A typical report covers: an executive summary with an overall risk score; a code and architecture review (quality, test coverage, maintainability); scalability assessment; security and compliance posture (including data handling under Canadian privacy law like PIPEDA); a quantified technical-debt estimate; team and key-person risk; an IP and open-source licence audit; and a prioritised list of red flags with remediation cost and timeline estimates. It is written for an investment committee, not just engineers.
Yes. We can prioritize decision-critical areas when a deal timeline is tight, but we set the review plan and delivery date during scoping. The preliminary verbal readout follows once we have received all requested materials and completed the review; timing may shift if inputs or access are delayed.
The ones that change deal terms: a single engineer who is the only person who understands the system (key-person risk), copyleft (GPL/AGPL) code linked into a proprietary product, no test coverage or CI on a system you are about to scale, hard-coded credentials or unpatched critical vulnerabilities, an architecture that cannot handle the buyer's projected growth, and technical debt large enough that the real cost of the asset is the price plus a rewrite. We rank each by severity and likelihood.
Reverse (or sell-side) due diligence is when a startup commissions its own technical assessment before raising a round or going to market for an acquisition. We run the same independent review an acquirer would, then help you fix or document the findings ahead of time — so you walk into the data room with no surprises and a cleaner technical story. Founders use it to defend valuation and shorten the buyer's diligence cycle.
Standard ($7,500) covers one product or codebase, a target engineering team of up to 10, with kickoff and delivery meetings included; additional team interviews may be separately scoped in exceptional cases but are not guaranteed, delivered in two weeks. Extended (from $15,000) covers multiple codebases or products, 11–40 engineers, or compliance-heavy scope such as SOC 2 or HIPAA, delivered in three weeks. Both tiers cover all eight assessment dimensions — from architecture and security to IP, data governance, and key-person risk — and end in the same IC/lender-ready scored report; the scoping call confirms which tier fits the target's footprint.
The scoping call confirms the target's technical footprint, requested materials, access, and available interviews. We then provide a fixed fee, delivery date in writing, and an access checklist. Review starts once the agreed access and requested materials are available; any timing adjustment is discussed promptly if inputs are delayed or scope changes.
The preliminary verbal readout follows once we have received all requested materials and completed the review. We agree on the written report date during scoping, based on the target's footprint and expected access; timing may shift if required materials, system access, or participants are delayed.
The fee is set by the target's technical footprint before work starts, not by the hour — so there is no meter running mid-deal. And it is never a percentage of the transaction: no success fees means the report reads the same whether you close or walk away, which is exactly what makes it defensible in front of an investment committee or lender.
Undisclosed codebases or products discovered mid-engagement — anything outside the footprint confirmed at scoping. Work pauses while the addition is quoted, so the fee never silently grows. Work beyond the tier caps (extra interviews, additional systems) is billed at $350/hr, agreed in writing first.
New to technical due diligence?
What a DD report covers, the red flags that change deal terms, and how sell-side prep works — the full guide.