Technical Due Diligence

Most engagements run one to three weeks. A focused pre-LOI red-flag review can be done in three to five business days; a full assessment of a mid-sized codebase with team interviews typically takes two to three weeks. We size the scope to your deal timeline and flag any blockers (missing repo access, unavailable founders) on day one.

A typical report covers: an executive summary with an overall risk score; a code and architecture review (quality, test coverage, maintainability); scalability assessment; security and compliance posture (including data handling under Canadian privacy law like PIPEDA); a quantified technical-debt estimate; team and key-person risk; an IP and open-source licence audit; and a prioritised list of red flags with remediation cost and timeline estimates. It is written for an investment committee, not just engineers.

A one-time, scoped technical due-diligence project typically runs $6K–$20K depending on codebase size, number of systems, and how many team interviews are needed — a quick pre-LOI red-flag review sits at the low end. Ongoing pipeline DD for active acquirers is a retainer from from $8,000/month; sell-side prep advisory is from $2,750/month. These are typical averages for planning only — actual cost is assessed per project and scope, and is not a guaranteed price. We quote a fixed fee after a brief scoping call so there are no surprises mid-deal.

Yes — most of our DD work is deadline-driven. If you are days from an LOI or a closing, we run a prioritised review that front-loads the deal-breakers (security exposure, architecture that cannot scale, key-person risk, licence contamination) and delivers a preliminary verbal readout within 48–72 hours, followed by the full written report. We schedule around your committee dates, not ours.

The ones that change deal terms: a single engineer who is the only person who understands the system (key-person risk), copyleft (GPL/AGPL) code linked into a proprietary product, no test coverage or CI on a system you are about to scale, hard-coded credentials or unpatched critical vulnerabilities, an architecture that cannot handle the buyer's projected growth, and technical debt large enough that the real cost of the asset is the price plus a rewrite. We rank each by severity and likelihood.

Reverse (or sell-side) due diligence is when a startup commissions its own technical assessment before raising a round or going to market for an acquisition. We run the same independent review an acquirer would, then help you fix or document the findings ahead of time — so you walk into the data room with no surprises and a cleaner technical story. Founders use it to defend valuation and shorten the buyer's diligence cycle.

We are independent. We do not take success fees, finder's fees, or any compensation tied to whether the deal closes — so our report is the same whether you proceed or walk away. That independence is the entire point: investors and boards trust a CTO-grade assessment precisely because it has no incentive to make the target look better or worse than it is.

The report is built for two audiences at once: a plain-language executive summary and risk score that an investment committee, board, or non-technical acquirer can act on, plus a detailed technical appendix your engineers (or the target's) can verify line by line. It is signed by a senior technologist, not a junior analyst, which is what makes it defensible in front of an IC or a lender.