Know what you are buying.
A full review of a software company's technology for a buyer: what it is, what it will cost to own and run, what has to be fixed and how much that will cost. Written for the people who decide, with the detail engineers need.
- For
- Private equity, strategic buyers, search funds
- Timing
- Usually 2 to 4 weeks, inside exclusivity
- Fee
- Fixed, agreed before we start
- You get
- Report, fix plan, walkthrough
Inside exclusivity, before the price is final.
- You have a signed letter of intent and a limited window to confirm what you are buying.
- The product is the business, so the code and the team are part of the price.
- You plan to integrate, replatform or scale the product after closing and need to know the starting point.
- You are buying a business out of a larger group and need to know what it shares with its parent.
- Your lender, investors, board or insurer want an independent technical opinion on file.
Six layers, read in full.
Each layer with the kind of problem it most often hides.
- Ownership & IP
- Repositories, cloud accounts, domains, app store listings, third-party licenses, contractor assignments and an open-source license inventory. Typical finding: an AGPL component inside the hosted product, with no record of the obligations it brings.
- Infrastructure & cost
- Environments, deployments, backups with a restore test where possible, monitoring, the monthly bill and what will drive it as the business grows. Typical finding: costs look low because the parent company pays for shared hosting.
- Data & privacy
- Where personal data lives, who can reach it, retention, consent and the processors it flows to. Typical finding: the privacy policy promises deletion that the system cannot perform.
- Code & architecture
- Structure, tests, dependencies and their support dates, how changes reach production, and samples read line by line where risk sits. Typical finding: the framework is past end of support and the upgrade touches every module.
- Security & access
- Access and offboarding, secrets, multi-factor authentication, known vulnerabilities, incident history and what is monitored. Typical finding: an incident two years ago was fixed but never written down.
- Team & knowledge
- Key-person risk, documentation, contractors and what happens to the knowledge after closing. Typical finding: the founder still approves every release and plans to step back after the sale.
See our approach for how each layer is read and how we handle access.
Talking to the seller's team.
Documents show what the company says about itself. Interviews show how it actually works. We usually hold three to five conversations, scheduled through the seller or its advisor and only with their consent: the technical lead, the person who runs the systems day to day, a senior developer, someone who knows the product and its customers, and a key contractor where one exists.
We send topics in advance, keep each call short and never ask people about the deal itself. Many staff may not know a sale is under way, and we respect whatever boundary the seller sets.
What we listen for: whether the answers match what the repositories and the cloud console show, who answers which questions, and which questions only one person can answer. That last point is often the clearest measure of key-person risk.
Two to four weeks from access to walkthrough.
Scope and fixed fee
A call under NDA, then a written proposal: scope, exclusions, report date and one fixed fee. What changes scope is named up front: a second product, an unlisted business unit, a separate mobile codebase.
Access and documents
Read-only named accounts, the request list and a first read of the data room. Gaps are listed the same week.
Review and interviews
Code, infrastructure, security and data read in full; interviews with the team. Critical findings are raised with you as soon as we confirm them.
Report
Summary, findings register, layer-by-layer view and the fix plan with costs.
Walkthrough
With you, your advisors and, if you wish, your lender or insurer.
- Read-only access to repositories, the cloud console and billing, and the deployment pipeline.
- System overview, architecture notes and the list of third-party services and their contracts.
- IP assignments for staff and contractors, and any open-source license report.
- Security policies, access reviews, incident records, penetration tests or SOC 2 reports.
- The technical team list with roles, tenure and contractor status, without personal files.
A report you can act on.
- A two-page summary for decision makers: overall view, the findings that affect price or terms, and conditions to consider.
- A findings register: every finding with severity, evidence, business impact, cost and time to fix.
- A fix plan for the first 100 days and the first year, with cost ranges and the assumptions behind them.
- Points to raise with your counsel for the purchase agreement, and questions for the seller.
- A walkthrough with you, your advisors and, if you wish, your lender.
How a finding is written. Each one states the layer, a severity on our four-level scale, the evidence (what we saw and where), the business impact in plain words, and the cost and time to fix as a range with its assumptions, such as team size and whether the existing tests can be trusted. If an assumption turns out wrong, you can see how the estimate moves.
What buyers do with the findings.
We do not negotiate or give legal advice. These are the usual uses of a technical finding, and each is a point to raise with your counsel.
- Price
- A known cost to fix, such as an overdue framework upgrade, can be reflected in the price or in the working capital discussion.
- Escrow or holdback
- Part of the price held back until a specific issue is resolved or a period passes without it surfacing.
- Specific indemnities
- Protection for a known issue, such as an open-source license breach or a past incident, that general warranties and insurance may exclude.
- Conditions before closing
- Things the seller does before the money moves: transfer accounts into the company's name, collect missing IP assignments, remove former staff access.
- Covenants to closing
- How the seller runs the technology between signing and closing: no major releases or new vendor contracts without consent.
- The 100-day plan
- Most findings end here. The fix plan becomes the first technical budget and hiring plan of the new owner.
Insurers, integration and carve-outs.
The report is often read by more people than the deal team. We write it with them in mind.
Representations and warranties insurance
Underwriters typically ask what diligence was done and how deep it went. Their questions usually cover cybersecurity controls (multi-factor authentication, backups, incident response), past incidents, privacy compliance, IP ownership and open-source use. Areas that were not examined, and issues already known, are often excluded from cover. Our report states its scope and limits plainly, so the underwriting call has a clear record to work from.
Integration
If you plan to combine the product with your own, we look at identity and single sign-on, the data model, hosting, and vendor contracts with change-of-control or assignment terms. The fix plan then separates what the product needs anyway from what integration will add.
Carve-outs
A business bought out of a group often shares a cloud account, an identity provider, code repositories, licenses and people with its parent. We list each shared element, what it takes to separate, and what a transition services agreement would need to cover technically, as points to raise with your counsel.
Common questions.
How long does it take?
Usually two to four weeks from the day we get access, depending on the size of the product and how quickly the seller answers. We agree the report date in the proposal and tell you early if the seller's answers put it at risk.
Do you talk to the seller's team?
Yes, with the seller's consent and usually through a shared schedule. We keep interviews short, send topics ahead and never discuss the deal itself, since many staff may not know about it. If the seller limits who we can talk to, the report says which questions stayed open.
What if you find something serious mid-review?
We tell you when we confirm it, not at the end. A Critical finding can change your next step while exclusivity is running, for example a request for an extension, so it reaches you and your advisors as soon as it is confirmed, with the evidence.
Will you fix what you find?
Not as part of the review. If you want help after closing, our engineering partner PERETZ can do the work under a separate contract, and you are free to use anyone else. The fix is never priced inside the review.
Can our lender rely on the report?
Reliance is agreed case by case in writing. Tell us early if a lender, investor or insurer needs to rely on the report so we can include it in the engagement letter. Insurers usually ask to read the report during underwriting; the terms for sharing it with them are agreed in writing too.
Is this a penetration test or a SOC 2 audit?
No. We review security practice, access and exposure, and we read existing penetration tests and SOC 2 reports if there are any. If a dedicated test is needed, we say so in the findings and you can commission it separately.
We already had a red-flag memo. Do you start over?
No. Work done for a red-flag memo on the same company counts toward the full review. We go deeper where the memo sampled, add the interviews and checks a memo usually leaves out, and the proposal reflects what is already done.
The seller has a vendor due diligence report. Do we still need this?
A good vendor report makes your review faster, not unnecessary. We test its key claims against the systems, read what it did not cover and focus on what matters for your own plans after closing, such as integration or scale.
Do you value the company or advise on the price?
No. We describe the technology and what it will cost to own and fix. Your advisors and counsel decide how that affects price and terms. We are happy to explain a finding to them in as much technical detail as they need.
Preparing a sale or looking at a target?
We reply within one business day. NDA before any documents change hands.