Tell your story first.
Vendor due diligence is the same independent review a buyer would order, commissioned by the seller before going to market. You see the findings first, fix what you can, and give buyers a report that answers their questions before they ask.
- For
- Founders, boards and their M&A advisors
- Timing
- Usually 3 to 5 weeks
- Fee
- Fixed, agreed before we start
- You get
- Seller report, buyer report, Q&A support
Surprises late in a deal cost the most.
When a buyer's reviewers find a problem during exclusivity, it usually becomes a lower price, a larger escrow or a deal that stalls. You have the least room to move at that moment, and the least time. The same problem found months earlier is a line in a fix plan.
- You learn what buyers will find while there is still time to act.
- Buyers get a structured report instead of hundreds of questions, so the process moves faster.
- Your advisors can position known issues honestly, with a plan and a cost attached.
- Every buyer gets the same facts, which keeps the competition between them about price.
- Your team answers fewer questions and keeps running the company.
What buyers' reviewers look for first.
All six layers, read in full. These are the findings sellers most often fix before launch.
- Ownership & IP
- Accounts and code in the company's name, signed assignments, licenses in order. Typical finding: domains and the app store account registered to a co-founder who left.
- Infrastructure & cost
- A clear picture of hosting, recovery and the real monthly cost. Typical finding: backups exist, but no restore has ever been tried.
- Data & privacy
- Personal data mapped, retention set, test copies masked. Typical finding: a marketing tool receives more customer data than the privacy policy discloses.
- Code & architecture
- Support dates, tests, and how hard the product is to change. Typical finding: a mobile app on a framework version the stores will soon stop accepting.
- Security & access
- Offboarding, multi-factor authentication, secrets, incidents. Typical finding: one shared admin login used by staff and an agency.
- Team & knowledge
- Who knows what, and what is written down. Typical finding: the deployment process exists only in one engineer's head.
Why buyers trust a seller-paid report, or do not.
Experienced buyers have seen seller reports that read like marketing: vague, written by a friend of the company, silent on anything uncomfortable, with a scope drawn to avoid the hard parts. They discount those reports and start again. A vendor report is worth paying for only if a buyer's reviewers can build on it.
- Our fee is fixed and paid whatever happens to the deal. There is no success fee.
- We disclose any relationship with the company and decline when it could affect our view.
- Every finding carries evidence, so a buyer's reviewer can check it rather than take our word.
- Problems are rated on the same scale a buyer's report would use, including the uncomfortable ones.
- The seller may correct errors of fact before release. It does not edit ratings or remove findings.
- The scope and the limits are stated: what we read, what we sampled, what we could not see.
- Buyers' reviewers can put their questions to us directly during the process.
Two reports from one review.
- Seller report
- The full findings, with what you may want to fix before launch, the cost and time of each fix, priorities and notes for your advisors. For you and your advisors only.
- Buyer report
- A factual report on all six layers, written to be shared in the data room under the usual confidentiality terms.
- Q&A support
- During the process we help answer technical questions from buyers, so your team keeps running the company.
Seller report and buyer report. Both come from the same review and the same facts. The buyer report describes the system, lists the findings with their severity and evidence, records what was fixed after the review and states the plan for what remains. The seller report adds what a buyer does not need: our advice on what to fix first, how long it takes and how to present what cannot be fixed in time. The buyer report never says anything different from the seller report. It only says less.
Reliance by a buyer or its lender, where wanted, is agreed in writing case by case. Findings are written the way they are in every engagement: see the report.
Where it sits in your advisor's process.
Review
We start before your advisor contacts buyers. Three to five weeks of review, then the seller report.
Fix and finalize
You fix what can be fixed in time. The buyer report is finalized, and its summary can inform the technology section of the information memorandum.
Release
The buyer report goes into the data room for the bidders your advisor chooses, often the shortlist after indications of interest.
Q&A support
The winning buyer's reviewers start from our report. We answer their technical questions and join their calls, so confirmatory diligence is shorter.
Refresh
If months pass, we can update the report so it still describes the company as it is.
Light on your team, careful with the secret.
Most sellers keep a planned sale confidential from most of the staff. We work with a small group you choose, phrase our requests to fit that boundary and schedule interviews through one contact. Usually that means read-only access to repositories, the cloud console and billing, the list of third-party services and contractors, IP assignment records, security policies and any existing assessments, and three to five short conversations with the people who build and run the product.
The fee is fixed and set on a scoping call under NDA, from the size of the product and the number of codebases. A second product or a business unit added later is agreed in writing before we read it.
Answers during the process.
Technical questions from bidders usually arrive through the Q&A tool of your advisor's data room, often in batches and often the same question from several buyers. We draft technical answers for your approval, point to the evidence behind them and keep a log, so every bidder gets consistent facts. When a buyer's reviewers want a call, we join it with your technical contact.
We answer questions of fact about the technology. We do not negotiate, comment on price or speak for you on terms. That stays with you and your advisor.
Common questions.
Will buyers trust a report the seller paid for?
They trust a report that is factual, specific and shows the problems as well as the strengths. Our fee is fixed and does not depend on the deal, every finding carries evidence, and buyers are free to check anything we wrote or put questions to us directly.
When should we start?
Ideally before your advisor starts approaching buyers, and early enough to fix the main findings. If there is more than six months, consider exit readiness first; it fixes the findings over months and ends with a mock review that makes this one shorter.
Do we have to share bad news?
The buyer report states facts. Many findings can be fixed before launch, and the ones that remain are better presented with a plan and a cost than discovered by the buyer during exclusivity, when you have the least room to respond.
Can we edit the buyer report?
You can correct errors of fact, and you can fix issues so the report records them as resolved. You cannot change a rating or remove a finding. That rule is what makes the report useful to buyers, and so to you.
Will buyers still do their own review?
Usually yes, but a shorter one. A buyer's technical due diligence team can start from our report, test its key claims and focus on their own plans after closing, instead of building the picture from nothing. Your team answers each question once.
Who sees the seller report?
Only you and the advisors you name. It contains our advice on priorities and positioning, which a buyer does not need. The buyer report is the version that goes into the data room, released to the bidders your advisor chooses and under the confidentiality terms of the process.
How much of our team's time does it take?
One technical contact to arrange access and answer follow-up questions, plus three to five interviews of about an hour each. During the process, Q&A support takes most technical questions off your team, who only confirm facts we cannot see ourselves.
What if the review finds a Critical issue?
You hear about it as soon as we confirm it, with the evidence and a cost and time to fix. Better now than during exclusivity. Many Critical findings, such as accounts held in a personal name, can be fixed before launch.
Can you also fix the findings?
Not inside the review. Your own team or any other can do the work; our engineering partner PERETZ can do it under a separate contract. The buyer report records what was fixed, whoever fixed it, and we check every fix the same way.
Preparing a sale or looking at a target?
We reply within one business day. NDA before any documents change hands.