Technical due diligence: what buyers and investors miss

Technical due diligence is the process of examining a company’s software, engineering, and technical operations before you buy it, invest in it, or bet a partnership on it. It exists to answer one question a pitch deck can’t: is the thing that generates this revenue actually built to survive the growth you’re paying for, or is it held together in ways that break the moment you scale it?

Most weak due diligence fails the same way. It reviews what’s easy to see, a feature list, a team org chart, an uptime number, and skips what actually predicts risk. Below is what a review worth commissioning looks at, drawn from building and inheriting real systems rather than from a checklist template.

What a real technical review examines

Ownership and licensing of the code. The first question is deceptively simple: does the company own what it says it owns? That means checking who wrote the code, whether contractor agreements actually assigned IP, and what open-source licenses the codebase depends on. A product built on copyleft dependencies such as AGPL or GPL can carry obligations that clash with how the acquirer intends to distribute it. This surfaces late and expensively when it isn’t checked early.

The gap between the demo and the system. A product can demo flawlessly and still be a prototype underneath: no tests, no deployment automation, data structures glued together to look right on stage. That gap is invisible from the outside and decisive after the deal. The tell is operational, not visual. Ask how a change reaches production, how they know when something breaks, and how long recovery takes. The answers separate a real system from a convincing one.

Key-person risk. In a lot of small companies, the entire architecture lives in one or two people’s heads. If the review can’t reconstruct how the system works from the code and its documentation alone, you’re not buying a system, you’re buying the availability of specific individuals. That risk has to be priced.

Security and data handling. Not a compliance checkbox, but the concrete questions: where does sensitive data live, who can reach it, how are secrets managed, and what happens in a breach. For any company using AI features, this now extends to the model layer, and public frameworks give you a spine to assess against. The NIST AI Risk Management Framework covers governing and measuring AI risk, and ISO/IEC 42001, published in December 2023, is the certifiable management standard for it. A target with AI in production and no answer to “what data feeds this and who owns the risk” is a finding, not a footnote.

Scalability where it actually bites. Not vanity load numbers. The real question is where this specific architecture breaks under this specific growth curve, and what it costs to fix before it does.

Why the AI question now sits inside every review

Even non-AI companies now embed AI features, and each one is a data-handling and reliability question wearing a product label. A support bot that quietly logs customer data to a third-party model, a pricing feature no one can explain, an agent with no cap on what it can do: these are due-diligence findings that didn’t exist a few years ago. Assessing them well is close to what an AI readiness audit does, and increasingly technical due diligence and AI assessment are the same review looked at from two directions.

Why we’re credible on this

We do this from the builder’s side of the table, which is the useful side. We build production software for a living, so we know exactly where outsourced and rushed builds hide their problems, because we’ve been handed the cleanup. Our full-cycle delivery work, like the SingSafe build we took from nothing to a deployed, schema-complete production site, is the same discipline in reverse: knowing what a healthy system looks like end to end is what lets you spot an unhealthy one fast.

If you’re evaluating a company’s technology before a deal, the value of the review is entirely in whether it looks where the risk actually hides. A report that confirms the team is nice and the app loads tells you nothing you couldn’t get from a demo. One that tells you what breaks, what you don’t own, and who you can’t replace is worth many times what it costs.