For deals under $20M
The risk isn't in the code. It's in the price you paid for it.
We read the codebase, the infrastructure, and the commit history of your acquisition target, then hand you the one thing the CIM never contains: what it will cost to fix what's actually in there. Seven days. Inside your exclusivity window.
- Critical $340,000 · 6 mo
AGPL-3.0dependency sits inside the billing core. Any distribution of the product triggers copyleft on proprietary code. Requires commercial relicense or rewrite before a strategic resale. - Elevated $180,000 · risk
71% of commits to the payments and provisioning services trace to a single contractor, off payroll since Q3. No architectural documentation. Knowledge transfer is unpriced in the model.
- Elevated $95,000 · 3 mo
PostgreSQL 11 in production, past end-of-life. Two extensions in use have no supported equivalent on 15+. Upgrade path is untested and blocks the SOC 2 timeline.
- Clear no adjustment
Deployment and test discipline are genuinely strong — 74% coverage, automated rollback, no manual production access. This team is better than the codebase suggests.
Why this exists
Below $20M, technical diligence simply doesn't get sold.
The established firms quote $25K–$150K on a four-to-eight week timeline, with a rush premium to fit your exclusivity window. That math works on a $200M platform deal. On a $16M acquisition it means buyers skip the assessment entirely and find out afterward.
Traditional advisory
$25K–150KFour to eight weeks. Priced for platform deals and institutional sponsors.
What most buyers do
$0A founder's word, a friend-of-a-friend code review, and hope. The default below $20M.
Techstacked
$8K–15KSeven business days, fixed fee. Automated analysis does the volume; judgment does the rest.
Scope
What we look for, and why it moves a number.
Copyleft contamination, abandoned packages, unpatched CVEs. The single most common finding that survives legal diligence untouched.
Commit history by author across the life of the repository. If one departed contractor owns the core, you are buying a rewrite.
Whether the AI product is defensible or a thin wrapper, what happens to gross margin when the provider reprices, and where the lock-in sits.
Whether hosting scales linearly with revenue or superlinearly with users. Determines whether the growth case survives contact with the bill.
Secrets handling, authentication patterns, tenant isolation, and a costed path to SOC 2 if enterprise expansion is in the thesis.
Subprocessors, single points of failure, and contracts that reprice on change of control. Often the fastest post-close surprise.
Whether the team and the architecture can plausibly ship what the growth model assumes, on the timeline it assumes.
Every finding carries a dollar figure and a duration. This is the section that goes into your renegotiation, so it is written to be forwarded.
Engagements
Three depths, matched to where the deal sits.
Fixed fee, agreed before we start. 50% on engagement, 50% on delivery of the report. Fees are never contingent on the deal closing — you get the finding either way, and a deal you walk away from is the assessment working.
| Engagement | Fee | Turnaround | Deliverable |
|---|---|---|---|
| Screen Pre-LOI, or triaging several targets at once | $2,500–4,000 | 3–5 days | Ten-page red-flag memo. Licence exposure, concentration risk, obvious structural problems. Enough to decide whether to proceed. |
| Standard Most engagements Signed LOI, inside exclusivity | $8,000–15,000 | 7–10 days | Full written report across all eight scope areas, costed remediation plan, and a 90-minute readout with your deal team and lender. |
| Deep $20M+, or a platform you intend to build on | $20,000–35,000 | 2–3 weeks | Everything in Standard, plus engineering team interviews, architecture deep dive, and a costed first-year technical roadmap for the hold period. |
Who we work with
Buyers the big firms won't quote.
The benchmark search acquisition is a $16M business bought around month 20. You have one shot and no in-house CTO. This is the engagement built for you.
Tuck-ins and add-ons that fall below your retained advisor's minimum but still carry real technical risk into the platform.
Offer diligence as part of the process. Clean technical findings shorten time-to-close and kill the surprises that break deals in week six.
You are lending against a software asset. We tell you whether the collateral is maintained or quietly decaying before the facility is drawn.
Process
Seven days, structured around your close.
Thirty minutes on the thesis, the deal timeline, and what you are most worried about. Fee is fixed at the end of this call.
Read-only repository access, cloud billing exports, and the subprocessor list. We work under NDA with the seller directly if you would rather stay out of it.
Automated scanning across dependencies, licences, and commit history, then manual review of everything the scanners flag and the architecture they cannot see.
Written findings with severity and costed remediation, delivered as a PDF built to be forwarded to your lender, your counsel, and the seller.
Ninety minutes with your deal team. We defend every number, and we help you decide what is a price adjustment, what is an indemnity, and what is a walk.
Questions we get
The practical objections, answered.
What if the deal falls apart mid-diligence?
You still owe the balance, and you should still want the report. Fees are never tied to close — contingent pricing would give us a reason to soften findings, which is exactly backwards. A deal you walk away from because of what we found is the highest-return engagement we can deliver.
The seller won't give a stranger repository access.
Common, and workable. We sign directly with the seller under NDA, review in a read-only environment they control, and can work from an escrow snapshot rather than live access. If the seller refuses any form of technical review, that refusal is itself a finding worth reporting.
How is this fast enough to be thorough?
Because the volume work is automated. Dependency graphs, licence trees, CVE matching, and commit attribution are machine problems, and running them takes hours rather than weeks. The days are spent on the part that needs judgment: what the results actually mean for your thesis and your price.
We already have a technical co-founder who can look at it.
Then use them — on the architecture and the team, where their context is worth more than ours. What they usually cannot do inside an exclusivity window is the exhaustive licence and dependency sweep, or produce a costed, independent document that a lender and a seller will both accept as neutral.
What are the limits of what you'll say?
We assess what the code and infrastructure show. We do not audit financials, verify revenue, or opine on valuation. Liability is capped at fees paid, we carry professional indemnity cover, and where evidence is thin we say so in the report rather than rounding a guess into a number.
Next step
Read a full report before you commit to anything.
We will send a complete redacted engagement — every section, every finding, the remediation model — so you can judge the work rather than the pitch. If you have a live deal, tell us the timeline and we will confirm within a day whether we can hit it.