Most buyers have never seen one of these before they pay for one. You should know what you are buying.
What is in the report
- A verdict on page one: proceed, proceed with conditions, or walk away, with the reasons in plain language.
- A scorecard of ten areas, from architecture and security to data protection and business continuity, each marked as a condition of signing, a price adjuster or a post-close plan.
- One page per finding: what we found, why it matters to the buyer, what we recommend, the effort in person-weeks, and how confident we are, with the evidence behind it.
- A technical debt register in work, not adjectives, with a total you can put into the deal.
- The first 100 days after close, and how the company joins your group.
- What it means for price, escrow or earn-out, and the open items to settle with the seller before you sign.
The scorecard from the sample
| Area | Rating | What we found | Effort |
|---|---|---|---|
| Architecture | Holds about 2.5 times today’s peak, the case needs 3 | 14 to 20 pw | |
| Code and tests | 11% test coverage, none on billing, one live rounding bug | 6 to 8 pw | |
| Security | Working secrets in Git history, no MFA on two admin accounts | 2 pw | |
| Delivery | Manual releases, one in four needs a hotfix | 4 pw | |
| Team and key people | One engineer wrote 68% of billing and scheduling | 3 to 4 pw | |
| Licences and IP | AGPL library in customer facing invoices | 2 to 3 pw | |
| Cloud cost | About €5,000 a month spent on idle resources | 1 to 2 pw | |
| The AI feature | Personal data sent to a US model endpoint, no evaluation | 3 to 5 pw | |
| Data protection | Processing records from 2021, five agreements missing | 2 to 3 pw | |
| Business continuity | Backups run, a restore has never been tested | 2 to 3 pw |
Total: 39 to 54 person-weeks, about €180,000 to €250,000 of remediation to price into the deal.
One finding, in full
Finding 06 · Licences and IP · Act before close
We scanned 1,140 open source dependencies. 1,128 are under permissive licences and 11 under weak copyleft licences such as LGPL and MPL, which are fine as they are used here. One is under AGPL-3.0: the PDF library that generates the invoices customers download. AGPL requires whoever offers the software to users over a network to make its source available. Whether that reaches into the application around the library depends on how the two are combined, which is a question for counsel.
The AGPL issue is exactly what a buyer's lawyers find late and use to reprice. Replace the library or buy the vendor's commercial licence before signing.
Questions buyers ask
What does a technical due diligence report include?
A verdict, a scorecard across ten areas from architecture to business continuity, one page per finding with the cost to fix and the evidence behind it, a debt register, a 100 day plan and the open items to settle before signing.
How long is a real report, and how long does it take?
Thirty to forty pages, delivered in two to four weeks. If the deal moves faster, the five day Technology Health Check covers the riskiest areas in a shorter report.
How much does technical due diligence cost?
€18,000 to €35,000 for the full report, fixed fee. The Technology Health Check is €4,500 to €6,500.
Is this a real client report?
It is an anonymised sample. Names are masked and details are illustrative, so nobody can be identified from it. The structure, depth and tone are exactly what you receive.
What happens after we read it?
You decide. If you want us to fix what we found, the fee comes off the first invoice on projects above €50,000. If you take the report to another supplier, that is a fair outcome too.
Have a deal coming? We can write this for yours.
Tell us about the deal and you get a written read on it within three working days, free.