Work on investor readiness usually starts a month before the round, when it should have started six months earlier. The investor sends a list of questions and it turns out that part of the code was written by a contractor with no assignment of rights, the infrastructure rests on one person, and IT spend was never counted separately from the general budget. I cover the technical side of the deal: preparing the company for the review, answering the investor’s experts during the round, and running the check in reverse when you are the buyer. Funds out of DIFC and ADGM ask about asset ownership in their first email.
- What people arrive with
- Investor readiness: what the technical expert checks
- The IT cost model and TCO for the investor deck
- The data room and answering the investor’s experts
- The other side: checking someone else’s company
- Stack
- What I do not do
- How the engagement runs
- Related services
- Frequently Asked Questions
- How long before the round should preparation start?
- How far inside do you have to go?
- What if the findings are serious?
- Do you work on the buyer’s side?
- Ready to Get Started?
What people arrive with
The chronology is almost always the same. On Monday the term sheet is signed. On Tuesday an email arrives with four pages of questions, and the first item is about rights to the code. On Wednesday it turns out that the contractor who wrote the payment module closed his company two years ago, and the services sit in the founders’ personal accounts. By Friday the picture is clear: the fund’s expert arrives in three weeks, and there is nobody to assemble the material without stopping development. The question is the same for everyone: whether what is shown really works and belongs to the company, or is a front end over somebody else’s service.
Investor readiness: what the technical expert checks
Technical due diligence does not start with architecture. It starts with the repository history, the provider invoices and the contractor agreements, because that is where the gaps against the pitch deck show up fastest.
- Code history: who wrote what and when, whether there are periods with no commits, whether the list of authors matches the staff and contractors.
- Ownership of the result: whether rights were assigned to the company in the contractor agreements, whether domains and marks sit with the legal entity rather than the founder.
- Component licences: what drags copyleft behind it, what forbids commercial use, where no licence is stated at all.
- Infrastructure: who owns the accounts, what happens if the technical founder leaves, whether production restores from backup.
The findings are not cosmetic: unassigned rights to the code kill a deal outright rather than trimming the valuation. A fuller walk through the review is in Technology due diligence for investors.
The IT cost model and TCO for the investor deck
In most financial models IT lives on one line called “infrastructure and development”. That line does not satisfy an investor, who wants to see how the cost behaves when revenue triples. I split the spend into fixed and variable parts, tie the variable part to a metric anyone can follow (users, transactions, gigabytes) and show the volume at which the current architecture stops holding without a rewrite. The three-year cost of ownership matters here for one answer: what the promised growth costs if the platform has to be replaced halfway.
In the Monolith Plus data room the figure “latency down 67 %” sat as a monitoring export next to the release date it followed, not as a line on a slide. That is the pair that convinces: what was done, and what the system showed.
The data room and answering the investor’s experts
The technical half of the data room is assembled once and then serves the whole round. A badly assembled one costs time: the expert asks a question, the answer takes two days to find, and the pause is read by the investor as a signal.
- An architecture diagram on one page, plus a detailed second one for the technical side.
- A component inventory with licences and versions, including what is actually installed on the servers.
- A register of access and account owners, contractor agreements, and proof that rights were assigned.
- Reliability figures for recent months (availability, incidents, recovery times), exported from Grafana.
It also holds a list of known problems with a remediation plan: that reads better than not knowing about them. During the round I talk to the investor’s technical experts directly.
The other side: checking someone else’s company
The same set of checks works when you are the one buying: the code and its history, the infrastructure, the licences, and who legally owns the result. A separate question is how self-contained the product is; behind the interface there is sometimes somebody else’s service on a subscription.
The report is written in the language of an investment committee, with a technical appendix so findings can be argued with the target’s team. The reverse experience helps: that same side I have prepared for this review many times.
Stack
| Layer | Tools |
|---|---|
| Code and its history | Git, GitHub, GitHub Actions |
| Code and dependency review | SAST (SonarQube, Semgrep), DAST (OWASP ZAP, Burp Suite), Software Bill of Materials (SBOM) |
| Declared versus running | Terraform, Ansible, Proxmox VE |
| The standard the investor looks at | ISO/IEC 27001 |
What I do not do
- I do not give legal opinions. I find that rights to the code were never assigned and show where; the contract is a lawyer’s job.
- I do not value the company or work out multiples: valuation belongs to an investment adviser, the technical inputs belong to me.
- I do not find investors or make introductions to funds: I am not a broker and take no percentage of the deal.
- I do not rewrite history. A problem that is found goes into the material with a remediation plan; it does not disappear from it.
How the engagement runs
The first artefact is not a report but a table of the questions the fund’s technical expert will ask, assembled for your sector and stage. Every row then gets an answer: what covers it today, what can be fixed in two weeks, and what takes two months. It needs read access to the repositories and the provider console, the contractor agreements and the invoices.
The full project starts from $15,000 (AED 55,050): working through the questions, closing findings together with your team, the data room, and the IT cost model. It runs six to ten weeks, counted backwards from the date the fund has set for its technical session.
Support during the round is $500 per hour (AED 1,835): the meter runs for the hours when the fund’s expert is on the call, not for standing next to the deal all month. That is the rate for expert time in a negotiation, not for project hours. Before any contract I can already say the thing that matters: whether there is time to fix things before the round, or whether the preparation is for a conversation about the discount.
Related services
The financial model, credit lines and post-round reporting belong to financial management. Questions coming from the investor’s security side are covered by information security. Once the round is closed, see fractional CTO. Before the deal begins, strategic planning is worth the time.
Frequently Asked Questions
How long before the round should preparation start?
Three or four months before the first meetings is about right. Some findings close in a week, but assigning rights to code from a contractor you parted with long ago takes months.
How far inside do you have to go?
Read access is enough: the repositories, the provider console, the contracts. The investor’s expert will ask for the same set, just later and with no time left to prepare.
What if the findings are serious?
Better to hear them from me than from the investor’s expert. A serious finding does not mean the round is off; it means a different conversation, because a problem with a plan and a date reads differently from the same problem found by the other side.
Do you work on the buyer’s side?
Yes: a review of the target’s technical side with a report for the investment committee. In any one deal I work for a single side.
Ready to Get Started?
Do you know who owns the rights to the code you will show an investor? If the answer takes more than one sentence, the time to start is now. Talk before the round.
