Technical due diligence before you sign, invest or take over

Who commissions a technical due diligence?

Two kinds of buyer. Someone about to acquire a company or invest in one, who needs to know whether the product works the way the pitch says it does. Or a business inheriting software from a vendor or a departing team, who needs to know what it is taking on before it commits to running it. It is most often built for professional services firms and e-commerce businesses.

In each case the question is not whether the code is perfect — no codebase is — but what it will cost you and who it depends on. The review is shaped around that question, which is why the technical debt comes with a cost estimate and the findings are ranked by severity rather than listed in the order they were found.

What does the review actually look at?

Architecture and scalability: how the system is put together, and what gives way first if usage grows. Code quality and test coverage: whether changes can be made safely, or whether every fix risks breaking something else. Security and compliance red flags: the kind of issue that would matter to a buyer or a regulator, such as secrets stored in the code, weak access control or personal data handled carelessly.

Key-person and vendor risk looks beyond the code: how much of the system lives only in one developer’s head, and how dependent it is on a single outside vendor or paid service. The findings deck then ranks everything by severity, so the few issues that should change a price, a condition or a decision sit at the top.

What is it not?

It is not a penetration test, a security certification or a legal opinion. Security issues are flagged as red flags for you to act on, not tested by attempting to break in, and nothing in the deck certifies compliance with any standard. It is also not a fix: the review tells you what is wrong and what it may cost, and any remediation is scoped and priced separately. The company being reviewed has to give access to its code and systems; the access needed is agreed on the scope call.

How is this different from a Drift Audit or a strategy consultation?

Due diligence examines the software itself. The Drift Audit (₹49,000, 2–3 weeks) examines what flows through your systems — money, data and records — and finds where they stop agreeing. It is the better choice when the code runs but the numbers don’t match. Tech Strategy Consultation (₹3,000, up to 7 days) looks forward rather than down: which systems to build or buy over the next 12 months.