How long does technical due diligence take?

One to three weeks for a seed or Series A company, depending on the size of the codebase and how quickly access is granted. Urgent findings are shared as soon as they are confirmed.

Do you need full access to the code?

Read access to the repositories, the cloud console, and the issue tracker. I do not need production data, and I ask for the minimum access that answers the questions in scope.

Can the founders see the report?

That is the client's decision. For investor-commissioned work I recommend sharing it: the remediation list is most useful to the team that will do the work.

Technical Due Diligence in Hong Kong

Before you wire the money, know what you are buying. I review a startup's code, architecture, infrastructure, security posture, and engineering practice and tell you, in writing, where the risks are and roughly what each would cost to fix.

Who it is for

Angels and seed funds writing a ticket into a company whose product is software.
Acquirers taking over a codebase, a team, or a cloud account.
Founders who want an independent read before a raise, so there are no surprises in the data room.
Boards that have lost confidence in delivery and need a plain account of why.

What gets reviewed

Codebase: structure, test coverage, dependency health, licence exposure, and how much of it one person knows.
Architecture: whether it will carry the plan in the pitch deck, and what breaks first when it does not.
Infrastructure and cost: cloud account hygiene, infrastructure as code, environments, backups, and the real monthly bill.
Security and data: access control, secrets handling, personal data flows, and readiness for a customer questionnaire or a PCPD question.
Delivery: release cadence, incident history, on-call, and how decisions are recorded.
Team: key-person risk, contractor and agency dependencies, and what the hiring plan assumes.

What you receive

A written report with a one-page summary, a risk register ranked by likelihood and impact, the evidence for each finding, and a remediation list with a rough cost and sequence. Findings are specific enough that the founding team can act on them, and the language is plain enough for an investment committee.

A review call to walk through the findings with the investor, the founder, or both. Where the engagement is for the founder, the report is written so it can go straight into a data room.

How it runs

A scoped review needs read access to the repositories, the cloud account, and the ticketing system, plus two or three conversations with whoever runs engineering. Most reviews run over one to three weeks depending on size, with the report at the end and interim notes if something urgent turns up.

The work is fixed fee against a written scope agreed before access is granted. Confidentiality terms are signed up front; I do not take engagements where I have a conflict with the target or the investor.

Rescue

Sometimes the review is the start, not the end: a release that cannot ship, a platform that falls over at every campaign, or an agency handover that left nobody who understands the system. In those cases the same review turns into a short stabilisation plan, run on an advisory retainer with the existing team.