The instrument for what a codebase is actually worth
Five dimensions. One published rubric. Calibrated senior reviewers who sign their names. A report written for the room where the deal gets decided — the investment committee, the board, the buyer across the table.
Deal-triggered, by design
A raise or exit is 60–180 days out and the data room is about to be opened. You want the first version of the truth to be yours.
A term sheet or LOI is signed and the close window is weeks. You are about to pay for software nobody independent has examined.
An enterprise customer, insurer, or director has asked how exposed the company is — and an engineering opinion is not an answer.
What the audit examines
| Dimension | What we examine | Representative finding class |
|---|---|---|
| 1 · Architecture & Scalability | Design intent vs. accumulation; coupling; failure domains; what breaks at 10× load; cloud cost trajectory. | "Queueing subsystem has no back-pressure strategy; failure behavior unknown to current staff." |
| 2 · Code Quality & AI-Code Risk | Provenance mapping; duplication index vs. benchmark; churn; the four risk classes scored. | "Retry logic duplicated in 14 locations, 3 divergent." |
| 3 · Security Posture | The classes AI writes at a 45% clip — authz gaps, injection, secret handling — plus dependency and configuration review. | "Live API keys hardcoded in 3 generated modules." |
| 4 · Delivery Capability & Key-Person Risk | Interviews; comprehension mapping; bus-factor by subsystem; can this team execute the pitched roadmap? | "No engineer can extend the billing service without the departed contractor." |
| 5 · Documentation & IP Hygiene | License exposure; AI-tool policy evidence; what the data room looks like under hostile light. | "No AI-usage policy on record — a material finding in current diligence practice." |
How the engagement runs
| Day | Activity |
|---|---|
| Day 0 | NDA executed. Read-only access granted. Nothing installed, ever. |
| Days 1–2 | Provenance mapping and automated evidence sweep. Interview schedule set. |
| Days 3–7 | Dimension review by two to three calibrated senior reviewers, independently scored, then reconciled. |
| Day 8 | Red-team read: a reviewer who hasn't seen the codebase attacks the draft's conclusions. |
| Day 10 | Report delivered. Sixty-minute walkthrough with your leadership — or your investment committee. |
What we need from you: read-only repo access, whatever architecture documentation exists (imperfect is fine — its state is itself evidence), and two to four hours of team interviews. That's all.
Fixed fee. Named reviewers. Findings, never fixes.
$12,500 founding cohort · $18,000 list. Under half a percent of a typical deal — and the cheapest sentence in the data room is "independently audited."