When it happens and who runs it
Expect technical due diligence once terms are broadly agreed and before final documents. At pre-seed and seed it is often light: a conversation about architecture and roadmap, maybe a look at the repository. From Series A onwards investors typically bring in an independent technical reviewer or a specialist diligence firm, and the process runs one to three weeks.
The reviewer is not looking for perfect code. Every startup codebase has shortcuts, and a reviewer who has done this before expects them. They are assessing whether the technical reality supports the commercial story, and whether there is anything that turns into a liability after the money goes in.
What the reviewer actually looks at
| Area | What raises a flag |
|---|---|
| IP ownership | Contractors with no assignment clause; code written before incorporation |
| Open-source licences | AGPL or GPL code linked into a proprietary product |
| Security | Secrets in the repository; no MFA on production; no access review |
| Architecture | Single points of failure; no path to the scale in the financial model |
| Key-person risk | One engineer who alone understands a critical subsystem |
| Testing and release | No automated tests on billing or auth; manual deploys with no rollback |
| Data protection | No records of processing; unclear sub-processors; no retention policy |
| Technical debt | Debt that is unmeasured and unplanned, rather than debt that exists |
Notice how little of that is about code quality in the abstract. A reviewer will forgive an ugly module that is well tested and understood. They will not forgive a billing system nobody can safely change.
IP ownership is the issue that kills deals
In the UK, code written by an employee in the course of employment belongs to the employer by default. Code written by a contractor does not. It belongs to the contractor unless a written agreement assigns it, and a great many early-stage products are partly built by freelancers, agencies, or friends who were paid but never signed anything.
The same applies to work done before the company existed. If two founders built a prototype for six months and then incorporated, that prototype needs an assignment into the company. Reviewers ask for a chain of title covering every significant contributor, and gaps take weeks to fix because you have to find people who may have moved on and persuade them to sign.
Open-source licences are the second trap. Permissive licences such as MIT, Apache 2.0, and BSD are fine. Copyleft licences such as GPL and especially AGPL can require you to release your own source under the same terms depending on how you have linked and distributed the code. Run a licence scan before the reviewer does.
Red flags worth fixing before anyone looks
Findings that reliably cause a reprice, a delay, or an indemnity clause:
How to prepare
Start six to eight weeks before you expect diligence. Assemble the paperwork first, since that is the slow part: employment contracts, contractor agreements with IP assignment, a licence inventory, your data processing records, and any penetration test reports. Rotate every credential and confirm nothing sensitive is in git history.
Then write the documents a reviewer wants but startups rarely have. A one-page architecture diagram. A short note on the three biggest pieces of technical debt, what they cost, and when you plan to address them. A summary of how a change reaches production. Volunteering a clear-eyed account of your weaknesses builds far more confidence than a reviewer finding them unaided, and it lets you frame each one with a plan attached.
Budget £5,000 to £15,000 if you want an independent pre-diligence review to find the problems while you still have time to fix them. Against a round where a single finding can move valuation or add an indemnity, that is inexpensive insurance.
AyTech note: The findings that actually break deals are almost never about code style. They are about ownership, security exposure, and whether the system can survive the growth in the plan you just pitched.
Need a practical technical plan?
AyTech can review your requirements, map the risks, and turn the idea into a scoped delivery plan.
SaaS development services