Free checklist

Technical due diligence checklist: 25 things investors check before a seed round

This is the list I use when a founder asks me to get their product ready for a technical review. Each point says what a good answer looks like and what makes a reviewer nervous. Go through it with your lead engineer. Anything you can't answer in two minutes is a finding.

What's inside

Architecture

  1. 01An architecture you can draw on one page
  2. 02Business logic separated from frameworks
  3. 03A data model that matches the business
  4. 04Third-party dependencies under control
  5. 05A credible path to 10x the load

Security

  1. 06Secrets kept out of the code
  2. 07Authentication and authorisation done properly
  3. 08Dependencies scanned for known vulnerabilities
  4. 09Least-privilege access and working offboarding
  5. 10Web security basics in place

GDPR and data

  1. 11A map of personal data
  2. 12Lawful processors and transfers
  3. 13Data subject rights you can actually execute
  4. 14Backups that have been restored

Infrastructure and operations

  1. 15Reproducible infrastructure
  2. 16Automated, repeatable deployments
  3. 17Monitoring and alerting
  4. 18Cloud costs understood

Tests and code quality

  1. 19Tests on the paths that make money
  2. 20Code review that actually happens
  3. 21Readable, consistent code
  4. 22Technical debt known and written down

Team and ownership

  1. 23No single point of failure
  2. 24Documentation that onboards someone
  3. 25Clean IP and account ownership

Get the PDF

25 points, each with what a good answer looks like and the red flag reviewers look for. Print it and go through it with your lead engineer.

I'll email you the PDF link and nothing else unless you write back.

Rather have someone run it for you?

A two-week technical audit turns this checklist into a ranked list of findings with the fixes in order.

See the technical audit →