Fractional CTO, audits, nearshore and MVPs: 25 straight answers.
The questions founders ask me most, answered in a paragraph each. If yours isn't here, ask it on the intro call.
Fractional CTO
What is a fractional CTO?
A fractional CTO is a senior engineering leader who works with your startup part-time, usually 1 to 2 days a week, and takes real responsibility for the technical side of the company. That means architecture, code review, technical hiring, security and the roadmap, decided by someone who has shipped products to production before. You get the judgment of a CTO without the salary, equity and long search of a full-time hire. In my case the engagement is a monthly retainer with a 3-month minimum, and everything I produce, from repositories to decision records, belongs to you from day one.
How the fractional CTO engagement works →What does a fractional CTO actually do in a week?
A fractional CTO's week is split between decisions, reviews and people, packed into 1 to 2 days of focused time. In a typical week I review the pull requests that matter, unblock the engineers on architecture questions, update the roadmap with the founders and check that production is healthy. Some weeks lean towards hiring: writing the job spec, running technical interviews, onboarding the new engineer. Other weeks go into one specific risk, like a slow database or a security gap. Between those days I stay reachable on Slack for short questions, so the team doesn't wait a week for an answer.
Fractional CTO vs full-time CTO vs freelancer vs agency: which do I need?
A fractional CTO gives you senior technical leadership part-time, a full-time CTO gives you the same leadership as a permanent hire, a freelance developer gives you hands on the code, and an agency gives you a delivered project. The right choice depends on what's missing. If you lack direction, architecture and someone accountable for engineering, you need a CTO, fractional until full-time is justified. If the direction is clear and you lack capacity, a freelancer or an agency adds output. Most pre-seed and seed startups need direction first, because extra capacity pointed the wrong way just builds the wrong thing faster.
When does a startup need a fractional CTO?
A startup needs a fractional CTO when technical decisions are being made without anyone senior enough to make them well. The usual triggers are clear: you're about to build an MVP and don't want to build it wrong, the product you shipped keeps breaking, your two or three developers have no senior to review their work, investors ask technical questions you can't answer, or a freelancer or agency is about to hand over a codebase you can't judge. If none of those apply and the team ships reliably, you probably don't need one yet.
Tell me where you're stuck →How do I know if my fractional CTO is actually working?
A fractional CTO is working when the team ships more predictably and the founders make fewer technical decisions blind. After the first month you should see concrete things: a written architecture and roadmap, code review on every change, a deployment process that doesn't depend on one person, and a short list of risks being fixed in order. After three months, releases should be calmer, hiring should be moving, and you should be able to explain your stack to an investor. If you can't point to decisions and documents your CTO produced, ask for them at the next checkpoint.
Pricing and engagement
How much does a fractional CTO cost in France?
A fractional CTO in France is usually paid as a monthly retainer for 1 to 2 days a week, and typical freelance CTO day rates on Malt run roughly €700 to €1,500, which puts the market at about €3,000 to €10,000 a month. Treat that as a range, not a quote. I price ongoing leadership as a monthly retainer with a 3-month minimum, and one-off work like a technical audit or an MVP as a fixed fee for a fixed scope. My starting prices are in the pricing box on each service page, and you get the final figure in writing before any work starts.
See fractional CTO pricing →Why charge a fixed fee for an audit or MVP instead of a day rate?
A fixed fee for a fixed scope means you know exactly what you're buying, by when and for how much, before any work starts. Every technical audit and MVP build I run starts with a written scope listing what's included, what's excluded and what the deliverable looks like, and the price doesn't move once that scope is agreed. If something new comes up mid-project, we decide together whether it replaces something in scope or goes into a later phase, instead of the bill quietly growing. For a founder managing runway, a number that can't drift is worth more than an estimate that can.
See technical audit pricing →What's included in a fractional CTO retainer?
A fractional CTO retainer includes the senior technical work a full-time CTO would do, scaled to the 1 to 2 days a week you book. With me that covers architecture decisions, code review and engineering standards, the technical roadmap, help hiring and onboarding engineers, security and GDPR oversight, and being the technical voice in investor conversations. It also includes short async answers on Slack or email between working days. Heavy build work, like writing a whole new module, is usually scoped separately so the retainer stays focused on leadership. Everything produced under the retainer belongs to you.
How do I stop a fractional CTO engagement, and is there lock-in?
A fractional CTO engagement with me stops at an agreed checkpoint, with no lock-in, once the 3-month minimum has run. We set the checkpoints in writing at the start, and at any of them you can pause, reduce the days or stop. Because you own the repositories, cloud accounts, domains and documentation from day one, stopping means a handover call, not a negotiation. The goal of the retainer is a team that can run without me, so ending it on schedule is a good outcome, not a failure.
Is a fractional CTO cheaper than hiring a full-time CTO?
A fractional CTO is cheaper than a full-time CTO for most early-stage startups, because you pay for 1 to 2 days a week instead of a full salary, employer charges, equity and a long recruitment. In my experience, an experienced CTO for a seed-stage startup in France often costs somewhere around €80,000 to €130,000 gross a year, and employer contributions add roughly 40 to 45 percent on top, before equity. A fractional retainer costs a fraction of that. The trade-off is availability: a full-time CTO is there every day. In my view, once you have around five engineers, a full-time hire starts to make sense.
Technical audits and due diligence
What is a technical audit of a startup's codebase?
A technical audit is a structured review of a startup's codebase, infrastructure and engineering practices that tells you what is risky, what is slowing you down and what to fix first. Mine runs for two weeks at a fixed scope and a fixed fee. I read the code and its history, check the infrastructure and deployment pipeline, look at security and GDPR, and talk to the people who built it. The result is a prioritised risk register you can act on, not a vague score. Founders usually ask for one before fundraising, before a rewrite, or after inheriting code from a team that left.
How the technical audit works →What's in a codebase audit report?
A codebase audit report is a prioritised risk register covering architecture, security, GDPR and data protection, infrastructure, tests and team practices. Each finding states what I found, why it matters, how severe it is, how much effort the fix takes and the concrete fix I recommend. Findings are ranked by impact and effort, so the top of the list shows what to fix this month and the bottom shows what can wait. The report is written for two audiences: precise enough for your engineers to act on, and clear enough for a founder or investor to read. A walkthrough call goes through it with you.
How long does a technical audit take and how are the two weeks spent?
A technical audit with me takes two weeks: roughly one week of reading and testing, then one week of verifying findings and writing the report. The first days go into access, a kickoff call and reading the architecture, the code and the git history. Then I review the infrastructure, the deployment pipeline, security and data handling, and reproduce the problems that matter. During the second week I talk to the people who built the system, check my conclusions against what they know, rank every finding and write the fixes. The engagement closes with the report and a walkthrough call.
What do investors check in technical due diligence before a seed round?
Technical due diligence before a seed round checks whether the product can survive growth and whether the company really owns it. Reviewers look at six areas: architecture, security, GDPR and data handling, infrastructure and deployments, tests and code quality, and team and IP ownership. Typical red flags are secrets in the git history, backups nobody has ever restored, one person who holds everything in their head, and an agency that still owns the GitHub organisation. I wrote these up as a free 25-point checklist you can run with your lead engineer in an afternoon, before the data room opens.
Get the free due-diligence checklist →Does my team need to stop work during a code audit?
A code audit doesn't require your team to stop working, and it shouldn't, because I want to see how the team ships normally. What I need is read access to the repositories, the infrastructure and the tools you use, plus a few hours of your engineers' time spread over the two weeks: a kickoff, one or two interviews and quick answers to questions. I don't push code or change production during the audit. Everything I access is covered by an NDA, and access is removed when the engagement ends. For most teams the cost is a few hours of interviews, not a lost sprint.
Nearshore, GDPR and working together
Why do European startups use nearshore development in Tunisia?
Nearshore development in Tunisia means working with engineers based in Tunisia, two to three hours' flight from most of Western Europe and on almost the same clock. European startups use it for three reasons: senior engineers cost less than in Paris, Berlin or Amsterdam, working hours overlap fully with the EU, and French is widely used in tech alongside English and Arabic. The difference with far offshore is that you work as one team, with live calls and same-day code review, instead of handing off specs overnight. I've shipped 20+ products from Tunis for clients in France, Tunisia and the UK.
Read the Facturra case study →What time zone is Tunisia in compared to Paris?
Tunisia is on UTC+1 all year and does not use daylight saving time, so Tunis has the same clock as Paris in winter and is one hour behind Paris in summer. From late March to late October, when France switches to CEST (UTC+2), 10:00 in Paris is 09:00 in Tunis. The rest of the year the clocks match exactly. The same applies to Berlin, Amsterdam and Madrid. In practice a normal working day in Tunis covers a normal working day in Paris all year, with at most one hour of offset to plan meetings around.
Is it GDPR compliant to outsource development to Tunisia?
Outsourcing development to Tunisia can be GDPR compliant, but it needs the right contracts and setup because Tunisia has no EU adequacy decision. When an engineer in Tunisia can access personal data of EU users, even just by logging into a server hosted in Europe, that counts as a transfer outside the EU. The standard way to cover it is a data processing agreement plus the European Commission's standard contractual clauses, with a transfer impact assessment. On top of the paperwork I keep data hosted in the EU, give engineers least-privilege access, and work on anonymised or test data whenever production data isn't needed.
Check your GDPR basics with the checklist →Can I work with a developer in Tunisia in French or English?
Working with a developer in Tunisia in French or English is normal, and with me you can choose French, English or Arabic for meetings, code reviews and documentation. French is widely used in Tunisian business and tech, and engineers work daily in English, since code, tooling and technical documentation are in English anyway. I teach computer science and run workshops in both French and English, and I write specs, tickets and handover documents in whichever language your team uses. Mixed teams work too: a French founder, an English-speaking investor and Arabic-speaking users can each get material in their own language.
Do I own the code if I outsource development, and will you sign an NDA?
You own the code, the infrastructure and the documentation from day one when you work with me, and I'm happy to sign an NDA before you share anything confidential. Put that ownership in writing as an IP assignment in the contract, because investors check it during due diligence. In practice the repositories live in your GitHub or GitLab organisation, the cloud, domain and app store accounts are in your company's name, and I work on them with access you control. When the engagement ends, you remove my access and nothing needs to be transferred. Most of my recent client work is covered by NDAs.
Ask for an NDA before we talk →MVP builds and AI
Can you really build an MVP in 4 weeks, and what fits in that time?
An MVP in 4 weeks is realistic when the scope is one core user journey, written down and agreed before the first line of code. In about four weeks of fixed-scope work that usually covers sign-up and login, the main data model, the workflow that proves your idea, an admin view, emails or basic payments, and a production deployment with CI/CD. What doesn't fit: several user roles with separate apps, native apps on both stores, complex legacy integrations, offline mode and heavy reporting. Those need more weeks, and I'll say so in the written scope instead of discovering it in week three.
How the 4-week MVP build works →What tech stack should I use for my MVP?
The best stack for an MVP is a mainstream one that your future hires already know and that won't need a rewrite at the first sign of traction. For most web products I build with Next.js and React on the front, Node.js with NestJS or Express, or Python with Django or FastAPI on the back, on PostgreSQL or MongoDB depending on the data. For mobile I use Flutter or React Native, so one codebase covers Android and iOS. Deployments run through GitHub Actions to a VPS, or to OVHcloud when EU hosting matters. I avoid exotic frameworks: being able to hire for the stack matters more than saving a week.
Can AI build my MVP, or do I still need a senior developer?
AI coding tools can write a large share of an MVP's code, but a senior developer is still needed to decide what to build, how to structure it and whether the generated code is safe to ship. I use agentic coding daily, and on Sabboura it helped take the product from first commit to production in under two months by running milestones in parallel. What AI doesn't do reliably is architecture, data modelling, security, permission checks and noticing when a plausible answer is wrong. Unreviewed AI code tends to work in the demo and fail on real users, which is exactly what a senior review catches.
Read the Sabboura case study →What happens after my MVP launches?
After an MVP launches, you own everything and choose how it grows: in-house, with a fractional CTO, or with another team. The repositories, infrastructure and documentation are in your name from day one, so there is nothing to hand back. The first weeks after launch are usually about fixing what real users reveal, watching errors and costs, and deciding what goes into version two based on actual usage, not guesses. You can keep me on a fractional CTO retainer for that phase, 1 to 2 days a week, or hire your first engineer and get a clean handover from me.
Grow it with a fractional CTO →How do I migrate my app off Bubble, no-code or Firebase?
Migrating an app off Bubble, another no-code tool or Firebase works best as a planned rebuild of the core, done in stages, while the old version keeps running. I start by mapping what the current app actually does, including the hidden logic in workflows, rules and plugins, then I export the data and check its quality. Next I rebuild on a standard stack such as Next.js and PostgreSQL, migrate users and data with a script you can run more than once, and switch over when the new version matches. Founders usually migrate when costs, performance limits or investor questions about lock-in start to hurt.
Still have a question?
Ask it directly. I reply within 48 hours.
Ask me →