Before you sign, you’ll know whether the target’s software can carry your growth plan: how much tech debt sits in the code, what it will take to scale, and where the team, the security or the AI story falls short. Clear findings your deal team can price in, in as little as 3–5 days.
Before the LOI through signing, or before a sale
3–5 days to 3 weeks
Findings ranked by deal impact, a scorecard, remediation costs and a roadmap
Deal teams buying software and tech-enabled companies
Diligence
Day 1
TSA exit
Integration
Technology due diligence is a review of the technology a target builds and sells, before you buy it. We look at the code, the architecture, the infrastructure it runs on, how the team ships software and how secure the product is. You find out whether the technology can support the growth in your investment thesis, and what it will cost if it can’t.
It goes deeper than a standard review of a company’s IT. For a software company, a SaaS platform or any business that runs on software it built itself, the product is the asset. So this is software due diligence as much as IT: senior technologists reading the code and the delivery data, not just interviewing management.
The systems the business runs on: ERP, network, help desk, security and IT spend
The software the business builds or sells: code, architecture, delivery and product security
Any company: manufacturing, distribution, services
Software, SaaS and tech-enabled companies, or any company with custom-built apps
What will this IT cost to fix, separate or integrate?
Can this technology scale with the plan, and what will that cost?
IT leaders and key users
The CTO, product and engineering leads
Most deals need one or the other. Some need both, and we run them together.
Explore IT due diligenceOur software due diligence covers six tracks, assessed for scalability, security and modern engineering practice. Each track ends with its own AI check, so the AI in the product is never reviewed on its own.
Agile, DevSecOps and CI/CD
QA and test automation
Code and artifact management
Dependency and container scanning
Code review
AI coding assistants, MLOps pipelines, model validation and red-teaming.
Governance: ISO 27001, SOC 2, NIST CSF
Identity and access: MFA, SSO, role-based access
Data protection: encryption and DLP
Threat detection and response
Incident response and third-party risk
AI risk management (NIST AI RMF, EU AI Act) and model risks: bias, adversarial attacks, theft.
Cloud-native design: microservices, containers, serverless
Frameworks and languages
Database and data strategy
APIs and integrations
Application security: OWASP, SBOM, SAST and DAST
Embedded AI and ML services, vector databases, guards against prompt injection and data leakage.
Cloud and hybrid set-up, infrastructure as code
Scalability and multi-region resilience
Zero-trust networking
Monitoring and observability
Patching and lifecycle (CIS, NIST)
GPU and model hosting, and monitoring AI workloads for latency and drift.
Resiliency strategy and immutable backups
Recovery targets (RPO and RTO) matched to customer SLAs
Automated failover
Tested drills and attack simulations
Critical SaaS and cloud vendor dependencies
Reliance on third-party AI providers, and recovery of critical models.
In-house or outsourced model
Org structure and role separation
Cloud and DevSecOps skills
Governance and prioritization
Key-person risk
AI roles, governance and ethics policies.
Where AI is central to the investment thesis, we go deeper on the AI itself, then help you capture it after close.
The growth story in the CIM assumes the technology can keep up. These are the findings that most often say otherwise, each tagged with what your deal team should do about it.
A cost the deal model should carry
Ask the seller to fix it, or cover it in the terms
A first priority after close
Years of custom code and old frameworks make each new feature cost more than the plan assumes.
It works at current volume but needs a rebuild to reach the users in the growth plan.
No documentation, no bench, and the product stalls if either leaves.
Little automated testing, manual deployments and no code review.
No code scanning, unpatched open-source components and no inventory of what’s in the software.
Backups and failover never drilled, and recovery targets that don’t match what customers were sold.
A single cloud, SaaS or AI provider the product can’t run without, on terms that can change.
“AI-powered” turns out to be a thin layer on someone else’s model, or the architecture can’t take the AI roadmap.
Every finding comes with a cost to fix and a place in the deal: the price, the terms or the 100-day plan.
One senior team, a proven sequence and evidence from the systems themselves, not just interviews.
A request list on day one, read-only access to code and delivery tools, and every technology claim in the CIM checked.
Interviews with the CTO, product and engineering leads, an architecture walkthrough, code review and a security review. Red flags reach the deal team within days.
Findings ranked by deal impact, a scorecard, remediation and scaling costs, and a roadmap, read out to the deal team, with support on the rep and warranty call.
Sponsors bring us in when the numbers depend on the technology. Here’s what our diligence has delivered.
Diligence found that a $150M firm serving top-20 U.S. banks had no real security program. After close, we built one to FFIEC banking standards, and the company passed its banking audit with zero findings.
Read the case study →
A $500M division carved out of an $8B public company, with eight facilities on different ERPs and the CIO gone a week before close. We centralized the ERP within three months and stabilized IT.
Read the case study →
A $300M division carved out of a $6B parent faced a 12-month TSA. A rapid IT assessment right-sized the infrastructure and ERP, and the business was running on its own systems in five months.
Read the case study →Compello manages all aspects of IT and technology due diligence, from network infrastructure to code reviews, rapidly and cost-effectively.
Principal, mid-market PE firm with $3B AUMSomething we haven’t covered? A partner can answer it on a short call.
It’s a review of a target’s technology before you invest: the code, architecture, infrastructure, security and the team that builds it. Tech due diligence tells you whether the technology can support the growth you’re paying for, and what it will cost to fix or scale.
IT due diligence reviews the systems a company runs on, like ERP, network and security, and applies to almost any deal. Technology due diligence, sometimes called technical due diligence, reviews the software a company builds or sells.
Software and tech-enabled targets usually need it. Many deals need both, and we can run them together.
When the investment thesis depends on technology: buying a software or SaaS company, a tech-enabled services business, or any company that runs on software it built itself. It runs between the LOI and signing.
Sellers use it 6–12 months before a sale, to find and fix what a buyer will find.
Yes. Code review is part of every full-scope engagement. We look at code quality, test coverage, how dependencies are managed and how securely it’s built, alongside the architecture and delivery practice.
A red-flag review takes 3–5 days. A full-scope review takes 2–3 weeks, depending on the size of the product and how fast the target shares access.
Architecture diagrams, the product roadmap, uptime and incident history, a list of third-party and open-source components, the org chart for product and engineering, and read-only access to code and delivery tools.
We send a request list on day one so nothing waits.
AI is built into every track, not reviewed on the side. We check whether the AI in the product is real and defensible, how it’s secured and whether the architecture can carry the AI roadmap.
After close, our AI consulting for private equity turns the AI findings into a plan.
The findings become a prioritized roadmap. Because we’ve already been inside the technology, we can help deliver it: as fractional CTO, running the program or supporting the team, so nothing is lost in a hand-off.
What the target’s IT will really cost to run, fix, separate or integrate, before you sign.
Security posture, compliance gaps and cyber-insurance exposure, priced before signing.
Where the target’s AI creates risk or real upside, found before you sign.
Whether the ERP can carry the investment thesis, before signing or after close.
Separation design, TSA scope and governance, Day 1 cutover and an early exit from the TSA.
Day 1 readiness, then moving the add-on onto the platform’s systems.
One office running every workstream for carve-outs, ERP integrations and other transactions.
From diligence to Day 1, TSA exit and integration, with one senior team.
Start with a red-flag review: three to five days, and a clear view of the tech debt, the cost to scale and the risks in the code.
