Acleantechreadoutbeforeyourinvestorshiretheirown.

The documentation package that moves deals forward

Architecture: a high-level diagram, component inventory, data flow, and deployment topology. Security: SOC 2 status (Type 1 or 2 report if available, a documented gap assessment if not), data classification, encryption at rest and in transit, access controls, and incident history. Scalability: current metrics — daily active users, requests per second, database size — plus capacity test results and your plan to 10x. Code quality: test coverage percentage, CI/CD pipeline, monitoring and alerting, incident response process. Team: org chart, key-person identification, hiring plan, retention risk. Risk register: known issues with severity ratings and mitigation timelines.

Each document should be one to five pages, readable by a senior engineer who has never seen your codebase. Dense docs get skimmed. Clear, concise docs get valued. I draft these from your architecture, codebase access, and a few focused interviews.

IP and open-source risk — the silent deal-killer

Unclear IP ownership is the most common deal-killer in Series A diligence, and it's invisible until someone looks. The questions are straightforward: was every line of code written by contractors formally assigned to the company? Are there any GPL or copyleft licenses in your dependency tree that could infect proprietary code? Did any early engineer leave without signing an IP assignment? If the answers are uncertain, DD firms flag it immediately — and acquirers walk away entirely.

I run a full IP and license audit as part of DD prep: contractor agreement review, dependency tree scan for restrictive licenses, and documentation of any assignment gaps with recommended remediation. This takes three to five days and fixes the issue before the DD firm ever sees it.

Security and compliance quick wins

DD firms flag security risks fast. Quick wins that satisfy most scrutiny: encryption at rest (AWS RDS or Postgres default-on), encryption in transit (TLS everywhere), access controls (least privilege, RBAC, MFA on admin tools), logging (90-day minimum retention, audit trail for sensitive actions), tested backup and restore procedures. For pre-Series-A, SOC 2 in progress with a documented gap assessment and remediation plan is usually acceptable. For Series B and acquisition diligence, an actual Type 2 report is often required.

I identify your specific gaps and rank them by DD criticality — not by textbook severity, but by what's most likely to spook this particular investor. The $15,000-$30,000 SOC 2 Type 1 process takes two to three months on its own; starting it early and presenting progress during DD is a credible posture for most Series A rounds.

Team and operational risk — what gets asked in interviews

After document review, DD firms schedule interviews. They want to know: if your lead engineer left tomorrow, how long before the team can't ship? That's bus-factor analysis. They also want your incident history — not proof you've never had an outage, but proof you handle them well. A post-mortem culture and a documented incident log signal engineering maturity. A blank incident history signals nobody is paying attention.

I prep your lead engineer or CTO proxy for these conversations. That includes building a credible hiring plan that addresses identified key-person risk, documenting your incident response process if one doesn't exist formally, and creating the team org chart with tenure and risk annotations. The goal is that the DD firm's interview feels like a confirmation, not an interrogation.

At bolttech — a $1B+ unicorn in fintech — the discipline behind 40+ payment provider integrations, 99.9% platform uptime, and zero post-launch critical bugs came from exactly this kind of documented operational rigor. That discipline transfers to Series A prep. The documentation habits that survive unicorn-scale diligence translate directly into passing a Series A review.

What I do during the DD itself

DD prep is not a one-time handoff. Once the DD firm starts, they push back on documents, schedule follow-up interviews, and surface edge cases no checklist anticipated. I stay available throughout: joining DD firm interviews as technical spokesperson, drafting remediation plans for findings they flag, and responding to their follow-up questions the same day.

Typical active DD engagement runs two to four weeks after the prep phase. After term sheet signing, the engagement can continue as ongoing fractional CTO work or close cleanly — your decision. The 14-day money-back guarantee on the first month means you can start, see how the engagement runs, and decide from there. All written deliverables — documentation, risk register, architecture diagrams — are Work Made for Hire. You own everything.

Scope: acquisition DD versus fundraise DD

Acquisition diligence is more exhaustive than fundraise diligence. The reason is straightforward: an acquirer is buying the technology outright, not investing alongside it. That shifts the scrutiny from 'will this scale' to 'what are we actually inheriting.' Integration planning, migration risk, post-close cost structure, and technology consolidation become additional workstreams.

For acquisitions, I add three items to the standard prep: an integration readiness assessment (how long and what it costs to integrate your stack into theirs), a technology consolidation inventory (which of your systems overlap with their existing stack), and a data migration risk assessment (are your data structures portable and clean). These are the items that most commonly surface surprises in M&A diligence for companies that prepared thoroughly for fundraise diligence but assumed the frameworks were identical.