Who it's for
Seed-to-Series-B investors, acquirers, and health systems or pharma groups evaluating a vendor. We also run sell-side diligence for founders who want to find the issues before their investors do. The reviewer has built and shipped regulated clinical software, so the findings are grounded in what it takes to fix them.
What's included
- Architecture and scalability — whether the system can grow with the business case, and what it will cost to get there.
- Codebase and engineering practices — code quality, testing, CI/CD, dependencies, and the bus factor.
- Security and HIPAA posture — technical safeguards, vendor and BAA coverage, and incident history.
- Regulatory position — whether claims and product are consistent with the SaMD position the company states.
- Data assets and rights — what data the company holds, whether it may use it as planned, and how clean it is.
- Team and key-person risk — who holds the knowledge and what happens if they leave.
- Remediation estimate — what the findings will cost to fix, so they can be priced into the deal.
How it runs
- ScopeConfirm the questions the deal needs answered and the access available.
- ReviewDocumentation, repository and infrastructure access, and interviews with the technical team.
- ReportRisk-rated findings with evidence and remediation estimates.
- CallA readout with the investment or deal team, and follow-up questions for two weeks.
Questions
Do you do sell-side diligence?
Yes. Founders often engage us before a raise to find and fix issues on their own terms. The deliverable is the same report, addressed to you.
How much access do you need?
Read-only access to repositories and cloud consoles, existing documentation, and two to four interviews. We never need production patient data and work under NDA.
How is this different from your Initial Audit?
The Initial Audit is for the company itself and ends in a remediation roadmap the team executes. Due diligence is for a third party and ends in a risk-rated opinion for a decision. The review is similar; the audience and the deliverable differ.
Related services
Scope it in 30 minutes
Book a scoping call and we'll name the smallest engagement that moves you forward. Most teams start with the fixed-scope Initial Audit.
Book a 30-min scoping callPrefer to write? Send a short note.