Rapid Technical Due Diligence

How the 48-hour clock works

The clock starts when we have what we need. It counts business days only, so weekends are not included.

• Share the documents. Send the materials listed below. The more complete the set, the stronger the read.
• Grant read-only code access. A fine-grained access token scoped to the repositories in the engagement, or an SSH deploy key.
• The clock starts. Once the documents and repository access are in place, the 48 hours begin.
• Receive the report. Findings, ratings, and a prioritized action plan within 48 hours.

What we assess

The same eight areas we cover in a full engagement, each rated green, amber, or red with the evidence behind it:

• Architecture: Scalability, availability, fault isolation, disaster recovery, and cost effectiveness.
• Product: Roadmap, prioritization, and product management practices.
• Product development lifecycle: How ideas move from intake through delivery and release.
• AI / ML: Strategy, execution, and whether the AI is genuinely differentiated.
• Development: Engineering practices, testing, and CI/CD maturity.
• Operations: Monitoring, incident management, reliability, and on-call support.
• Organization: Team structure, vendors, talent depth, and key-person risk.
• Security: Security architecture, data protection, policies, and certifications.

Scored against the principles we wrote the book on

Every finding is measured against the AKF scalability principles from The Art of Scalability and Scalability Rules. We also place the platform on the AKF Scale Cube — the X-axis (cloning and replication), the Y-axis (splitting by function or service), and the Z-axis (splitting by customer or data) — so you can see how far it can grow before the architecture becomes the constraint.

How the AKF Scale Cube works →

What the code shows

With read-only access, we analyze the repositories directly and compare the results with what we expect from a company at the target's stage:

• Delivery activity: commit velocity and trend, commit size, and how often work references tickets and tests.
• Team and key-person risk: active contributors, and whether the top all-time contributors are still active.
• Code quality signals: codebase size, test-to-source ratio, and third-party code checked into the codebase.
• Security: potential hardcoded secrets in the code and its history, and whether security scanning runs in the build pipeline.
• Open source: license risk in direct dependencies.
• Governance: CI/CD configuration, reproducible builds, and documentation.
• AI tooling adoption: disclosed signs of AI-assisted development in the repository.

What you receive

• Executive summary: the overall read on the platform, its strengths, and its material risks.
• Health ratings: green, amber, or red across all eight areas, with the evidence behind each.
• AKF scorecard and Scale Cube rating: how the platform measures against AKF principles and where it sits on each axis.
• Architecture callouts and SWOT: the specific architectural strengths and concerns, plus strengths, weaknesses, opportunities, and threats.
• Prioritized action plan: each observation with its impact, risk, and our recommendation.

Rapid or full technical due diligence?

Need to go deeper? A rapid engagement can be expanded into full technical due diligence on the same target, and the rapid fee can be applied toward it.

Use it on your own company

Rapid diligence also works as a buy-side readiness check. Run it on your own company before an acquirer or investor starts their diligence, and see in days what they are likely to find — then decide what to fix, what to document, and what to explain.

What we need from you

The standard technical data room. Send what exists; we note anything missing as a gap in the report.

Product and roadmap

• Current product and technology roadmap, including architectural items
• How the roadmap is prioritized, and how it balances growth, customer needs, and technical investment

Architecture

• Architecture diagrams showing components, deployment, scaling, and data flows
• Hosting providers and data centers used
• Tech stack, including custom-built, third-party, and open-source components
• Disaster recovery and business continuity plans
• Availability issues and failures from the past three years

AI / ML

• Inventory of models in use and their purpose
• AI/ML strategy: proprietary, fine-tuned, or off-the-shelf models
• Training data sources and the ML pipeline
• Model deployment, monitoring, and how performance and business impact are measured

Product development and engineering

• Product development lifecycle from idea intake through release
• Sprint planning, estimation, and tracking practices
• Coding standards, testing strategy, and CI/CD and release controls

Operations

• Monitoring, alerting, and observability tooling
• Incident management process and significant incidents from the past 12 months
• Uptime targets and actuals, and on-call structure

Organization

• Org chart and team structure, including employees, contractors, and offshore staff
• Development and operations vendors and their scope
• Hiring, onboarding, open roles, and known succession risks

Security

• Security architecture, access controls, and identity management
• Data protection and classification policies
• Security certifications and audits (for example SOC 2 or ISO 27001)
• Known security incidents or material risks from the past 24 months and how they were addressed

Code

• Read-only access to the repositories in scope

How we handle code access

• Read-only. AKF never receives write access to your code.
• Scoped. A fine-grained access token covers exactly the repositories in the engagement, in a single grant.
• Time-limited. Tokens carry an expiration date, so access ends on its own. If you prefer a separate credential per repository, we can use an SSH deploy key instead.
• Fully revocable. Either method can be fully revoked when the engagement ends.
• No secrets captured. Potential credentials in the code are flagged by location only; their values are never captured.
• Works with your Git host. GitHub, GitLab, Bitbucket, Azure Repos, and other Git hosts.

Frequently Asked Questions

See more questions in our FAQ →