Technical Due Diligence
Independent, evidence-based assessment of any code estate — the one you own, the one you're building, or the one you're buying.
Hexalink Technical Due Diligence
Independent technical due diligence — evidence-based, vendor-neutral
Most organisations don't actually know what their code estate is — they know what they've been told it is. We establish it with evidence: for boards and executives who want independent confidence in the estate they own, for programme sponsors who need assurance that a codebase can carry the roadmap, for founders preparing for sale, and for acquirers running transaction diligence. The assessment works directly from the code — architecture, code quality, security, testing, delivery and operations, and engineering practice — and every finding is traced to file and line.
The only access required is read-only access to the repositories in scope. No managed-services upsell, no integration partner conflict — the report stands on its own. For a resilience and continuity review of an already-owned estate, see resilience and continuity.
How it works — three phases
A structured engagement from scoping through assessment to severity-classified findings.
Scoping & Access
Output · Scope document + access checklist
Confirm the engagement context — board assurance, programme review, sell-side preparation, or transaction — and define the code estate in scope by repository count and breadth. The only access required is read-only access to the repositories.
Code-Estate Assessment
Output · Evidence workbook
Assess architecture, code quality, security, testing, delivery and operations, and engineering practice. Every finding is traced to file and line — evidence, not impressions.
Findings Report
Output · Severity-classified findings + Q&A pack
Findings classified Critical / Important / Suggestion, with business impact and remediation priorities. Reviewed and signed by a senior advisor. Full Q&A pack for board, executive, or investment-committee challenge.
Engagements
Three ways to engage — scoped on a fixed-fee basis at the scoping call.
Repository screen
Inside a week
A rapid assessment of a single repository — a fast, low-friction read on the health of a codebase. Credited in full against a fuller engagement.
Estate assessment
Scoped to the estate
The full code-estate assessment, scoped by repository count and breadth — for board assurance, programme confidence, or transaction support. Architecture, code quality, security, testing, delivery and engineering practice, with file-and-line evidence throughout.
Sell-side review
Before going to market
For founders and management teams who want to know what a buyer will find before going to market — the same assessment, run on your own estate, on your own clock.
What we assess
Six domains of the code estate — each assessed with file-and-line evidence.
Architecture
Structure, stack choices, technical debt, scaling constraints, and the cost trajectory they imply.
Code quality
Maintainability, complexity, consistency, and the health of the codebase you own — or the one you're taking on.
Security
Vulnerable patterns, secret handling, dependency exposure, and security practice in the code itself.
Testing
Test coverage and depth, what is actually verified, and where regressions would go unnoticed.
Delivery & operations
CI/CD, release practice, observability, and how reliably the team ships to production.
Engineering practice
Review discipline, contribution patterns, key-person concentration visible in the history of the code.
Why this is different: evidenced, judged, independent
Evidence over opinion
Every finding traced to file and line — a source, not an impression. The report survives challenge because each claim can be checked.
Judgement is the deliverable
Automation finds the issues; a senior advisor decides what matters, reviews the findings, and signs the report.
Independent of vendors and integrators
No managed services upsell, no implementation partner conflict, no downstream consulting hook. The report stands on its own.
Who we work with
Four buyer segments, each with a specific use of the due diligence report.
C-suite & Boards
Independent confidence in the estate you already own — before a major investment, after an acquisition, or when delivery keeps slipping and nobody can say why.
Programme Sponsors
Assurance on vendor-delivered or internally-built programmes — whether the codebase behind the roadmap can actually carry it.
Founders & Management (sell-side)
Know what a buyer will find before going to market — and fix what can be fixed on your own timetable.
Investors & Acquirers
Transaction diligence where access exists — exclusivity, post-LOI, or sell-side mandates. Findings that materially affect valuation, terms, and 100-day plans.
Book a due diligence scoping call
A 30-minute call to understand the context, the repository count, and the timeline — and decide which engagement fits: repository screen, estate assessment, or sell-side review.
Book a callFrequently asked
Have a specific transaction question? Talk to us
v1.2 · Aug 2026 · Hexalink Ltd