What is the meaning of technical due diligence?

It is a review of a company’s technology before an acquisition or investment. It covers the codebase, infrastructure, security, dependencies, and the engineering team behind them. The goal is to show what you are buying before you transfer funds.

How do I do technical due diligence on a small AI SaaS?

Get read access to the repository, run dependency, secret and license scans, and ask the founder to walk through the core flows. Then check provider dependency, margins against actual invoices, and who owns the prompts and data. Rank every finding as a blocker, a price adjustment or a post-close task.

How much does technical due diligence cost?

There is no standard price. Cost is set by scope: the number of repositories and services, compliance requirements and system complexity. For small deals, a time-boxed review by an experienced engineer plus automated scans is usually the proportionate approach.

What is the difference between a code audit and technical due diligence?

A code audit examines the source code itself: quality, security and maintainability. Technical due diligence is broader. It adds infrastructure, third-party dependencies, IP ownership, operational data and the people who run the system. In an acquisition, the code audit is one part of the whole review.

Do I need an outside firm for a deal under $100k?

Not always. Many buyers combine automated tools with a trusted engineer. Bring in a specialist when the product handles regulated data, spans several systems, or when the code is something neither you nor your engineer can follow.

Technical Due Diligence for AI SaaS Acquisitions

It is written for buyers acquiring micro-SaaS, AI wrappers and agent products, and for sellers who want to know what will be inspected. We run an AI SaaS marketplace, so the examples lean toward deals in the $5k to $100k range, where a full consulting engagement rarely makes economic sense.

AI Exchange Club

aiexchange.club

Find AI SaaS Deals to Review

Browse AI SaaS listings on a curated marketplace, then assess each opportunity’s code, infrastructure, dependencies, and risks.

Browse AI SaaS listings

TL;DR

Technical due diligence reviews the codebase, infrastructure, security, dependencies and the people behind them. It shows what you are buying before you wire the funds.
For AI products, add three checks: model and API dependency, prompt and data ownership, and whether the current owner can actually explain the AI-generated code.
Scope drives cost, not a price list. Scale the audit to the deal: a self-serve checklist and a few hours of an experienced engineer for small deals, a formal assessment for larger ones.
Listings on AIExchange.club are free, the success fee is a flat 10% with no monthly fees, and deals close through escrow with standardized contracts. The marketplace is for AI SaaS businesses only.

What technical due diligence covers

The definition most advisers use is consistent: an in-depth analysis of a company from a technical perspective, including its products and infrastructure. The same review is run by acquirers, by investors, and by founders preparing a raise on their own product’s credibility.

In practice it breaks into six areas:

Code and architecture. Structure, readability, test coverage, how hard changes are to make.
Infrastructure and operations. Hosting, deployment, monitoring, backups, who holds the cloud accounts.
Security and compliance. Secrets handling, access control, data protection, and any certifications customers expect.
Third-party dependencies. Open source licenses, paid APIs, model providers.
Data and IP. Who owns the code, prompts, training data and customer data.
People and process. Who knows how it works, and what leaves with them.

The point is not a perfect score. Every codebase has debt. The point is to price the debt and to find the problems that restructure a deal or kill it.

Why small AI deals need a lighter, sharper audit

Large-company due diligence assumes a data room with hundreds of documents and a team to read them. A $20k AI wrapper has a repository, a Stripe dashboard, a cloud console and a founder. If you apply the enterprise process, the audit can cost more than the discount you would negotiate with it.

Cost guidance from practitioners agrees on one thing: technical due diligence cost is set by scope, not by a standard price list. The drivers they name include how many repositories and services need review, whether compliance work such as SOC 2, HIPAA or PCI is in scope, and how complex the system is. A single-repo AI tool with one database and two API providers sits at the cheap end of every one of those drivers.

So scope on purpose. Decide which risks could cost you the most relative to the purchase price, and spend your hours there.

Why small AI deals need a lighter, sharper audit — overview diagram

The code audit: what to look at first

Start with the repository, not the pitch deck. Ask for read access to the code, ideally through a screen share or a temporary read-only invite, under the NDA you already signed.

Structure and coupling

Open the main directories and read the entry points. You are looking for code that is hard to modify without causing widespread side effects, which is tight coupling, or code that relies on obsolete frameworks. A quick test: pick one small feature you would want to change after closing, such as swapping the model provider, and trace how many files you would touch. If the answer is “everywhere”, price in a rewrite.

Tests and deployment

Check whether tests exist, whether they run, and whether deployment is automated. A founder who deploys by SSH and copying files is a single point of failure. Ask to see one deployment end to end. If the founder can ship a fix in ten minutes with a pipeline, you inherit a working process. If it takes an afternoon of manual steps, you inherit a risk.

Dependencies and licenses

List every dependency and check for abandoned packages, known vulnerabilities and restrictive licenses. Software composition analysis tools do this automatically; Snyk’s overview of technical due diligence places dependency and security scanning inside the standard review. Run a scan yourself or have your engineer do it. It takes minutes and produces a concrete list to discuss with the seller.

Secrets and access

Search the repository history for API keys, tokens and passwords. Then confirm who holds the keys to each account: domain registrar, cloud provider, model API, payment processor, email sender, analytics. Everything should be transferable to you at closing. Anything tied to the founder’s personal account needs a transfer plan written into the contract.

Code quality metrics that matter for SaaS

Buyers often ask for a number. There is no single score, but a short set of metrics tells you most of what you need. Use them as conversation starters with the seller, not as pass or fail gates.

Metric	What it tells you	What to ask
Test coverage and test pass rate	Whether changes can be made safely	Do tests run in CI, and do they pass today?
Dependency age and vulnerability count	Maintenance habits and security exposure	When were dependencies last updated?
Deployment frequency and time to deploy	How easily the product evolves	How long does a release take?
Change coupling (files that always change together)	Hidden architecture problems	Which parts break when you touch billing?
Error rate and uptime history	Production health	Can I see the last 90 days of monitoring?
Cloud and API cost per active customer	Whether margins hold at scale	What did last month’s bills total, by provider?
Bus factor	How many people understand the system	Who besides you has touched this code?

The last two rows are not strictly code metrics, but for a small AI product they matter more than cyclomatic complexity. Inference costs can turn a profitable-looking product into a thin-margin one, so reconcile the seller’s reported margin with actual invoices from the model provider.

The AI-specific questions

A conventional audit misses what makes an AI product different. Add these checks.

Is the code a black box to its owner?

Many products are now built with heavy assistance from AI coding tools. That is not a defect. The question one due diligence guide raises is whether the existing team can explain, maintain and secure the code that AI produced, or whether the product is effectively a black box to them. Test it directly: pick a module, ask the founder to walk you through it, then ask them to explain how a bug in it would be diagnosed. Founders who built the product understand the answers. Founders who pasted it together often cannot.

This matters because you are about to become the maintainer. If the seller cannot explain the code, you will be learning it from scratch, with a live customer base.

How dependent is the product on one model provider?

Most AI wrappers call a third-party model through an API. Check which models and versions are used, whether prompts are written for one vendor’s quirks, and how hard a swap would be. Ask what happens if pricing changes or an endpoint is deprecated. A well-built product isolates the model call behind one interface. A fragile one has provider-specific logic scattered through the codebase.

Who owns the prompts, data and outputs?

Confirm that prompts, fine-tuning data, evaluation sets and customer data are all legitimately the seller’s to transfer. Check the terms of service of the model providers and of any data sources, and whether customer data is used in ways the privacy policy allows. These are legal questions as much as technical ones, so have a lawyer review the asset purchase agreement language for IP and data representations.

What risk framework is the product held to?

If you sell to businesses, expect their security questionnaires to ask about AI governance. The NIST AI Risk Management Framework is a voluntary U.S. framework, published by the National Institute of Standards and Technology in January 2023, for identifying and managing AI risks across the lifecycle. A small product does not need a full program, but it should be able to say what data goes to which model, where outputs are stored and what is logged. Vendor risk assessments for AI tools look at model governance, data handling and security, so a seller who can answer those questions has a stronger product to hand over.

Choosing audit tools without overspending

Buyers searching for the best code audit tools usually want one product that does everything. No such product exists, and for a micro-SaaS you do not need one. Combine three layers:

Automated scans. Dependency and vulnerability scanning, secret detection, license checks, and a linter or static analysis pass. Many have free tiers suitable for a single repository.
A structured manual review. Two to four hours from an engineer who has shipped products in the same stack. They read the core flows, billing, authentication and the model integration.
Operational evidence. Cloud invoices, uptime logs, error tracker exports and support tickets. These show how the product behaves, which no static tool can.

Hosted software M&A platforms also bundle automated technical reports with a data room and escrow. For example, Codekeeper advertises a 72-hour technical due diligence report as part of its transaction services. We do not link to services that compete with ours, so treat it as a sign of where the market is heading: faster, more automated reports, delivered earlier in the deal.

What to do with the output matters more than which tool produced it. A good report turns findings into a ranked list with effort estimates. Scoping guidance for technical assessments describes deliverables in tiers: executive summaries for decision makers, detailed analyses for integration planning, and actionable roadmaps. For a small deal, a one-page version of all three is enough.

How much should technical due diligence cost?

We will not invent a number, because credible sources say it depends on scope. What you can do is set a budget rule: spend on the audit in proportion to what could go wrong, and keep the total small against the purchase price.

What moves the price up:

Several repositories or microservices instead of one
Compliance requirements such as SOC 2, HIPAA or PCI
Complex infrastructure or custom-trained models
A requirement for a written, formal report for lenders or investors

What keeps it down:

One repository and one database
Standard frameworks and managed hosting
Clear documentation and a founder who answers questions quickly
Using your own engineer, or a freelancer you trust, for a time-boxed review

Ask any provider for a fixed-scope statement of work before you start. If they cannot say what the deliverables are, the price will drift.

A step-by-step process for a sub-$100k deal

Define the risks that would change your offer. Revenue concentration is a commercial matter; for technical diligence, think about vendor lock-in, security holes and key-person dependency.
Request a standard document set. Repository access, architecture notes, account inventory, list of third-party services, last 12 months of infrastructure and API bills.
Run the automated scans. Dependencies, secrets, licenses. Share the results with the seller and let them respond.
Do the founder walkthrough. One hour, recorded if the seller agrees. Cover architecture, deployment, billing and the model integration.
Do a focused manual review. Authentication, payment handling, data storage and the AI pipeline.
Rank findings. Mark each as a blocker, a price adjustment or a post-close task. Attach an effort estimate.
Negotiate with evidence. Convert blockers into closing conditions and adjustments into a price change or a holdback.
Plan the handover. Account transfers, knowledge transfer sessions and a support window written into the contract.

If you have not run the commercial side yet, our due diligence checklist for buying a business covers financial, legal and customer checks, and our step-by-step guide to buying an AI SaaS business shows where technical review sits in the whole sequence.

Red flags that should change your offer

The founder cannot explain core modules, or the repository history is a single commit.
Production credentials are stored in code or shared widely.
One model provider is hard-wired everywhere, with no abstraction layer.
No tests and no automated deployment, on a product with paying customers.
Reported margins that do not reconcile with cloud and API invoices.
Unclear ownership of code, prompts or data, such as contractor work with no written assignment.
Dependencies with restrictive licenses that conflict with a commercial product.
Reluctance to grant access at all. Sellers with something to hide delay the code review.

Not every flag is a deal breaker. Technical debt is often underestimated, but a known and priced debt is a negotiating point, not a surprise.

If you are the seller: prepare before buyers ask

Buyers will run the checks above. Sellers who prepare get faster closes and fewer price cuts. Write a short architecture overview, an inventory of every account and key, a dependency list, and a cost breakdown by provider. Clean secrets out of the history. Document the deployment steps. Our guide on what buyers check when you sell an AI app goes through the full list, and the 12-month preparation checklist helps if you are planning ahead.

Our perspective on technical diligence

We see technical diligence as the step that turns a listing into a deal. On AIExchange.club, every transaction runs through a six-stage pipeline: kickoff, LOI, due diligence, APA, escrow and closing. Due diligence sits in the middle on purpose. By then the buyer and seller have agreed on the basics in a letter of intent, so the review is about confirming facts, not hunting for reasons to walk away.

Our view is that the audit should be sized to the asset. Most of the AI SaaS businesses on our marketplace are small. The right review is quick, evidence-based and specific to how AI products fail: provider dependency, unexplained generated code, and margin leakage through inference costs. We verify revenue and code quality on listings, but we always tell buyers to run their own checks on anything they plan to rely on.

We also think sellers should expect the review and welcome it. A founder who hands over clean documentation signals a well-run product, and that tends to protect the price. Contracts are standardized and funds are held in escrow, so both sides know what happens if a finding changes the terms.

— Phillip

Where to find deals and how we support them

If you are ready to buy or sell, you can browse AI SaaS businesses on the marketplace, submit an offer or join a live auction. Listing is free. The success fee is a flat 10% paid only when a deal closes, with no monthly fees, and every deal closes through escrow with standardized contracts. Buyers who want full marketplace access can take Marketplace Membership at $49 per month or $399 per year; details are on the pricing page. Our marketplace is for AI SaaS businesses only, so you are not sorting through unrelated listings.

Sellers who want a number before listing can use the AI SaaS valuation quiz. Larger or more complex deals can go through Boutique AI M&A Advisory.