Walk into your raise knowing exactly what your tech DD will say.

Three ways, from granting temporary access to keeping your code entirely in your own hands. Grant our reviewer read-only access for a short while, the same way you’d onboard an engineer, and revoke it the moment the scan starts. Install a scoped GitHub or GitLab app with read access to only the repositories you choose. Or upload it yourself to a single-use, encrypted bucket. Whichever route you choose, your code runs in a locked-down EU environment, is never executed or read line by line, and nothing is sent to the US.

Technical due diligence is a structured review of a company’s technology, product, and engineering, the assessment an investor runs before they commit. It looks at architecture and scalability, security and compliance, code quality and delivery, the team, AI readiness, and how all of it maps to the commercial plan. Traditionally it takes weeks of interviews and self-reported metrics. Our X-Ray runs it against your live codebase instead: read-only access in under 30 minutes, 300+ checks operator-verified, and a clear report the next business day. You get the same picture an investor would, early enough to act on it.

A red flag is a finding serious enough to change the terms of a deal, or kill it. Common ones are security vulnerabilities left unaddressed, code the company doesn’t fully own, a single engineer who holds critical knowledge no one else has, or an “AI product” that turns out to be a thin wrapper. The point of running your own technical due diligence first is simple: find the red flags before an investor does, and either fix them or have an answer ready.

ISO 27001, SOC 2 Type II and GDPR alignment are all in progress. In the meantime, every engagement is NDA-covered, read-only, encrypted, and operates on a zero-retention basis with written confirmation once your data is wiped.

No. Your code is analyzed in-context inside a secure, isolated dataroom and retained only for the engagement. When the dataroom is wiped, you receive written confirmation that all of your data is gone. Access is read-only, encrypted, scoped, fully auditable, and revocable at any time.

It runs in a locked-down AWS environment in the EU, inside an isolated network with outbound traffic blocked except for a handful of EU-only endpoints. Any model analysis runs in an EU inference region. Nothing is sent to the US, and every action is captured in an audit log.

To run the automated scan, your code does need to be read in our secure environment, but you control how it gets there: upload it yourself to a single-use, encrypted bucket, grant temporary read-only access, or install a read-only app. Wherever it runs, it stays in a locked-down EU environment, is never executed or read line by line, and is deleted afterwards with written confirmation. If you genuinely cannot share code at all, we can do a guided remote walkthrough instead, where it stays on your screen, though that is a more limited, manual review.

No. Many companies run an X-Ray on their own, to get an objective read before a raise, a board cycle, or a key hire. Investors often initiate it too. Either way, the process and the reports you receive are exactly the same.

Under 30 minutes, total. One person grants read-only access to your repositories and signs the NDA. After that, the scan and review run on our side. There are no interviews or questionnaires required.