Part of IOanyT’s engineering capability. Most clients reach this team through a Workflow Diagnostic or Proof Sprint. How we work
Engineering · Assessment
Code audit and technical due diligence: what you really have, before you sign
You are about to invest in, buy or take over a codebase. Or you inherited one and need to know what you really have before you plan the next year. We read the code and the set-up around it, and give you a written report in plain language: what is sound, what is risky and what to fix first.
Read-only code access, logged and never used for training. An NDA is fine.
Who it’s for
- Investors and acquirers who want to know what the software is really worth before a deal.
- Founders and boards taking a product over from another team or supplier.
- CTOs planning the next year on a codebase they inherited.
- Built with AI coding tools? See AI Code Rescue, the same review written for AI-built apps.
What you get
A health report
Architecture, code quality, tests, dependencies and security, each rated, with the evidence.
Risks ranked by business effect
What could hurt the business first, not what looks untidy.
Who holds what
The accounts, domains, licences and keys the product depends on, and whose name each is in.
A prioritised fix list
Each fix with its effort, to plan, negotiate or budget with. Plus a readout call and a short summary you can share with an investment committee or board.
How it works
-
Step 1
Kick-off and access
We agree who the report is for and any deal date. You give read-only access to the repositories.
-
Step 2
Read the code
AI does a first pass over the code; our senior engineers review every finding and trace it to the code.
-
Step 3
Write the report
Each area rated with evidence, risks ranked by business effect, who holds what, and a fix list with effort.
-
Step 4
Readout call
We walk you through the findings and give you a short summary to share with an investment committee or board.
What you own
- The report may say the code is fine. It is yours, and any supplier can act on it.
- Code access is read-only and logged, never used for training, and deleted within 30 days of the review ending unless we engage.
What it does not cover
- Fixing what we find. We quote it separately, or your own team or another supplier does it.
- Legal, financial or commercial due diligence.
- A penetration test, or any certification.
- ISO/IEC 27001
- ISO 9001
- AWS Advanced Partner
- Founded 2016
- 50+ engineers
The review may recommend another supplier, or no change at all. We take no referral fees.
Code audit questions
Can you work to a deal date?
Tell us the date when you get in touch. If our timeline doesn’t fit it, we say so before we start.
Who sees the report?
Whoever ordered it. Sharing it with the other side of a deal is your decision.
Is this a penetration test?
No. It reviews security in the code and set-up (dependencies, secrets, access). A penetration test is separate work.
Do we have to fix it with you?
No. The fix list is written so your team or any supplier can carry it out.
Start with the free Review.
Free, 60–90 minutes. Bring the system or decision you are weighing; we tell you what to check first, in a 2-page note you keep.
Fixed price, agreed at scoping. The quote comes from Pricient — by IOanyT, itemised with exclusions.
Prefer to start through Upwork, with escrow and milestone payments? Several of our fixed-scope engagements are available there. See them on Upwork