Code-Level Due Diligence
Source code tells stories that interviews miss. We extract security insights, development practices, and team capabilities, all while keeping code completely isolated.
How It Works
Upload
Client uploads source code via secure file transfer. Code is encrypted immediately upon receipt.
Scan
Automated security scanning identifies vulnerabilities, generates software inventory, and catalogs open-source licenses.
Analyze
AI-assisted triage classifies each finding. Human analysts review results and assess business impact.
Report
A summary report with finding name, file, and location is delivered via secure link. No code is disclosed.
Delete
All client code and working data is permanently destroyed. Encryption keys are deleted, making recovery impossible.
What You Get
Security Posture Assessment
Insights into security culture, team capabilities, and development practices based on code patterns and practices
Security Findings
Vulnerabilities prioritized by severity and exploitability with CVSS scores and affected files
SBOM & Licenses
Complete software bill of materials with dependency versions and license detection
Remediation Guidance
Actionable fix recommendations with code examples and effort estimates
Who This Is For
Corporate M&A
Evaluate acquisition targets with confidence before signing
PE/VC Firms
Portfolio company due diligence and security posture assessment
Sellers
Pre-sale security cleanup to maximize valuation and reduce deal friction
Security Controls
Isolation
Per-Engagement AWS Account
Each engagement runs in a dedicated AWS account. SCPs enforce region restrictions and block cross-account access.
Identity
Least-Privilege IAM Roles
ECS task roles scoped to the engagement's own resources. Short-lived credentials rotate automatically.
Network
Zero Internet Egress
No internet gateway. All traffic flows through VPC endpoints only. Code cannot be exfiltrated.
Access
SSM Session Manager
All analyst access via SSM. No inbound ports, no SSH keys. Full session logging to CloudWatch.
AI Privacy
Private AI Inference
Bedrock traffic via private VPC endpoint. No model training on customer data. Per-finding analysis.
Destruction
Crypto Shredding
KMS keys deleted after delivery. All encrypted data permanently irrecoverable. Audit logs persist.