What a technical due diligence report actually looks like.

The core is a 540K-line Rails monolith with background processing in Sidekiq and three satellite services split out since 2022. The monolith is well-modularized and the team ships weekly. This is a maintainable codebase, not a distressed one.

The problem is the tenancy model described in Risk 1. Database-per-customer was a rational choice at 20 customers and is a growth ceiling at 209. Schema migrations already take a full weekend across the fleet; at the modeled customer count they stop being feasible at all.

Automated test coverage is 34% overall but 71% on the billing and rating paths, which is where coverage matters. Static analysis shows no hotspots beyond the usual accumulation in a 10-year-old codebase.

The material debt item is framework currency: the Rails version in production reaches end-of-life in 11 months. The upgrade is a known, bounded job (estimated at 6-8 engineer-weeks) but it is not on the roadmap, which says something about how the roadmap is built.

21 engineers, median tenure 4.2 years, contractor share 24% and falling. Attrition over the trailing 24 months is 9%, well under sector norms. Interview answers were consistent across levels, which usually means the org chart reflects how work actually happens.

The exception is the rating-engine concentration in Risk 2. Nothing else in the team profile approaches it; fix that one exposure and this section is Green.

The open pen-test findings and untested tenant isolation are covered in Risk 3. Beyond those: secrets management is now clean (rotated after a 2024 repository-history exposure, handled properly at the time), but there is no bug bounty or coordinated disclosure route, and SOC 2 remains Type I when two enterprise prospects in the pipeline require Type II.

None of this is unusual for a company of this size. It is still the section most likely to produce a post-close surprise, which is why it carries the only Red.

AWS spend is $74K/month, of which 68% is RDS: a direct consequence of 212 databases. Measured gross margin lands at 71% against the 78% presented in the CIM; the difference is almost entirely infrastructure.

The multi-tenancy work in Risk 1 recovers most of it. Modeled conservatively, pooled tenancy takes roughly $30K/month out of the RDS bill, which moves margin about 4 points at current revenue.

The headline roadmap item, AI-assisted quoting, depends on historical pricing data that engineering describes as "not usable without a cleanup project." No cleanup project exists on any plan. The feature as marketed is 2-3 quarters further away than the roadmap states.

Separately, 55% of the next two quarters' engineering capacity is already committed to custom integration work for two enterprise customers. The roadmap assumes that capacity twice.

Employee IP assignment is clean and the open-source dependency licenses are unremarkable (MIT/Apache, no copyleft in the distributed product). Two early contractors (2015-2016) have no IP assignment on file; their commits touch roughly 6K lines in the tariff module, which is still in production.

This is a legal cleanup item rather than an engineering one: chase the assignments or plan a rewrite of the affected module. Flagged to counsel.