Technical due diligence on software: what to check before you buy
Easy Insight Team ·
Technical due diligence is an independent check of software before you pay for it: who owns the code, how it is built, how secure it is and who can keep it running. For an SME buying a business, a product or a system someone else built, it turns vague technical risk into a costed list you can negotiate on.
When does an SME need technical due diligence?
Whenever a large part of what you are paying for is software you did not build and cannot easily replace. In practice that means four situations:
- Buying a business whose value depends on its own software: a booking platform, a customer portal, an internal system the whole operation runs on.
- Buying a product outright or licensing a white-label platform you will build your business on.
- Taking over a bespoke system from a previous supplier, whether the agency is leaving or you are moving the work elsewhere.
- Investing in a software company, even a small stake.
It is not the same as choosing who should build something new. That is supplier selection, and we cover it in how to choose a web development agency. It is also not the build-or-buy decision itself, which comes earlier; see build vs buy software for SMEs. Due diligence is what you do once you have a specific piece of software in front of you and money about to change hands.
What does technical due diligence actually check?
Six areas cover nearly everything that goes wrong after a purchase.
| Area | The question it answers | What a red flag looks like |
|---|---|---|
| Ownership and IP | Do the people selling it actually own it? | Contractors wrote the code and there are no signed assignments |
| Third-party components | What is it built from, and on what licence terms? | No list of dependencies; copyleft licences nobody has read |
| Architecture and code | Can it be changed without breaking? | No automated tests, no documentation, one giant file nobody touches |
| Hosting and operations | Where does it run, and who controls the accounts? | Hosting on a developer's personal account; no backups tested |
| Security and data | How is it protected, and what personal data does it hold? | No patching routine; personal data with no record of why it was collected |
| People | Who understands it, and will they stay? | One developer knows everything and is leaving after the sale |
Who owns the code?
This is the check that most often surprises buyers. Under UK law the author of a work is its first owner of copyright, and the exception only covers work made by an employee in the course of their employment. Code written by freelancers or an agency belongs to them unless it has been assigned, and an assignment of copyright is not effective unless it is in writing and signed by or on behalf of the assignor.
So ask for the contracts, not a reassurance. If the system was built by three different freelancers over five years, you want three signed assignments.
What is it built from?
Modern software is mostly other people's code: open-source libraries, paid components and cloud services. Each comes with its own licence and its own security updates. The UK government's voluntary Software Security Code of Practice, published in May 2025, asks vendors to "understand the composition of the software" and to manage the risk of third-party components. A seller who cannot produce a list of what the system depends on has not done that, and you will inherit the gap.
Can it be changed safely?
A reviewer reads the code, but the useful signals are simple. Is there a working way to set up a copy for development? Are there automated tests, and do they pass? Is the code in version control, with a history that shows regular, small changes? Software that only one person can deploy, from their own laptop, is a risk however good the code looks.
Where does it run, and who holds the keys?
List every account the system needs: hosting, domain, email sending, payment provider, app stores, monitoring. For each one, find out whose name it is in and whether it can be transferred. A domain or hosting account still registered to a former developer is an easy problem to miss and an awkward one to fix after completion.
What about personal data?
If the software holds customer or staff data, the purchase moves that data to a new controller, and data protection law comes with it. The ICO's guidance on due diligence when sharing data following mergers and acquisitions says to establish what data is being transferred, the purposes it was originally collected for and the lawful basis for sharing it. It also advises getting technical advice where different systems are involved, because data can be lost, corrupted or degraded in the move.
That is a legal check as much as a technical one, so pair the technical review with your solicitor's work rather than treating either as a substitute for the other.
How much does technical due diligence cost?
It scales with the size of the system and the depth of review. As of October 2026, one UK provider, Rocking Tech, lists a fixed-fee technical review at £15,000 plus VAT over ten working days, and a full technical due diligence at £35,000 plus VAT over fifteen working days. Those prices are pitched at investment deals.
For a small business buying a single system, a narrower review is often enough: ownership, dependencies, hosting and a senior engineer's read of the code and deployment. Whoever you use, ask for a fixed fee, a written scope and a costed list of findings rather than a pass or fail. The point is to put a number on each problem so it can move the price, become a condition of the deal or be fixed before completion.
For a sense of what fixing or rebuilding might cost if the review finds serious problems, our app development cost guide sets out typical UK price bands.
What should you ask the seller for on day one?
Access is often the slowest part of a review, so ask early. A short list:
- Read access to the code repository, with full history.
- The contracts and IP assignments for everyone who wrote code.
- A list of third-party components and paid services, with licences.
- Admin or read-only access to hosting, domain and monitoring accounts.
- Any security test reports, incident records and the patching routine.
- A record of what personal data the system holds and why.
- An hour with the person who knows the system best.
If a seller hesitates over most of this list, that tells you something too.
Who should do the review?
Someone senior with no stake in the outcome. That rules out the seller's own developers and, ideally, the agency hoping to win the rebuild. It does not need a large firm: one experienced engineer who has built and run similar systems will find more than a team working through a template. We think the review is only worth paying for if the findings are costed and explained in plain English, so the people negotiating the deal can use them.
If you are weighing up software you are about to buy or inherit, see how we approach app development and SaaS products, or tell us what you are looking at.
Frequently asked questions
What is technical due diligence on software?
An independent review of a piece of software before you commit money to it: who owns the code, how it is built and hosted, how secure it is, who can maintain it, and what it will cost to keep running. The output is a list of risks with rough costs attached, so they can shape the price or the contract.
How much does technical due diligence cost in the UK?
It depends on the size of the system and how deep the review goes. As of October 2026, one UK provider lists a fixed-fee technical review at £15,000 plus VAT over ten working days, and a full review at £35,000 plus VAT over fifteen. A narrow review of a small system can cost much less; ask for a fixed fee and a defined scope.
Who owns the code if a contractor wrote it?
By default, the contractor. Under the Copyright, Designs and Patents Act 1988 the author is the first owner of copyright unless the work was made by an employee in the course of their employment, and an assignment only takes effect if it is in writing and signed by the assignor. Ask to see the signed assignments.
How long does technical due diligence take?
As of October 2026, the UK provider quoted above lists ten working days for a technical review and fifteen for a full one, counted from when access is granted. A narrow review of a small system can be quicker. Getting access to the code, accounts and people is often the slowest part, so ask for it on day one.
Can we do technical due diligence ourselves?
You can do the paperwork checks yourself: ownership, contracts, licences, hosting accounts and who holds the passwords. The code, architecture and security review needs a senior engineer who has no stake in the deal, because a junior with a checklist will miss what matters.
Easy Insight is a UK consultancy for AI, web, apps and data — senior specialists only, no juniors.
Next step
Have an app or a product in mind?
We build mobile apps and SaaS products end to end, and run two of our own, Manifold and Quarterly, so the advice comes from production, not a pitch. Apps from £6,000, SaaS and MVP builds from £12,000, fixed price in writing.