Source control history, branching model, and code ownership documented

CI/CD pipeline with automated tests and a rollback path

Architecture diagram reflects current production (not the original pitch)

Third-party dependencies and licenses inventoried

Secrets management — no credentials in source or shared docs

Backups verified by restore drill in the last 90 days

Logging, metrics, and on-call rotation defined

Data classification, retention policy, and DPA template in place

Security posture: SSO, MFA, least-privilege, vulnerability scanning

Key-person risk: ≥2 people can deploy and access every critical system

Customer contracts honour the actual stack (uptime, regions, sub-processors)

Regulatory scope mapped (GDPR/HIPAA/PSD2/etc.) with current gaps listed

Will your startup pass technical due diligence?