# Technical Due Diligence — example deliverable

Source: https://stacktr.ee/examples/technical-due-diligence

[← stacktr.ee](https://stacktr.ee/) · example deliverable · fictional client, real product · [Publish your own version](https://app.stacktr.ee/new?template=client-deliverable&from=example-technical-dd)

       Confidential · prepared for Northwind board
      For the board and its advisers only

         Sable & Fen
        Technology Advisory

# Technical Due Diligence

      Northwind logistics platform · pre-Series-B assessment

          Prepared forNorthwind Holdings
          EngagementNW·DD·0426
          Issued14 May 2026
          Lead reviewerA. Sable

          Contents
          [01 Executive summary](#s1)
          [02 Risk profile](#s2)
          [03 Material findings](#s3)
          [04 Remediation roadmap](#s4)

## 01 · Executive summary

### Sound architecture, three material risks to close before scale.

            Overall assessment
            Proceed. The platform is well-built for its current stage; three findings must be remediated inside 90 days to support Series-B load.

          Northwind’s engineering is above the median for its stage. The service boundaries are clean, deployment is automated, and test coverage on the billing path is genuinely strong. The concerns are not with what has been built but with what has not yet been hardened for the next order of magnitude of traffic and scrutiny.

          Three findings are material to the transaction. None is a reason to walk; each is a reason to hold a portion of the round against a dated remediation plan, set out in section four.

## 02 · Risk profile

### Where the exposure sits

          Assessed across six areas against our standard scale-readiness rubric. The matrix places the four findings by likelihood and impact; the strip beneath records residual risk by area after existing controls.

             Address pre-close
             90-day plan
             Monitor

          Residual risk by area · after existing controls

            Secrets & accessHigh
            Data resilienceMed
            ObservabilityMed
            DependenciesLow
            Code qualityLow
            DeliveryLow

## 03 · Material findings

### Three to remediate, one to watch

          The exposure concentrates on the revenue path. Where each finding sits:

#### Secrets present in CI build logs

              Critical

            Deployment credentials and a third-party API key are printed to the CI log stream and retained for 90 days, readable by every contractor with pipeline access. Ref DD-04 · owner: Platform

#### Single-region primary data store, no tested failover

              Material

            The primary store runs in one region with nightly backups but no read-replica and no rehearsed restore. Recovery-time objective is undefined; a regional outage is an unbounded outage. Ref DD-07 · owner: Infrastructure

#### No structured tracing on billing and fulfilment paths

              Material

            Failures on the two revenue-bearing paths are reconstructed from raw logs by hand. At Series-B load, mean time to diagnose becomes the bottleneck, not mean time to fix. Ref DD-02 · owner: Platform

#### Dependency drift within tolerance

              Monitor

            Two frameworks are a major version behind but under active support; no known-exploited advisories apply. Track and schedule; not a pre-close item. Ref DD-11 · owner: Engineering

## 04 · Remediation roadmap

### What to do, and by when

          Sequenced so the critical item clears before signature and the remaining three land inside the 90-day window the board is holding funds against.

              RefActionOwnerWindow

                DD-04Purge secrets from logs, rotate keys, move to a vault with scoped accessPlatformPre-close
                DD-07Stand up a cross-region replica and rehearse a restore; publish an RTOInfrastructure30 days
                DD-02Add structured tracing to the billing and fulfilment pathsPlatform60 days
                DD-11Schedule framework upgrades into the standard maintenance trainEngineering90 days

           Sable & Fen
          Technology advisory · prepared for the Northwind board · not for onward distribution

          Questions? a.sable@sableandfen.com
Engagement NW·DD·0426

  A fictional example published with Stacktree · no real client data

---
Full markdown summary of the Stacktree marketing surface: https://stacktr.ee/llms-full.txt