Technical Assessment & Health Check

Led the technical due diligence of a digital bank owned by one of Argentina's largest insurance groups, inside the M&A process in which the group acquired part of the fintech where I was VP of Engineering. Architecture, security, infrastructure, regulatory context and engineering team, reported straight to the decision-makers. The deal closed.

A founder had to decide whether to build a new business on an insurance-broker platform already in production: 600+ active producers, 6 carriers integrated. Seven dimensions assessed, 105 findings, including critical security issues. The cognitive load index came back at 450 out of 1000 on the legacy platform against 220 on the newer one, measured across 870 files and 195K lines. Deliverables: a findings register classified by severity with evidence, a consolidated risk matrix, a phased remediation roadmap, and an executive readout that informed the adopt-or-walk decision.

Full audit of a brokerage platform (PHP/React): technical debt, architectural risk, code quality, delivery practices and vendor performance. The findings drove a team restructuring and the replacement of an underperforming consulting firm.

Assessments of credit-risk and collections platforms for a lending group: security and compliance review (OWASP Top 10, banking regulatory mapping), technical debt with repository forensics (bus factor, change hotspots, churn × complexity) and a prioritized remediation roadmap.

It depends on why you are asking, because the order follows the risk that prompted the question. Before a round I start with Security Posture and Architecture; after a founding CTO leaves or an acquisition, with Code Quality and Infrastructure; before a rewrite, with Architecture and Technical Debt; after an agency handover, with Infrastructure and Security Posture. If none of those fits, the Focused Assessment on one area is the cheaper way to start.

Yes, and it is a different read from the founder-side version. On an investment I am working out whether the team can keep making good decisions after the round closes, so the weight goes on repository history (bus factor, change hotspots, churn against complexity) and on security and compliance exposure that becomes yours once the money is in. Same formats and prices, same read-only access, and I need the founder's cooperation to get it. Portfolio companies you already hold work the same way.

Read-only access to source code repositories, cloud console (AWS/GCP/Azure), and any existing documentation. I can work with whatever access level you're comfortable with. More access means deeper analysis.

Some disruption, but bounded. Plan on 4-6 hours from your technical leads for a Focused Assessment, and closer to a full day (spread across four weeks) for the Full Health Check. A kickoff call, a few conversations with the people who actually know the system, and questions that land in Slack as I work. Everything else happens in the code and the infrastructure.

I'll tell you. Better to know now than during due diligence or after a production incident. The report includes not just problems but practical paths to fix them.

Yes. A fractional CTO engagement (monthly retainer) is the natural follow-up when remediation needs ongoing leadership. We can scope it together after you see the report.

Tools find symptoms. I find causes. Automated scanners can tell you about known vulnerabilities or code smells. I can tell you why your architecture will break at 10x scale and what to do about it. Every finding also says how it was verified: read in the code, reproduced on a local copy, or confirmed by your team.

Yes. I sign an NDA before accessing anything. Your repository lives in an encrypted volume on my machine, and the AI tools I use read only a copy with personal data and secrets redacted. The report is served behind a sign-in limited to the people you name, and I delete every copy when the engagement closes.