You'll know whether the AI in the deck is in the code. You'll know who would take the system with them if they left. You'll know in days, while the LOI still gives you room to act, and before you spend $100k on a full audit.
The deck says "AI-powered." Assay finds every AI claim in the target's own README, docs and copy, then looks for the model SDKs, inference calls and data paths that would make each one true. A claim backed only by a test mock gets its own flag, because that is where a fake integration hides.
Assay reads the full commit history for the truck factor, the number of people who could leave before nobody can maintain the code, and names the critical files only one person has ever changed. You see it before that person takes the earn-out and leaves. Buyers already price it at a 0.5–1.5x reduction in the multiple.
A codebase sold as proprietary can carry copyleft obligations that change what you're buying. Assay finds the AGPL, GPL and LGPL signals and ranks the target by the worst family present. A license string inside a test fixture is annotated and never raises a red flag on its own.
Cloud keys, private-key blocks and tokens committed to the repository, each one redacted in the memo and marked as production code or test fixture. You learn what leaked without the memo leaking it again.
Whether tests and CI exist at all, and which files change constantly while one person writes nearly all of them. That is the maintenance cliff your engineering lead meets on day one. The finding stops at medium severity on purpose, so missing tests never outrank a leaked credential.
Assay reads the lockfile offline and lists every package that ships, including the ones nobody chose directly. You see copyleft that arrives through the dependency tree, packages matching a dated advisory snapshot, and a CycloneDX bill of materials your counsel can hand to an underwriter. A license Assay can't resolve is reported as unresolved and treated as unknown.
Read from the target's own Terraform, Kubernetes and Docker files: databases with no declared backups, ingress open to the internet, single replicas, base images past their support window. Findings stop at high severity, because those files record what someone intended and the running system may differ.
Most technical diligence is opinion with a logo on it. In an Assay memo, every claim points at something in the repository your own engineer can open: a file, a line, a commit.
A finding can cite only what a reviewer can check: commits, files, manifests, matched lines. Asked to assert a risk with no source, the engine stops with an error.
A check that didn't run is listed as UNKNOWN in the memo's gaps section, where you can see it, so a skipped check never reads as a clean one.
Every finding carries a confidence between 0 and 1, and the deal recommendation follows from severity by fixed rules. Screen the same repository twice and you get the same memo.
The method page has the full discipline, including what Assay refuses to claim.
Diligence memos get forwarded, quoted and argued over months later. Every Assay run carries the exact commit it examined and a cryptographic seal over each finding, so what your investment committee reads is what the engine wrote.
Re-run at the same revision and the seals come back byte-identical, on any machine. An edited memo fails verification. A consultancy PDF can't do that.
The target keeps committing between LOI and close. Re-screen and see what changed: code dumped in, a copyleft dependency added, a signal gone. A signal that disappears is reported as no longer detected, and you decide whether it was fixed.
Each metric is placed against earlier screens of targets the same size. Until 20 comparable screens exist, the benchmark reports itself as not assessed rather than dressing up unknown as average.
Assay Ready runs the same checks on your own codebase months before a sale process starts. You get a punch-list of what to fix instead of a deal recommendation, so each finding is closed on your schedule rather than priced into someone's offer. The engine and its thresholds are the ones a buyer runs.
AI-washing is now an enforcement target. The SEC charged Presto Automation, the DOJ charged Nate Inc., and Builder.ai's $450M collapse came after its AI claims met reality. Buyers are answering in their spreadsheets.
Sellers hate shipping their source to a stranger's cloud. Assay installs nothing and makes no network calls, so it runs where the code already lives and the seller never has to send it anywhere.
Read-only access to the repository under NDA, or the engine runs on the seller's own hardware. We never need production systems or customer data.
The engine pulls the evidence. A senior reviewer decides what it means for your deal thesis, and that judgment is what you're paying for.
Findings ranked by what they do to the deal, each cited, each with its confidence. It ends with the list of what was not assessed and the questions to put to management.
Tell us about the deal and when your LOI expires. If a screen isn't the right instrument, we'll say so.
Book a Screen