Priced by the claims, quoted before we start.
The work scales with how much the software says about itself, not with how much code there is. A short README is a small job. A product with a documentation site is a larger one. After a brief intake we know which it is, and you get a fixed quote before anything begins.
Try it
Free
Read a completed claims review of a small open-source project and put questions to it. Developers evaluating a repository of their own can write to us for access to run one; we set these up by hand for now.
Claims review
$500 to $5,000 quoted after intake
A small target with one short claim document sits at the low end. A typical business engagement, one or two documents and up to about 150 claims, sits toward the top. Larger claim sets are quoted on the same basis.
Attested due diligence
Quoted per engagement
The claims review, plus a full reading of the record and a signed opinion by a practitioner with buy-side and sell-side experience, available to your deal team through closing. Expect a multiple of the claims review fee, set at intake.
What a claims review includes
Intake
A conversation about what you are evaluating and, for a deal, your thresholds, held in your own time over a page that fills the engagement form as you talk.
The review
Every claim in the agreed documents, tested against the repository and the materials supplied.
Check and rating
An independent re-reading of every finding's evidence, and ratings against your thresholds, replicated and looked at again where they differ.
The report
Findings with their citations, what was and was not examined, questions to put to the seller, and a signed conclusion if you ask for one.
Questions afterwards
A private page where you can ask about any finding for the life of the decision, with the record behind each answer.
The working record
Every search and every file opened, kept, so any finding can be traced back to what was looked at.
What it does not include
Running the software, load or penetration testing, a review of code quality or architecture, and legal or financial advice. Materials the seller does not supply, whatever sits on a hosted service, in a private module, or on a third party's platform, are reported as unsettled rather than guessed at.
Timing
Intake takes about a day. A review of a small target is usually back within a few days of receiving the materials; a typical business engagement within a week, with the report the day after. Attested engagements add the time for a full reading, agreed at intake.
Where the work runs
For paid engagements the repository is examined on isolated, single-tenant hardware the practice controls, in an environment created for the engagement and deleted afterwards. None of the seller's code is sent to any cloud model service, and where the seller requires it the environment is kept out of the buyer's sight as well. Your deal terms are held in the engagement file and nowhere else. The free demo is the exception: it runs on a hosted model, which is one reason it is limited to public code.
Terms, retention and the limitation of liability are set out in the engagement letter.