Flagship
A 360° tech audit is a 15-hour, fixed-scope review of a startup's architecture, security, delivery process, team, and infrastructure costs, delivered as a scored report and a 90-day roadmap.
I take one per quarter, alongside my full-time work as co-founder and CTO of Togethrust. The cap is the point: it keeps the work senior and the attention undivided.
Who it's for
Any software company. The regulated end is simply where my background goes deepest.
Pre-fundraise founders who need a credible technical story before diligence starts.
Founders unsure whether their stack and team still fit the company after a period of growth.
Companies operating after a CTO departure, with no senior technical read on where things stand.
Not built for replacing a dev shop on price, finishing a no-code MVP, or forming a technical opinion before there is code to read.
What's covered
Reviewed in one pass, so the findings connect instead of arriving as five separate opinions.
What you get
D.01
Each of the five areas scored, with the evidence behind the score. Written to be forwarded to a board or an investor without translation.
D.02
What to fix first, what can wait, and what to leave alone. Ordered by risk and effort, not by what is most interesting to build.
D.03
One working session with the founding team to walk the findings, argue with them, and agree on what happens next.
Inside the report
Three parts, in this order. Nothing padded, nothing held back for a follow-on engagement.
R.01
One score per area, with the evidence behind it, so a reader can check the reasoning rather than take the number on trust.
R.02
Not a list of everything that could be better. The findings that carry real risk, ordered by how much.
R.03
Split into three blocks, ordered by risk and effort rather than by what is most interesting to build.
Written to be forwarded to a board or an investor without translation.
How it works
Fixed scope, fixed fee, quoted after a 30-minute diagnostic call. I scope the depth to fit the box rather than letting the box grow.
Fixed scope · Hard-capped
Reality Check, 90 minutes. Before anything is scoped, one session to establish whether a full audit is warranted. If it is not, you keep the read and we stop there. It is arranged on the free diagnostic call, not booked separately. How engagements run.
You provide repository, infrastructure, and documentation access at the start. Time spent waiting for access comes out of the 15 hours.
I work through the five areas, reading code and configuration directly and interviewing the people who own them.
Scores, evidence, and the 90-day roadmap, delivered in writing before we meet so you read it without me in the room.
A 90-minute session with the founding team. After that the engagement is closed, unless you ask for something more.
Those four steps run the same four movements every time: read, expose, sequence, hand over. The Investor-Grade Read.
Background
18+ years in engineering across 5 countries, much of it on regulated banking infrastructure. Today I am CTO of an ACPR-supervised fintech.
From right-sizing infrastructure and moving non-critical workloads to spot instances.
CI/CD pipeline overhaul and process streamlining on a regulated platform.
Measured after a full rebuild of the product, as co-founder and CTO.
Audit case studies are published with client approval as engagements complete.
Tell me about your company. If an audit is not the right answer for you, I will say so.
Fixed scope • 15 hours • Scored report and 90-day roadmap
Tell me about your company →Or write to me at khaled.souf@gmail.com