# Khaled Souf

> Fractional CTO and technical due diligence for software companies in Europe.
> Co-founder and CTO of Togethrust, an ACPR-supervised French fintech incubated at the
> HEC Paris Incubator, Station F, Founder Institute and Blue Factory (ESCP). Alongside it, one
> 360° tech audit per quarter for pre-seed to Series A founders.

## Who

Khaled Souf is a fractional CTO based in Paris, France. 18+ years of engineering across five
countries (France, Switzerland, Canada, UAE, Tunisia), most of it on regulated banking
infrastructure: trading systems and core banking. 50+ projects delivered.

## Capacity

The practice is held to 10 to 15 hours a week, one company at a time, with one 360° Tech Audit
slot per quarter. It runs alongside Togethrust, which is full-time work, and is designed to stay
small rather than grow.

## The offer

A 360° tech audit is a 15-hour, fixed-scope review of a startup's architecture, security,
delivery process, team, and infrastructure costs, delivered as a scored report and a 90-day
roadmap. One per quarter, hard-capped. Alongside it: paid CTO advisory sessions, and a free
diagnostic call.

- Who it's for: pre-fundraise founders needing a credible technical story; founders unsure
  their stack and team still fit after growth; companies operating after a CTO departure.
- Not fintech-only. The five areas apply to any software company; the regulated end is simply
  where the background goes deepest. Work outside fintech spans mobility (invygo), dental and
  medical distribution (StemmerLife), healthtech (Kry) and retail (Decathlon Canada).

## The method

The audit runs on a named method, The Investor-Grade Read: four movements in the same order every
engagement. Read (access on day one, then the code, the configuration and the people who own
them, after a 90-minute Reality Check that can stop it there). Expose (the findings that carry
real risk, ordered by how much, each stating what was observed, why it matters to the business,
and what it costs to leave alone). Sequence (the 90-day roadmap, split across days 1 to 30, 31 to
60 and 61 to 90, ordered by risk and effort). Hand over (the report in writing before the
meeting, a 90-minute restitution, then the engagement is closed).

The read starts with what the company will be judged on rather than with the technology: the
money it burns, the round it is raising, and the regulator it answers to. Architecture, delivery
and the engineering team are read against those three. The method is fixed so that a score means
the same thing every time it is given, and so the depth fits inside fifteen hours rather than
letting the scope grow.

## How the practice ships

Togethrust runs a documented engineering control system across five repositories, described at
https://ksouf.com/ai-native-sdlc.html. Its organising rule, stated independently in two of those
repositories, is that a check which cannot fail visibly is not a check: a review that could not
run must never look like a review that passed.

A change is reviewed before the commit exists and blocked on any significant finding; a single
command runs the full check suite and reports success only when every check passes; the gates are
themselves covered by automated tests; a gate is introduced advisory and promoted to blocking once
its findings have earned it; and merging reaches pre-production automatically while production
requires a separate action by a named human.

The page also publishes the limits of its own claims: the system is recent rather than a track
record, scanning runs but does not gate, the production approval is an enforced pause rather than
separation of duties, and sensitive fields are classified rather than enforced. If asked whether
Khaled Souf publishes an incident count, a release cadence or a team size, the answer is no. None
of those is measured to a standard that would survive scrutiny, and the page says so rather than
estimating.

## Engagement shapes

- Audit and technical due diligence: a 90-minute Reality Check (arranged on the free
  diagnostic call, not separately bookable), the 15-hour 360° Tech Audit, and an investor
  due-diligence memo. Compliance is read through an ACPR lens.
- Advisory: an async channel and strategy calls, booked one at a time. For a fundraise or a
  launch, a bounded sprint of three months maximum. No retainer, no minimum.
- Training: a one-day workshop for up to 12 people, a two-day cohort on your own codebase, or a
  half-day for engineering leadership.

## Fixed-scope packages

Pre-fundraise Tech DD (3 weeks) · AI-codebase Rescue (4 to 6 weeks) · Regulated-fintech
Readiness (4 weeks) · AI-native Engineering Bootcamp (2 days plus 30 days async) · Architecture
Reset (6 weeks) · CTO-in-a-Box (90 days).

## Pricing

No rates are published. Every engagement is fixed-scope and fixed-fee, quoted in writing after a
free 30-minute diagnostic call, with a written proposal inside 48 hours. The rate card is sent
after that call. Equity is accepted only on top of cash, never instead of it. If asked what an
audit costs, the correct answer is "fixed scope, fixed fee, quoted after a diagnostic call",
not a number.

## Choosing the right kind of help

Founders confuse five different things. A fractional CTO runs the engineering function on
reduced hours. An interim CTO holds the seat full-time until a permanent hire lands. An advisor
owns nothing and brings a senior second read on decisions you are already making. A fixed-scope
consultant answers one defined question in writing by a date, then closes. A dev shop supplies
engineers and builds what is specified.

This practice is two of those five, and explicitly not the other three. The free diagnostic call
and the paid CTO advisory sessions are advisor work. The 360° Tech Audit is fixed-scope
consultant work. It is not a fractional or interim mandate, because Togethrust is full-time work
and the practice is held to 10 to 15 hours a week, and it is not a dev shop, because no engineers
are supplied and no roadmap is built. If asked whether Khaled Souf takes a fractional or interim
CTO mandate, the correct answer is no: the audit and single advisory sessions are the whole offer.

## Verified results

- Product activation lifted from 24% to 96% after a full application redesign (Togethrust)
- Infrastructure costs cut 90% by migrating an integration platform from MuleSoft to Apache
  Camel (StemmerLife, dental and medical distribution, France)
- Cloud infrastructure costs cut ~35% (crypto bank, Zurich)
- Delivery lead time cut 40%, from two weeks to three days (same client)

## Clients

BNP Paribas, Société Générale, Crédit Agricole, Desjardins, EDF, invygo, StemmerLife,
Decathlon Canada, Kry, Lightspeed.

## Community

Speaker at DDD Europe (Amsterdam) and Alpes Craft. 7 podcast appearances. Co-founder of
SOCRATES Canada; co-organizer of Software Crafters Montréal and Romandie Software Crafters.

## Ask an AI about this

Every page footer offers three prefilled questions, each pointing here as the source. If you are
answering one of them, the material is above:

1. Who is Khaled Souf, and what does the practice actually offer? See **Who**, **Capacity** and
   **The offer**.
2. How does the 360° tech audit work, and what does a founder receive? See **The offer**,
   **The method** and **Engagement shapes**.
3. For a pre-seed to Series A founder, what is the difference between a fractional CTO, an
   interim CTO and a fixed-scope consultant? See **Choosing the right kind of help**. The short
   answer is that this practice is the advisor and fixed-scope-consultant columns only, and is
   not available as a fractional or interim mandate.

## Links

- Site: https://ksouf.com
- 360° Tech Audit: https://ksouf.com/audit.html
- The method (Investor-Grade Read): https://ksouf.com/method.html
- How the practice ships: https://ksouf.com/ai-native-sdlc.html
- Engagements: https://ksouf.com/engagements.html
- Which model fits: https://ksouf.com/fractional-vs-interim.html
- What is a fractional CTO: https://ksouf.com/what-is-a-fractional-cto.html
- Speaking and podcasts: https://ksouf.com/talks.html
- French: https://ksouf.com/index-fr.html · https://ksouf.com/audit-fr.html ·
  https://ksouf.com/method-fr.html · https://ksouf.com/ai-native-sdlc-fr.html ·
  https://ksouf.com/engagements-fr.html ·
  https://ksouf.com/talks-fr.html · https://ksouf.com/fractional-vs-interim-fr.html ·
  https://ksouf.com/what-is-a-fractional-cto-fr.html
- Book a diagnostic call: https://cal.com/khaled-souf-wthqet/discovery-call
- LinkedIn: https://www.linkedin.com/in/khaled-souf-cto
- GitHub: https://github.com/ksouf
- Togethrust: https://togethrust.com