Technical Due Diligence
Northwind logistics platform · pre-Series-B assessment
01 · Executive summary
Sound architecture, three material risks to close before scale.
Northwind’s engineering is above the median for its stage. The service boundaries are clean, deployment is automated, and test coverage on the billing path is genuinely strong. The concerns are not with what has been built but with what has not yet been hardened for the next order of magnitude of traffic and scrutiny.
Three findings are material to the transaction. None is a reason to walk; each is a reason to hold a portion of the round against a dated remediation plan, set out in section four.
02 · Risk profile
Where the exposure sits
Assessed across six areas against our standard scale-readiness rubric. The matrix places the four findings by likelihood and impact; the strip beneath records residual risk by area after existing controls.
03 · Material findings
Three to remediate, one to watch
The exposure concentrates on the revenue path. Where each finding sits:
Secrets present in CI build logs
CriticalDeployment credentials and a third-party API key are printed to the CI log stream and retained for 90 days, readable by every contractor with pipeline access. Ref DD-04 · owner: Platform
Single-region primary data store, no tested failover
MaterialThe primary store runs in one region with nightly backups but no read-replica and no rehearsed restore. Recovery-time objective is undefined; a regional outage is an unbounded outage. Ref DD-07 · owner: Infrastructure
No structured tracing on billing and fulfilment paths
MaterialFailures on the two revenue-bearing paths are reconstructed from raw logs by hand. At Series-B load, mean time to diagnose becomes the bottleneck, not mean time to fix. Ref DD-02 · owner: Platform
Dependency drift within tolerance
MonitorTwo frameworks are a major version behind but under active support; no known-exploited advisories apply. Track and schedule; not a pre-close item. Ref DD-11 · owner: Engineering
04 · Remediation roadmap
What to do, and by when
Sequenced so the critical item clears before signature and the remaining three land inside the 90-day window the board is holding funds against.
| Ref | Action | Owner | Window |
|---|---|---|---|
| DD-04 | Purge secrets from logs, rotate keys, move to a vault with scoped access | Platform | Pre-close |
| DD-07 | Stand up a cross-region replica and rehearse a restore; publish an RTO | Infrastructure | 30 days |
| DD-02 | Add structured tracing to the billing and fulfilment paths | Platform | 60 days |
| DD-11 | Schedule framework upgrades into the standard maintenance train | Engineering | 90 days |