IT due diligence for Indian startups: what investors and acquirers actually check

Technical due diligence in a funding round or an acquisition examines a fairly predictable list. Almost everything on it is cheap to put right with six months' notice and expensive to put right with two weeks, which is the main argument for reading this before you need it.

Access control and offboarding

The first question is usually the simplest: who has access to what, and does anyone who left still have it. Diligence teams check this directly, and finding a former employee with live access to a production system or a code repository is a genuine finding rather than a note.

Fix: a documented offboarding checklist covering email, code, cloud, VPN and every SaaS application, executed on the leaving date. Then audit the last twelve months of leavers and close what you find.

Device management

Are company devices managed, encrypted and remotely wipeable, and do personally owned devices hold company data? The second half is where startups struggle, because early hires frequently used their own laptops and nobody revisited it.

A device the company does not own is a device the company cannot wipe, which is both a security and an intellectual property answer nobody wants to give.

Intellectual property and code

Who owns the code, and can you demonstrate it. Contractor agreements with proper assignment clauses, no repositories in personal accounts, and no critical infrastructure sitting under a founder's individual cloud login.

Repositories in a personal GitHub account rather than an organisation is a common and easily fixed finding that looks careless in a data room.

Backups and continuity

Is production data backed up, and has a restore been tested. Is Microsoft 365 or Workspace backed up, which most startups have not considered because the platform feels durable. Could you rebuild if a cloud account were lost or compromised.

Licensing

Are you paying for what you use and using only what you pay for. Unlicensed software is a liability that transfers with an acquisition. So is a subscription count that has grown well past headcount, though that one is merely embarrassing rather than dangerous.

Security posture

MFA coverage, logging, incident history and whether you have ever had a breach. Being asked about incidents is not a trap, and disclosing one handled well is considerably better than being found to have concealed one.

Documentation

Architecture diagrams, an asset register, a list of third parties holding company data, and named ownership of each system. The absence of these does not usually kill a deal, but it lengthens the process and signals a level of operational maturity that affects how everything else is read.

A sensible order

Offboarding audit first, because it is the most likely finding and the cheapest fix. MFA everywhere. Device enrolment and encryption. Move repositories and cloud accounts into organisation ownership. Back up your cloud data. Reconcile licences. Write the documentation last, when the underlying facts are worth documenting.