What do investors check about your AWS setup in technical due diligence?

What is technical due diligence for a seed or Series A startup?

Technical due diligence is a review of a company's technology, team and engineering practices, commissioned by an investor before they put money in.

AKF Partners, which carries out these reviews, says investors run it to understand what they are buying: how the software is built, how the team operates and where the technical risks sit.

madewithlove's guide to the subject lists seed and Series A rounds, and acquisitions, among the moments it is needed. For a small team, that usually means a few conversations and a request for documents, not a month-long audit.

What do investors look at on your AWS infrastructure?

Investors look at six areas, according to AKF Partners: architecture and scalability, codebase quality, security and compliance, infrastructure and cost efficiency, engineering processes, and the team.

On AWS, most of the infrastructure questions come down to the same short list.

What security findings come up most often?

AKF Partners names hardcoded credentials, in-house authentication, production secrets stored in version control and missing access controls as some of the most frequently cited findings in SaaS audits.

It also says each of them is fixable in days, not months.

On AWS, that points to a short clean-up before any investor call: move secrets out of the repository, remove long-lived access keys, turn on multi-factor authentication and review who can reach production. An AWS infrastructure audit for a small SaaS walks through those checks. Under the AWS shared responsibility model, the configuration of your account is yours, so these are your findings to fix.

Can you roll back a bad release and restore from a backup?

Investors want proof that a bad release can be undone and lost data can be recovered, and AKF Partners' own checklist rates an automated deployment pipeline with rollback capability as a high priority.

A pipeline that depends on one person running a script by hand is the kind of finding it tells founders to fix first.

• Show a pipeline where a failed deploy reverts on its own, as in rolling back an ECS deployment automatically from GitHub Actions.
• Keep a dated record of a real restore test, as in how to prove your AWS backups restore.
• Write down your recovery targets in plain words, as in RPO and RTO for a small SaaS.

How early should you prepare for investor due diligence?

Start at least one quarter before you plan to talk to investors, because fixes need time to be shipped rather than promised.

AKF Partners recommends exactly that lead time, and warns that cleaning up documentation the week before does not fool experienced reviewers, who read commit histories and test systems.

AKF Partners also stresses that investors are not looking for perfection. What erodes confidence is risk the team has not identified, so a short, honest list of known weaknesses with a plan beside each is worth more than a polished claim that everything is fine.

Does a small team need a DevOps hire to pass due diligence?

A small team does not need a dedicated hire to pass due diligence, but it does need the operational basics to be real, written down and owned by someone.

That can be a developer who has time for it, a fractional engineer or a managed service; running production on AWS without a DevOps engineer compares the options.

What matters to the reviewer is that the work is not resting on a single person's memory. Investors treat dependence on one engineer as a risk, so documentation and a second pair of hands count for a lot.

Is there a way to get the operations basics in place if you are a very small team?

Keel runs a Startup programme for early-stage teams that need the foundations in place without a hire.

It is a foundation-level service for small teams already live with paying customers: a deploy pipeline with rollback, tested backups, monitoring and monthly patching, in your own AWS account, plus a monthly check-in with a Keel account manager.

It is aimed at teams from pre-seed to Series A with fewer than 5 people, live in production with at least one paying customer, on AWS with code on GitHub or GitLab. Places are limited and awarded on merit, and pricing is agreed on application. You can apply for a place in the pricing section. Keel cannot promise an investor outcome, but it can help you have the evidence ready.

Could you answer an investor's AWS questions today?

Tick each item that is true today.