12 technology red flags to check before you invest

1. #Red flagWhat to ask
2. 01
   Key-person dependency. One engineer, founder or outside agency holds the knowledge, the code or the admin access.
   What to askWho could keep the system running if that person left tomorrow? Is any of it documented?
3. 02
   Unclear ownership of the code. Software built by freelancers or agencies without a written transfer of IP; open-source licences never reviewed.
   What to askAre there signed IP assignments for everyone who wrote code? Has anyone checked open-source licence obligations?
4. 03
   No map of personal data. Nobody can say where customer data sits, who processes it, or on what legal basis.
   What to askIs there a record of processing under the GDPR, and data processing agreements with each supplier?
5. 04
   AI claims the product cannot support. “AI” that is really rules or manual work behind the screen, or models trained on data the company may not have the right to use.
   What to askWhat exactly is the model, how is it measured, and where did the training data come from? Does any use fall under the EU AI Act’s stricter categories?
6. 05
   Uncontrolled use of AI tools. Staff paste customer or company data into tools nobody approved.
   What to askIs there a written AI policy, and which tools have company data gone into?
7. 06
   Technology costs growing faster than revenue. Cloud, licences and contractors rise with every new customer.
   What to askWhat does technology cost per customer or per transaction, and how has it moved over time?
8. 07
   Technical debt with no plan. Old frameworks, unsupported versions, and every change feels risky.
   What to askWhat would the team rebuild first, and what would it cost in time and money?
9. 08
   Backups never tested. Backups exist, but nobody has restored from one.
   What to askWhen was the last full restore test, and how long did it take?
10. 09
    Weak access control. Shared passwords, no multi-factor authentication, former staff still with access.
    What to askWho has admin rights today, and when was access last reviewed?
11. 10
    Lock-in to one supplier. A critical platform with no exit terms, or data that cannot be exported.
    What to askIf the main supplier raised prices or closed, how would the company leave, and with its data?
12. 11
    No security history. No penetration test, no logging, no record of past incidents.
    What to askHas there been an independent security test, and what incidents have occurred and been reported?
13. 12
    Delivery that depends on heroics. No release process, no automated tests, no monitoring. Roadmap promises far ahead of what actually ships.
    What to askHow often does the team release, how do they roll back, and how do last year’s plans compare with what shipped?

How to use it. Send the “What to ask” column to the target’s management before the data room opens. Vague answers are a signal in themselves. For a fixed-price technical due diligence on one company (red flags, AI and data risk, and a 100-day technology plan), contact eg@alarifa.com.

General guidance only. Not legal, tax or investment advice.