Tech Risk Memo · badcop.tech

Northwind Rota Ltd — technical risk assessment for acquisition

Prepared for Acquirer (holdco), pre-SPA

Deal 100% acquisition, ~€3.2M, €1.1M ARR

Basis 20-min structured interview with founder-CTO · 45-min follow-up call · seller data-room summary

Not reviewed Source code, infrastructure, contracts (see §7)

Date Illustrative

Signed Michael Petychakis

1 · Verdict

PROCEED WITH CONDITIONS

58/100

risk score · 100 = low risk

Northwind Rota is a boring, well-chosen stack (Django monolith, Postgres, DigitalOcean, Cloudflare) run by one person who knows it completely and nobody else who knows it well. The product is real and the customers are sticky. The risk is not that the software is bad; it is that the software is his. Three of the five red flags below are variations of that fact, and all three are addressable with structure rather than price: a 12-month retention with earn-out for the founder, a signed IP assignment from the integrations contractor as a condition precedent, and a specific indemnity for the tenant-isolation weakness until it is fixed. If the seller refuses the retention clause, walk away.

2 · Red flags — what should change terms

01

One person has deployed to production in the last 14 months. The founder-CTO wrote an estimated 90% of the code; the second engineer works on the mobile app; a contractor in Novi Sad owns the payroll-export integrations and is the only person who understands them. Bus factor: 1.

02

Tenant isolation is by convention, not enforcement. Single Postgres schema with a tenant_id column; row-level security is off. Two incidents in 2025 of one customer seeing another's shift data, each fixed by patching the query. Customers are hospitality groups; the rows are employees' personal data.

03

Backups exist but have never been restored. Nightly managed snapshots, 7-day retention. RPO 24 hours; RTO unknown because nobody has tried.

04

The "proprietary forecasting engine" in the deck is a prompt. Demand forecasting sends the last eight weeks of shift data to a third-party LLM API with a fixed prompt. It is a reasonable feature. It is not a moat, and it should not appear as one in the reps and warranties.

05

IP assignment from the contractor is assumed, not seen. Asked whether the contractor agreement assigns IP: "I think so, it was a standard template." Not read by us; must be read before signing.

3 · Scorecard

Pillar	Grade	One line
Team & key-person risk	D	Founder is the system. Second engineer competent but 8 months in, mobile-only.
Architecture & scalability	B−	Monolith + Postgres is right for 61 tenants and would carry 10×. Background queue on oversized machines.
Security & continuity	C−	No RLS, untested restores, shared admin credentials for DO console. Cloudflare WAF in front is the saving grace.
Cloud cost & unit economics	B	€4.1k/month for 61 tenants ≈ 4.5% of revenue. Up 30% in six months for no traffic reason — fixable.
Data & AI claims	C	Feature is honest engineering; marketing is not. No evaluation set, no accuracy tracking.
IP & code ownership	B−	Company-owned repos, MIT/BSD dependencies by the founder's account. Contractor assignment unverified.

4 · Findings — claim, evidence, risk, fix

4.1 Key-person concentration

Claim: Seller deck: "Experienced engineering team of three."
Evidence: "Deployments — that's me. Marko could probably do it if I wrote it down. I keep meaning to write it down."
Second engineer has never deployed the web app; contractor has never had production access.
Risk: If the founder leaves or disengages after close, feature velocity drops to near zero and incident response depends on a person with no obligation to answer the phone.
Fix: 12-month retention tied to earn-out; the second engineer deploys with the founder watching within 30 days; runbook and on-call rotation by day 60.

4.2 Tenant isolation

Claim: Security questionnaire: "Multi-tenant architecture with strict data isolation."
Evidence: "Every query filters by tenant. We had two cases where a query didn't — a report page and an export — both fixed the same day."
No row-level security, no tenant-scoping middleware, no automated test that asserts isolation.
Risk: A third incident under new ownership is a GDPR notification event with hospitality-group customers and the acquirer's name on it.
Fix: Enable Postgres RLS on tenant tables or add scoping at the ORM layer; add an isolation test to CI. Two to three engineering weeks. Carve-out indemnity until done.

4.3 Backups and recovery

Claim: "Daily backups, enterprise-grade hosting."
Evidence: "DigitalOcean does the snapshots. I've never had to restore one."
7-day retention; no off-provider copy; no documented procedure.
Risk: Unknown RTO. A ransomware or account-compromise event could take out primaries and snapshots together.
Fix: One restore drill in the first 30 days (half a day); nightly logical dump to a second provider (one day); extend retention to 30 days.

4.4 Cloud cost trajectory

Claim: "Infrastructure costs are stable."
Evidence: €3.1k/month in Q4 last year → €4.1k/month now, tenants +9%. Cause stated on the call: background workers moved to larger droplets "to be safe" after a slow payroll run.
Risk: Low. Gross margin impact ~1 point. Signals nobody is watching the bill.
Fix: Right-size workers and queue payroll exports; expected saving ~€900/month. Add a monthly cost line to the board pack.

4.5 The AI claim

Claim: Deck: "Proprietary AI demand-forecasting engine."
Evidence: "It sends the last eight weeks to the model with a prompt and we show the answer. Customers love it. No, we don't measure accuracy."
Risk: Reputational and legal if the phrase survives into reps and warranties or investor materials. Vendor dependency on one LLM provider; cost per tenant is trivial today.
Fix: Reword the claim before signing. Post-close: log predictions vs. actuals for one quarter, then decide if it is worth building properly.

4.6 What is solid

Evidence: Stack choices are conservative and appropriate. Billing has real test coverage (the founder walked through it unprompted). Cloudflare in front, Django's ORM throughout — no hand-written SQL in the request path. The 99.9% uptime figure is plausible given the architecture, though we did not see the monitoring.
Implication: A competent hire can take this over. The codebase is not the problem; the org chart is.

5 · 30 / 90-day plan — paste into the SPA schedule or the 100-day plan

Before signing

Read and, if needed, re-paper the contractor IP assignment (condition precedent).
Retention + earn-out for the founder, 12 months minimum.
Specific indemnity for tenant-isolation incidents until §4.2 is closed.
Strike "proprietary AI engine" from all deal documents.

Days 0–30 · stop the bleeding

Restore drill from snapshot into a scratch environment; write down what happened.
Second engineer performs a production deploy, founder shadowing.
Rotate shared DigitalOcean credentials; enforce MFA; named accounts.
Nightly logical dump to a second provider.

Days 30–90 · pay the debt

Row-level security or ORM scoping, plus an isolation test in CI.
Pair the second engineer through the payroll-export module; retire the single-contractor dependency.
Right-size background workers (~€900/month).
Runbook, on-call rotation, error-budget dashboard.

Watch after 90 days

Founder engagement — the earn-out is the tell.
Forecasting accuracy log; decide build vs. keep.
Cost per tenant, monthly.

6 · What this means for the deal

Price: no change recommended on technical grounds; the fixes total roughly six engineering weeks and €0 in new tooling. Structure: retention/earn-out, contractor IP as condition precedent, isolation indemnity. Integration: budget for one senior hire in the first six months; do not plan a platform migration in year one — the stack is not the problem.

7 · What we did not verify

No source code, repository history, CI configuration, or infrastructure console was inspected. Uptime, cost figures, test coverage and incident counts are as stated by the founder-CTO in the interview and the follow-up call, cross-checked only for internal consistency. The contractor agreement was not read. No penetration test or dependency scan was performed. A Deal Review adds read-only repository and infrastructure inspection if the seller agrees; for a €3.2M deal with these findings, we would recommend it before the SPA is final.

Signed: Michael Petychakis · badcop.tech · This memo reflects professional judgment based on the information described in §7 and is not a substitute for legal, financial or security audit advice.