Know what you're buying.
Tech and AI due diligence in 48 hours. Every finding traced to the code, the commit or the document.
Proprietary model claim not supported
The deck describes an in-house model. Inference calls route to a third-party API with a prompt template. No training code or weights were found in the repository.
- Every deck says AI.
- Few show the code.
- A wrong call on the tech costs more than the diligence ever would.
What eval4 checks.
Each area ends in a rating and a list of findings. Each finding links to the evidence behind it.
AI claims
Is the AI theirs, or a wrapper?
Code health
What are we really buying?
Security and data
Is customer data safe, and where does it go?
Team risk
What happens if one engineer leaves?
Scalability and cost
Will AI and cloud costs eat the margin?
How it works.
Deal created
The investor opens a deal and invites the seller.
Seller connects their code
Read-only access, granted by the seller.
Never leaves their environmentScans and AI analysis
Static analysis, dependency and history scans, then claims checked against the code.
Reviewer signs off
A named reviewer checks every red finding. The report lands in 48 hours.
Read the report before you request one.
A full report for a fictional company. Cover, scorecard, findings, evidence and a coverage section that says what was and wasn't checked.
Pellbrook AI Ltd
- Report
- DD-0147
- Snapshot
- main @ a41f9c2
- Issued
- 12 Mar 2026
- Reviewer
- [Named reviewer]
| AREA | FINDINGS | RATING |
|---|---|---|
| AI claims | 4 | |
| Code health | 7 | |
| Security and data | 5 | |
| Team risk | 3 | |
| Scalability and cost | 2 |
For investors and for sellers.
Reports your team can put its name on.
- White-label reports under your brand
- API into your deal workflow
- Questions for management, drawn from the findings
- A 100-day plan for after close
Show buyers the code backs the listing.
What happens to your code.
You are giving a stranger access to your code. Here is exactly what we do with it.
Your code stays put
Code never leaves your environment, or is deleted after scanning.
Never used to train AI
Not by us, not by any model provider we use.
UK and EU hosting
Data is processed and stored in the UK and EU only.
Deletion certificate
Full deletion 30 days after the deal, with a certificate.
Revoke at any time
Remove access from your side. Scanning stops at once.
Named sign-off
Every red finding is signed off by a named reviewer.
Built by a hands-on CTO who has spent eight years building regulated financial and compliance platforms.
Common questions.
Does my code leave my servers?
No. Scans run inside your environment through read-only access. Where that isn't possible, code is scanned in isolation and deleted straight after.
Do you train AI on our code?
No. Your code is never used to train any model, ours or a provider's.
Which languages do you support?
[Placeholder: confirmed language list.] If a language isn't covered, the coverage section of the report says so.
How long does it take?
48 hours from the seller connecting their code to the signed report.
Who sees the report?
Only the people the deal owner invites. Sellers choose whether to publish a verify link.
What if you can't scan something?
The report's coverage section says exactly what was and wasn't checked.