Assay is the AI-substantiation and key-person screen you can run on the seller's machine, in days — before spending $100k on a full audit. Every finding cited to the file and commit that proves it.
The deck says "AI-powered." Assay scans the target's own prose for AI claims, then checks whether the codebase contains the model SDKs, inference calls, and data paths that would make them true — and flags claims substantiated only by test mocks, where fake integrations hide.
Authorship concentration from the full commit history: truck factor, dominant-author share, and the specific critical files owned by a single person — before that person takes the earn-out and leaves. Buyers already price this: key-person risk drives a 0.5–1.5x multiple reduction.
Copyleft obligations hiding in a proprietary codebase — AGPL, GPL, and LGPL signals ranked by the worst family present, with fixture noise annotated so a test file never manufactures a red flag.
Live credentials committed to the repository — cloud keys, private-key blocks, high-entropy tokens — with every hit redacted in the memo and classified by whether it sits in production code or a test fixture. You learn what leaked without the memo re-leaking it.
Whether tests and CI exist at all, and which files are simultaneously high-churn and single-owned — the maintenance cliff your engineering lead meets on day one. Capped at medium severity on purpose: a commoditized signal should never outrank a leaked credential.
The lockfile resolved offline into the full transitive set — copyleft that arrives through the graph, packages matching a dated advisory snapshot, and a CycloneDX bill of materials counsel can hand to an underwriter. A dependency whose licence we can't resolve is reported unresolved, never assumed permissive.
Read from the target's own Terraform, Kubernetes and Docker files: databases with no declared backup retention, ingress open to the internet, single replicas, base images past their support window. Capped at high severity, because infrastructure-as-code declares intent — not what is actually deployed.
Most tech DD is opinion with a logo on it. Assay's findings are generated under an evidence discipline enforced in code — a claim either traces to something checkable in the repo, or it never enters the memo.
Findings can only cite verifiable evidence — commits, files, manifests, matched lines. The engine throws rather than assert an unsourced risk. Vibes are not an admissible source.
A check that didn't run is reported as UNKNOWN — listed in the memo's gaps section. No comforting sentence enters the memo without a finding behind it.
Every finding carries an explicit 0–1 confidence, and the deal recommendation maps deterministically from severity. Same repo, same memo — reproducible under scrutiny.
Read the full discipline — including what we deliberately refuse to claim — on the method page.
Diligence artifacts get forwarded, quoted, and argued about months later. Every Assay run now carries the exact commit it examined and a cryptographic seal over each finding, so what your IC reads is provably what the engine produced.
Re-run at the same revision and the seals come back byte-identical, on any machine. An edited memo fails verification. That is a different kind of artifact from a consultancy PDF.
The target keeps committing between LOI and close. Re-screen and see exactly what changed — code dumped in, a copyleft dependency added, a signal gone. A disappeared signal is reported as no longer detected, never as fixed.
Metrics are positioned against comparable prior screens in the same size class — and below 20 comparable screens the benchmark reports itself as not assessed. Unknown is never dressed up as average.
Assay Ready points this same battery at your own codebase months before a process starts, and returns a remediation punch-list instead of a deal recommendation — so findings get fixed on your timeline rather than priced into someone's offer. Nothing is softened: it's the identical engine, with the identical thresholds.
AI-washing moved from marketing sin to enforcement target — SEC v. Presto Automation, DOJ charges against Nate Inc., Builder.ai's $450M collapse. Buyers are responding with their spreadsheets.
Sellers hate shipping their source to a stranger's cloud. Assay's engine is zero-dependency and makes no network calls — it can run where the code already lives, which is why sellers say yes faster.
Read-only repo access under NDA — or the engine runs on the seller's own hardware. We never need production systems or customer data.
The engine extracts the evidence; a senior reviewer decides what it means for your deal thesis. The tool is leverage, not the product.
Findings ranked by deal impact, each cited, each with confidence — plus the explicit list of what was not assessed and the questions to ask management.
Tell us about the deal. If a screen isn't the right instrument, we'll say so.
Book a screen