Technical and security due diligence, before you invest in a francophone African startup
We review the code, infrastructure, security and data-protection compliance (ARTCI, GDPR) of the startup you plan to fund. Within 10 working days you get a report in English or French, with a first page your committee can read in two minutes.
Summary for the investment committee
- CriticalMobile-money payment notifications are not verified: a fake payment can be recorded as real.
- CriticalNo backup has ever been restored in a test.
- To fixAPI keys are present in the code repository's history.
- To fixOnly one developer knows the production system.
- SoundSimple architecture, suited to the volume planned for 24 months.
Opinion: invest, with 3 conditions to meet before disbursement (details on p. 2).
What we check
Product and code
- Architecture and room to grow
- Code quality and technical debt
- Infrastructure, deployment and hosting costs
- Payment integrations: Wave, Orange Money, MTN MoMo, aggregators
Security and data
- Access, secrets and account management
- Known vulnerabilities and dependencies
- Backups, recovery and incident response
- Data protection: ARTCI (Law 2013-450), Senegal's CDP, GDPR
Team and ownership
- Dependence on one key person
- Ownership of the code and accounts (cloud, app stores, domains)
- Open-source licences
How a review works
- Scope and non-disclosure agreementDay 0: a call with you, then with the startup; we agree the scope and read-only access.
- ReviewDays 1–7: reading the code and infrastructure, non-intrusive security tests, an interview with the tech team.
- Report and debriefDays 8–10: the report, then a 45-minute call with your investment team.
What you receive
- A one-page summary: findings rated critical, to fix or sound, and an opinion (invest, invest with conditions, do not invest)
- The detailed report, with evidence
- The list of fixes, before and after disbursement, with estimated effort
- A 45-minute debrief call
Prices
- Review of a seed-stage startup
- from €2,500
- In-depth security add-on
- + €1,000–2,000
- Ongoing support for a fund (regular reviews, portfolio follow-up)
- on request
Our independence
- We offer no development work to a company we have reviewed, for 12 months.
- We also build our own product, Fidelia (loyalty and sales history for merchants in Abidjan). We never review one of its direct competitors, and we tell you in writing if a deal comes close.
- What we see stays confidential: read-only access, a non-disclosure agreement, and working notes deleted 30 days after the report.
Who does the review
A senior software engineer based in Bonn, Germany. He designs mobile apps and payment backends for West Africa, including Fidelia, and is preparing for the CISSP security certification. He works in English, French and German.
Questions
Does the startup have to give access to its code?
Yes, read-only and under a non-disclosure agreement. We work in the agreed environment without copying the code elsewhere, and we delete our working notes 30 days after delivering the report.
Do you run penetration tests?
The review includes non-intrusive security tests. A full penetration test can be added with the startup's written consent; we then help you define its scope.
Do you also review established companies?
Yes, for an acquisition or a Series A round. The price then depends on the size of the system; we set it after the scoping call.
Which countries do you cover?
All of francophone Africa, remotely. Interviews take place by video call; a trip to Abidjan is possible when the review needs it.
Talk to us about your next investment
15 minutes are enough to see whether a review is useful to you and what it would cover. Reply within 24 hours.