X-Ray for European VC — Product & Tech Audit in 1 Business Day
We help you know the product & tech reality early — and price it into the deal.
- ✓Trusted by leading European VC firms from Seed to Series C+
- ✓Run it before the term sheet — verdict in one business day, zero friction
- ✓Non-intrusive — under 30 minutes for the target team
- ✓IC-ready findings your deal team acts on immediately
The timing problem
You price the deal before you know what you're buying.
01
You price the deal before you know what you're buying.
Tech DD happens after the LOI. By then the price is set, the relationship is established, and any red flag just means an awkward renegotiation you've already lost.
02
Most funds treat tech DD as confirmatory. It should be value-determining.
Tech directly influences valuation. Running it after the LOI means you're confirming a price you already agreed to — not setting one based on what you actually found.
03
AI makes every pitch deck look better than the product.
AI-generated code, AI-written docs, AI-polished demos — all hiding the same technical debt underneath. A team of five now builds what used to take fifty. The architecture still has to hold.
Paying the price for perfection is easy — when you know something the rest of the market doesn't.
Who we are
Built by operators who've been on both sides of the table.
Scaleflow was founded by operators who built and scaled software companies — and who advised investors on the ones worth backing. That dual perspective is what makes the X-Ray different. We know what a healthy codebase looks like at Series A. We know what hides behind a polished demo.
The X-Ray is not a tool you log into. It's a verdict we deliver — backed by AI analysis and operator experience across 200+ engagements in Europe.
250+
European engagements
100%
Partner repeat rate
The X-Ray
A hands-off diagnosis. AI-powered. Operator-verified. In 1 business day.
- ✓The target connects their code — or we work from what's publicly available
- ✓We ingest the dataroom — Notion, Confluence, pitch decks
- ✓AI runs 250+ checks across the target's full stack
- ✓Our operators verify every finding — IC-ready within 1 business day
Pillar scores
250+ dimensions, each with a verdict and a way forward.
Benchmark
overall scoreRanked 2nd of 6 · anonymised
Findings
A verdict on every pillar — before you commit, not after.
Architecture
Investable with conditions
Security
Caution — auth gaps found
Team & Delivery
Strong — above benchmark
AI Readiness
Moderate — gaps in governance
Code Quality
Strong — clean codebase
Gap closing over time
Price the gap into your deal. Use the data in term sheet negotiations — not as a surprise after.
Delivered in 1 business day
What you get in 1 business day.
Executive Presentation
Verdict + scored pillars
Mitigations Document
Prioritised fixes for CTO
Clarification Questions
AI-generated, sent in-platform
Raw Evidence
Code-level data for deep DD
Pillar scores
250+ dimensions across the target's stack, each with a deal-relevant verdict.
Benchmark
Ranked 2nd of 6 · anonymised
Findings
A verdict on every pillar, not a list of observations.
Architecture
Investable with conditions
Security
Caution — auth gaps found
Team & Delivery
Strong — above benchmark
AI Readiness
Moderate — gaps in governance
Code Quality
Strong — clean codebase
Gap closing over time
Prove the gap is closing. Rescan to show progress — in data, not slide decks.
Delivered in 1 business day
Four layers, four audiences — one complete picture.
Executive Presentation
Verdict + scored pillars
Mitigations Document
Prioritised fixes for CTO
Clarification Questions
AI-generated, sent in-platform
Raw Evidence
Code-level data for deep DD
How it works
From activation to verdict.
One business day.
Activate an X-Ray
Select a target, add your investment thesis, key questions, and any docs. We take it from there.
New X-Ray
Sign NDA & connect code
NDA signed same day — use our template or yours. Target connects repositories (read-only, under 30 min) and adds any technical docs.
Repository access
From company
AI scan + operator verification
250+ automated checks run across all pillars. Our senior operators then review every finding — adding context, catching edge cases, and signing off on the verdict.
Scan progress
247 / 250
Operator notes
Security score adjusted
Auth issue pre-dates team — not systemic
Crown jewel identified
Real-time data pipeline — rare at this stage
Context added
Monolith is intentional — roadmap shows migration
Questions to the company
Where the scan raises questions, we send them directly to the company. They answer in the platform — structured, traceable, fast.
DD questions
3 pendingWhat is the plan for the auth layer migration?
AnsweredWho owns the data pipeline and what is the bus factor?
AnsweredAre there existing SLAs for enterprise clients?
PendingInvestor Verdict
Verdict, risk rating, crown jewels, and how the tech maps to the deal. IC-ready — no technical background needed.
Investor Verdict · Vertex
ConfidentialInvestable with conditions
Security remediation required pre-close
76
Full Findings & Actions
Every finding with code references and a remediation path. Released to the company at your discretion — before or after close.
Full Findings · Vertex
VC releasesAuth tokens stored in local storage
auth/session.ts:42
No rate limiting on public API endpoints
api/routes.ts:118
Lodash 4.17.11 — CVE-2021-23337
package.json
Debrief — your deal team
We walk through every finding with your deal team. Ask anything. We translate technical risk into investment language.
On the call
X-Ray Team
Walking through findings
You
Lead investor
Deal team
IC members
Separate debrief — optional
If useful, the X-Ray team can do a separate debrief with the company's CTO. Completely optional — and kept separate from your investor debrief.
Optional — company debrief
X-Ray Team
Walking through findings
Vertex CTO
Technical lead
Kept separate from your investor debrief.
Optional: Product & Tech Due Diligence
Not part of the X-Ray. A separate, deeper engagement when the deal warrants it — operator interviews, architecture deep-dives, IC-ready package.
Due Diligence — add-on
Avg. 2 weeks from X-Ray verdict
Operator interviews
CTO + lead engineers, structured
Architecture deep-dive
Full system walkthrough
Expanded X-Ray
Deeper checks, more pillars
IC-ready package
Verdict, risk rating, recommendation
Used when the deal warrants deeper scrutiny — post-term-sheet or pre-close.
Learn more →What investors say
In their own words.
X-Ray
“Speed, depth, and a clear focus on business goals — our go-to for every scan.”
Dorus Olgers
Partner · Newion
X-Ray
“You can't afford to skip the technical read when the process is moving fast.”
Pieter Libeert
Partner · Fortino Capital
X-Ray
“A credible verdict in a day changes how we approach the term sheet.”
Rutger Kemper
Partner · Peak Capital
Due Diligence
“We needed a diligence partner who could actually evaluate what they're building.”
Markus Laubenthal
Partner · ECBF
X-Ray
“X-Ray gives us the technical confidence we need before we commit.”
Jeroen Arts
Partner · ICOS Capital
Security & Trust
Built for sensitive data.ISO 27001 certified. Confidential by design.
ISO 27001
Currently in the process of achieving ISO 27001 certification — the international standard for information security management.
SOC II
SOC 2 certification in progress — independently verified controls for security, availability, and confidentiality of your data.
Confidential
Every engagement is covered by NDA. Your product & tech reality stays between us — full stop.
No data retained
Source code and dataroom content is analyzed in-context. Nothing is stored or shared after the engagement ends.
GDPR
Working towards full GDPR compliance. Data processing agreements available on request.
Secure dataroom
Dataroom integration reads only what it needs. Access is scoped, auditable, and revocable at any time.
ISO 27001
Currently in the process of achieving ISO 27001 certification — the international standard for information security management.
SOC II
SOC 2 certification in progress — independently verified controls for security, availability, and confidentiality of your data.
Confidential
Every engagement is covered by NDA. Your product & tech reality stays between us — full stop.
No data retained
Source code and dataroom content is analyzed in-context. Nothing is stored or shared after the engagement ends.
GDPR
Working towards full GDPR compliance. Data processing agreements available on request.
Secure dataroom
Dataroom integration reads only what it needs. Access is scoped, auditable, and revocable at any time.
Insights
Latest from the blog.
If you could get a tech read before the LOI, would that change how you filter deals?
Traditional DD takes 3–6 weeks. Competitive processes leave days. We deliver in 1.