Software audit services

A software audit answers one question: what state is this system in, and what should be done about it? It is one of our consulting and discovery services, and three situations call for it before a decision is made.

• Before an investment or a funding round. You see the technical state of the product before money is committed: architecture, code, infrastructure and delivery process.
• Before taking over a system from another vendor or team. You learn what you are inheriting and where the work should start.
• Before scaling a product. You see which parts will carry growth and which need attention first.

A product that does not exist yet needs a different first step: our free product strategy workshops produce a scope, a roadmap and an estimate.

In an audit we look at the code and its architecture (the code audit), at data processing and performance, at infrastructure, and at the delivery process and team practices. The result is a picture of the system's state and recommendations.

At Skyfri the audit covered React, C# and ASP.NET, Python and pyspark, Kusto/ADX, Databricks and Azure. It focused on data processing and performance, on the product build process and team practices, and on the repeatability of interface components. The stack and the questions differ from system to system. Accessibility audits against WCAG are a separate service: see our accessibility audit services.

You get proposals for solutions and a shared view of what to change first. At Skyfri the client asked us to show what to change in the product build process and in recurring performance issues, and the audit answered that request with proposals. The order of changes was then agreed together with the client.

Technical due diligence is a technical assessment of a product and its team before an investment, an acquisition of a company or a large purchase. It typically covers architecture, code quality, security, scalability, infrastructure and dependence on key people.

A software audit looks at the same ground from the side of the system: code, architecture, data, infrastructure and delivery process. If you are about to invest in your own product, or to take over a system from another vendor or team, the audit gives you the technical picture to decide on, together with proposals for what to change.

The Skyfri audit ran from 20 November 2023 to 7 January 2024 in Oslo. After it, we agreed the order of changes with the client. In our conversations with the team in Oslo a new project came up: an energy management system (EMS) for a Skyfri client. From January 2024 our team has worked inside the Skyfri team. The EMS went into production in June 2024 and controls 7 plants, with more than 5 MWh of battery capacity and more than 4 MW of battery power. Later services at Skyfri received full CI/CD and infrastructure as code, with Terraform replacing ARM Templates and Azure CLI. Infrastructure work like this belongs to our Platform & Cloud Engineering services. The full story is in the Skyfri case study.

The decision about the result is yours, and the audit does not commit you to working with us. If it points to changes in an existing system, Software Modernization is where we carry them out, step by step on a system that keeps running.

For a new product, the free product strategy workshops give you a scope, a roadmap and an estimate of cost, time and team composition. To build it, we offer custom software development. Support and maintenance after the changes runs under an SLA set in the contract. Hypercare, a period of closer support right after changes go live, is possible, with scope and duration agreed before the start.

Confidentiality is standard for us: without a client's consent we describe clients by industry or not at all. We act as a processor and you are the controller, and each project has a separate data processing agreement based on Article 28(3) of the GDPR. Our GDPR documents were prepared with a law firm acting as our data protection officer and approved by our management board.

Access to your systems goes through named accounts, AWS IAM Identity Center and the principle of least privilege. Our disks are encrypted and we review our procedures every 12 months. We report an incident within 24 hours at the latest. When the contract ends we delete or return your data within 10 working days and confirm it in writing within 7 days. More in Security & GDPR.

Book a free consultation and tell us whether the decision is an investment, a handover or a growth plan. The first conversation is free, and so are our product strategy workshops for new products.