Independent · fixed price · yours to keep

A second opinion, before the money is spent.

Technical consulting and architecture review for Toronto and GTA businesses about to commit to something expensive — a build, a platform, a rewrite, or a developer. We look at the plan, the code or the quote, and tell you plainly what we would do differently and why.

Most costly software decisions are not made badly. They are made by people who have to decide without the technical background to interrogate what they are being told, on the basis of a single quote from a supplier who benefits from a particular answer. That is not a knowledge problem — it is a structural one, and a short piece of independent work fixes it.

When people usually call
findings 0
EngagementFixed price
OutputWritten report
BiasNone to sell
OwnershipYours to take

Timing

Six moments where an hour of review saves a quarter of budget

The common thread is a decision that is cheap to change today and expensive to change in three months.

Before signing

You have one quote and no way to judge it

Is the estimate reasonable? Is the approach sensible? Are the assumptions in it the ones you would have made? A quote is a technical document as much as a commercial one.

Before rebuilding

Someone has proposed starting again

Sometimes correct, often not. We assess whether the existing system genuinely cannot be improved, and what a staged alternative would cost against a clean rewrite.

Before buying

Choosing a platform you cannot easily leave

Platform decisions are among the stickiest you will make. We look at the fit against how you actually operate, and at what exit would involve if it goes wrong.

Before hiring

Assessing a developer or agency

Technical interviewing when you are not technical is close to impossible. We review a candidate's work, sit in on a conversation, or evaluate an agency's proposal on its merits.

Mid-project

It is late and you cannot tell why

An independent read on whether the problem is scope, estimation, capability or communication — and what would actually get it moving again.

Before acquiring

Technical due diligence

Buying a business with software in it. What is the codebase worth, what is the real maintenance burden, and what is not in the data room.

Scope

The seven areas a review examines

Not every engagement needs all seven — the shape depends on the decision you are facing. Swipe through, or use the arrows.

Each area produces the same two outputs: what is actually true today, and what it means for the decision in front of you. We avoid the two failure modes of technical reviews — a list of complaints with no priorities, and a recommendation with no evidence behind it.

Area 1 of 7
01 — Architecture

Does the shape fit the problem?

Whether the structure matches what the business actually does, and whether it can absorb the next two years of change without a rewrite.

  • Boundaries between parts of the system
  • Coupling that will make change expensive
  • Complexity that is not earning its keep

Answers: "will this still work when we grow?"

02 — Code quality

Could someone else maintain it?

Readability, consistency, test coverage and documentation — assessed against who will realistically be working on it, not against an ideal.

  • How long onboarding a new developer takes
  • Whether tests exist and mean anything
  • Concentrations of risk in single files or single people

Answers: "are we dependent on one person?"

03 — Security

What is exposed, and how badly?

A practical review rather than a penetration test: dependency currency, authentication and authorisation, secrets handling, and where user input reaches the database.

  • Known vulnerabilities in dependencies
  • Access control that is enforced, not assumed
  • Credentials in places they should not be

Answers: "what would a breach look like?"

04 — Performance

Where does the time actually go?

Measured, not guessed. Server response, database behaviour, front-end weight and Core Web Vitals, with the specific bottleneck identified rather than described.

  • The slowest pages and why
  • What worsens as data grows
  • Which fixes are cheap and which are not

Answers: "why does it feel slow?"

05 — Delivery

How does work reach production?

Version control, environments, deployment, backups and monitoring. Weak delivery practice is often the root cause of problems that look like code problems.

  • Whether a bad release can be reversed
  • Whether anyone would notice an outage first
  • How much of it depends on one person's memory

Answers: "why is every release stressful?"

06 — Cost

What are you actually paying for?

Hosting, licences, third-party services and the maintenance burden implied by the current design — including the costs that only appear later.

  • Spend that no longer buys anything
  • Licences overlapping with each other
  • Where the design forces ongoing cost

Answers: "is this the right run rate?"

07 — Risk

What would hurt most if it failed?

A plain-language register: what could go wrong, how likely, how bad, and what the cheapest meaningful mitigation is for each.

  • Single points of failure, technical and human
  • Data you could not recover
  • Dependencies outside your control

Answers: "what should worry us?"

Why timing matters

The cost of changing your mind

Decisions are cheap to revisit at the start and expensive later — not because anyone did something wrong, but because more has been built on top of them. Scroll through the project timeline and watch the curve.

This is the entire commercial argument for reviewing early. The same change — a different database, a different platform, a different structure — costs a conversation in week one and a rebuild in month nine. A review buys back the cheap end of this curve.

Project stageBefore anything is built

What you receive

Four things, in writing

The output is a document you can hand to a supplier, a board, a buyer or another developer. It is written to be read by someone non-technical without being vague.

01

What you have

A plain description of the current state — architecture, stack, dependencies and how work reaches production.

02

What concerns us

Findings ranked by impact against effort, each with the evidence behind it rather than an assertion.

03

What we would do

A recommendation with the reasoning, plus the alternatives considered and why they lost.

04

What it would cost

Indicative effort for each recommendation, so you can sequence by value rather than by whoever asks loudest.

Patterns

Nine things that reliably signal trouble

None of these are proof of a problem on their own. All of them are worth a question, and in combination they are usually the story.

Estimate

A precise number with no scope

A confident figure attached to a vague description usually means the number came first and the scope will be argued about later.

Access

You do not hold your own accounts

Domain, hosting or repository registered to the supplier rather than to you. Almost always accidental, always worth fixing before it matters.

Testing

No environment other than live

If there is nowhere safe to try a change, every change is a gamble — and eventually one of them lands badly.

People

One person understands everything

Not a criticism of them. It is a business risk that grows quietly until the week they are unavailable.

Dependencies

Nothing has been updated in years

Frozen dependencies mean either the upgrade path is broken or nobody is looking. Both need a plan.

Documentation

The knowledge is verbal

Where an answer only exists in someone's head, the system cannot be handed over, valued or safely changed.

Complexity

Architecture aimed at a scale you are not at

Infrastructure built for millions of users when you have hundreds carries real cost and buys nothing yet.

Backups

Backups nobody has restored

Untested backups fail surprisingly often, and you find out at exactly the wrong moment.

Communication

Progress is described, never shown

Healthy projects have something to look at every week. When updates are narrative rather than demonstrable, ask to see it running.

Questions

Technical consulting, answered

Will you just recommend that we hire you?

No, and the engagement is structured so that we do not have to. It is fixed price and paid for on its own terms, the report is yours regardless, and several clients have taken it straight to their existing developer.

If your current supplier is doing good work, that is what the report will say. It is a more useful outcome than a rebuild you did not need.

How long does a review take?

Most take a few days to a couple of weeks depending on system size and how many of the seven areas apply. A quote review or a platform decision can often be turned around inside a week.

Due diligence for an acquisition usually runs longer because there are more questions to ask of people rather than of code.

What access do you need?

Read-only wherever possible — the repository, a copy of the database with sensitive fields removed, hosting details and any existing documentation. Where access cannot be given, we work from what is available and say plainly what we could not see.

We do not need production write access to review anything.

Can you review a quote we have received?

Yes, and it is one of the most common requests. We look at whether the scope matches what you described, whether the approach is sound, what is missing, and which assumptions will cause a variation later.

You get a list of specific questions to put to the supplier. Often that conversation alone changes the shape of the project.

Do you work with our existing developers?

Usually, and it goes better when we do. Good developers generally welcome a review — they are frequently already aware of the problems and have been trying to get them prioritised.

The report gives that argument an independent voice, which is sometimes all it needed.

Is this useful if we are not technical at all?

That is who it is written for. Findings are explained in terms of business consequence — cost, risk, time, dependency — with the technical detail available underneath rather than in the way.

The test we apply is whether you could take the summary into a meeting and defend it without us there.

What if you find something serious?

You hear about it immediately rather than in the final document. Anything genuinely urgent — an exposed credential, an unpatched vulnerability being actively exploited — gets raised the day we find it, with the minimum step needed to close it.