Release 1 · 9 Nov 2026

ProfessorMeAlready own it · all nine areasFor the boardSample report, example data. Not real findings.

Healthy, with two things to fix now.

The product is well built and the team releases every week. Nobody has tested a restore, and one person has the only way into production.

Fix those two this month. Plan for £160k to £260k of engineering work over the next 12 months, most of it on separating reports from the live database. Nothing we found stops you serving today's customers.

Fix now

Do these this month

Fix this quarter

Before the end of January

£210k

Likely cost to fix

£160k to £260k, at £750 a day

Findings

Backed by 96 pieces of evidence

Findings, by when to fix them

The eight that matter most, of 24.

WhenRefFindingAreaLikely costWhy it comes hereEvidence

Fix nowH-01Nobody has tested restoring a backupRestore test booked for 18 NovInfrastructure and resilience£6kIf a restore fails, customer data is lost4 pieces

Fix nowH-02One person has the only administrator access to productionNot startedTeam and delivery£4kNothing can be fixed while they're away3 pieces

Fix this quarterH-03Staff accounts don't need a second factorNot startedSecurity£9kLarge customers ask for it first5 pieces

Fix this quarterH-04Two libraries in the live product have known serious flawsOne updated, to be checked againSecurity£14kA fix exists for both6 pieces

Fix this quarterH-05Customer records are kept after an account is closedNot startedData and privacy£22kNeeded before the next customer review5 pieces

Plan forH-06Reports and the live product share one databaseIn the plan for next yearArchitecture and scale£85kA limit at about four times today's load7 pieces

WatchH-07The AI feature has no written policy and no second providerNo action needed yetAI use and governance£18kSmall today, grows as use grows4 pieces

StrengthH-08Releases are automated and can be undone in minutesBetter than expected at this stageInfrastructure and resilienceNoneKeep doing it5 pieces

Nine areas, graded

A to E, against companies of this size and stage. Next time, each shows what changed.

Architecture and scale · grade B

Grows by adding servers. Reports and the live product share one database.

Code health · grade B

Consistent, reviewed and well tested where it matters.

Security · grade C

Good access control and logging. No second factor for staff, and two libraries to update.

Infrastructure and resilience · grade D

Releases are automated. Backups are taken nightly and have never been restored.

Data and privacy · grade C

Personal data is mapped. Records are kept after accounts close.

Team and delivery · grade C

Releases weekly. One person has the only way into production.

Open source and IP · grade A

Every licence allows commercial use, and every contributor is under contract.

Product and roadmap fit · grade B

The design supports next year's roadmap.

AI use and governance · grade C

One AI provider in the product, with no written policy and no backup.

The next 12 months

In order, most urgent first.

This month

Fix now

Restore last night’s backup to a spare database and time it H-01 · £6k, 3 days
Give a second person administrator access, with the steps written down H-02 · £4k, 2 days

This quarter

£45klikely

Require a second factor on every staff account H-03 · £9k
Update the two libraries with known serious flaws H-04 · £14k
Delete customer records when an account is closed H-05 · £22k

Months 4 to 12

£103klikely

Move reports to their own copy of the database H-06 · £85k
Write the AI policy and add a second provider H-07 · £18k

Ask a question

Answers come only from the evidence in this report, with references. If the evidence can't answer, your question goes to the analyst and we tell you.