Scaleflow

The services industry is rebranding itself around outcomes it cannot measure. That's a big problem. HFS Research: 76% of buyers would rather pay for a result than for hours worked. 5% have a contract that works that way. In September they asked 100+ banks and insurers why. 23% said they cannot define or measure the result they would be paying for. So it is not a demand problem. It is a supply problem. Almost nobody can show what they delivered, so almost nobody can sell it that way. We picked one field to close it in: tech due diligence. One price per deal, never per hour, and every report keeps a record of how it was made. Run it twice on the same code and you get the same report. That raises a question we did not plan for: enablement. Other firms ask us whether they can run their own work on what we built. We have not decided yet whether we want that, but the number of conversations is growing.

Scaleflow is growing. We are moving to a new office soon and are building our commercial team. We do that as a Service as Software (SaS) company. A SaS company sells the work itself, not a tool. The client pays for the outcome, software does most of the work, and people add judgement where it matters. Every job makes the software better, so each one takes fewer hours than the last. For us, that work is tech due diligence. Tech due diligence has always been a service: people, weeks, a report. With the X-Ray, a fund buys an outcome. It gets a clear view of where the product, technology and AI of a company stand today, and of the path forward. The company gets a concrete set of next steps. To deliver that, we built our own OS. It reads the code and the data room, tests every finding against the deal and writes the report. People add judgement where it matters. We run every X-Ray on it ourselves, so every X-Ray makes the next one better. Under the hood, the OS is built in layers. Deterministic steps sit between the AI steps, so the same codebase gives the same result. We pick the best model for each skill, and improvements go live almost in real time. What this gives our clients: 1️⃣ Precision that does not depend on who has a good day 2️⃣ Findings tested against the deal, not just a code score 3️⃣ From code access to report can be done in one business day Our whole team, me included, works as forward deployed engineers. We are small, every one of us is senior, and we sit with the client and own the result. Dozens of funds now do their tech, product and AI DD with us, from software for autonomous robots to cybersecurity platforms. Next we bring the X-Ray into the processes and tools funds already use. A lot of that lands in 2027. We built the OS for our own SaS business. Other professional services firms are asking whether they can run it too, and we are exploring that. I will share what we learn along the way: what works, what does not, and what it takes to build a SaS company. /CC Wilco van Duinkerken Jurrie Spoelstra Indroneel Ray Thijs Jung

AI agents now write code faster than any team can approve it. At Scaleflow we are solving that without loosening security or compliance. We see it in the teams we assess at Scaleflow when we do an X-Ray. The front-runners build faster than ever, and the approval is where they slow down. We have felt it ourselves for a long time. Everyone here codes as a forward deployed engineer, me included. 10x is not the goal anymore. 100x is. The faster we build, the harder we hit it. Wilco (CTO) in our dev channel: "All this PR approval stuff is irking me terribly. It's sooo slow..." Our approach starts with one distinction: review and approval are two different things. An agent can read every change. The yes is where we wait. So we split them: 1️⃣ An agent reviews every pull request. It has to read the changed lines and the tests before it may approve anything. 2️⃣ Some paths always go to a person: auth, infrastructure, permissions, database migrations. Code owners add their own critical paths per repo. The rest can go through. 3️⃣ The human approves the system, not every change. A change to the rules themselves always needs a person. The bottleneck does not disappear. It moves to the high risk areas, and there it stays human. Signing faster is not the way to 100x. Making that area smaller is. Agents only add, so Wilco's rule is now in our base prompt: "Tell your agent it should still do tomorrow what it does today, only with half the code removed." Others see it too. A few weeks ago I had a good conversation about it with Wouter Goossens (Partner at Fortino Ventures). He hears the same when he talks to software teams: they build faster than ever, and the approvals have become the bottleneck. Nicholas (Head of AI & Research at Jellyfish) looked at 105 million pull requests across 1,300+ companies: the median company merges 0.6% of its PRs without a human reviewer. The leaders are at 9% or more. Writing code is not the constraint. ✔️ Trust in the approval is! For most companies that trust runs through compliance. SOC 2 never said a human has to approve every pull request. It asks for changes that are authorised, tested and approved, with separate roles. Auditors now start to accept automated review, as long as a person owns the tool. That is what lets the rest of the market follow. What is not done: our agent already approves, but our own policy still asks for a human on top. And its first comments did not always match the change. Every step forward moves the bottleneck. This one we will solve too, and we would rather solve it first than wait for the market. Curious how others handle this: where do you draw the line between what an agent may approve and what still needs a person? I will share what we learn along the way: what works, what does not.

Investors describe tech due diligence as dreadful, expensive, lengthy and annoying. Then the report lands after the decision is already made. Every fund that started with Scaleflow still works with it. 40+ European VC and PE funds. 250+ diligences. 100% partner repeat rate. The reason: findings tied to what they mean for the deal, delivered in 1 business day.

AI has made every pitch look better than the product behind it. The EU AI Act makes that gap expensive. Rules for high-risk AI systems apply from 2 December 2027. Any company you back today will have to meet them during your hold. Scaleflow’s X-Ray scans the whole codebase, including security and compliance posture, and delivers an IC-ready verdict in 1 business day. Before the term sheet, not after.

Tech due diligence still takes 3 to 6 weeks at most funds. Long enough to lose a deal to a faster investor. Scaleflow’s X-Ray scans the whole codebase, not a sample, and delivers two reports in 1 business day: an IC-ready summary for the deal team and a fix list for the CTO. Move tech due diligence to the front of your next deal.