Audit week first, on paper, with you in the room. Architecture written down before the first PR opens, then one-to-four-week sprints with weekly demos and a board-ready report. 100+ projects on this cadence since 2019.
The same four phases run on a 6-week MVP, a 14-week SaaS rebuild, and a 16-week AI product. The dates change. The shape doesn’t. That’s the whole methodology in one sentence.
A Series A fintech came to us with merchant onboarding that worked, until it didn’t. The KYC boundary had been bolted onto auth mid-sprint, nobody wrote down why, and the next engineer couldn’t change vendors without touching login. A year-two refactor that the audit week would have caught on day five.
That’s the pattern behind the methodology. The expensive surprises don’t come from hard problems. They come from decisions made quietly, mid-build, with no record of the alternatives. So we made the audit the load-bearing week, and the architecture decision record the load-bearing artifact. Six ADRs minimum before the first PR opens.
The result is dull on purpose. No heroics, no late-night saves, no clever rescue. Just the same four phases, the same written architecture, the same Friday sprint report, 100+ times since 2019. This page is for the founder who’s already paid for the surprise once.
The same four phases run on a 6-week MVP, a 14-week SaaS rebuild, and a 16-week AI product. Here’s what each one does, and what you walk away holding when it ends.
“Can you just start building? We’re in a hurry.”
One week, fixed cost, architecture written on day 5. Five days of senior attention on your brief or your codebase. Signed scope by Friday afternoon. You walk away with the audit brief either way, no commitment to build.
“What if the risky part turns out to be impossible halfway through?”
The riskiest 20% built first. The thing most likely to fail goes against the gold set in week two. If it doesn’t hold, we redesign before we touch the easy 80%, while it’s still cheap to change.
“How do I know what’s happening without chasing you every day?”
1-2 week sprints, demos every Friday. A written sprint report your team can forward to your board or seed lead. Two senior engineers paired daily. Every decision into an ADR by the same evening.
“Once you hand over, can my next engineer actually pick this up?”
Architecture brief, six ADRs, runbook, 30-day on-call. DPA pack and a 30-minute video tour for your next engineer. We sit alongside your team for 30 days post-handover. Then you walk on.
The audit week is the load-bearing decision of the whole engagement. It’s where the architecture gets written, scope gets locked, and we tell you honestly whether the brief fits the budget.
Mutual NDA signed inside 30 minutes via DocuSign. Two-hour kick-off. We read your brief, your existing code read-only, your customer history, your unit economics if relevant.
System diagram drafted on a whiteboard. Edge cases surfaced. The features that don’t belong in v1 named. The features we’d push back on documented in writing.
Risk model on the top 8 abuse patterns. Cost model on the AWS and infra spend at 10× current scale. Build cost in GBP and engineering days, line-itemed.
Six ADRs minimum drafted. Each one is the decision with context, alternatives considered, decision, consequences. Your team reviews. You own the words.
30-page audit brief in your inbox by lunchtime. Walkthrough in the afternoon. Signed scope locked by 5pm. You can walk away, and about a fifth of audit-only clients do.
These are the rules the methodology is made of. Each one exists because we paid for its absence at least once.
The diagram, the trade-offs, and the call get made on paper before the first commit. Always.
Every meaningful call lands in an architecture decision record the same evening, in your repo.
Two senior engineers paired daily kills the bus factor. Either can take over the next morning.
Material scope changes go into a written change request with a delta quote. You decide.
A 30-minute demo and a written sprint report your team can forward unchanged. No surprises.
IP assigns on commit. 30-day walk-away in both directions. No lock-in, no deposit forfeiture.
The audit told you what we’ll build and why. This is the rhythm of the weeks that build it. Open any day to see what your team sees from the outside.
A 30-minute sync. Sprint goal stated, risks named, blockers cleared. No planning theatre. We commit to one or two outcomes per week and say so out loud.
Send a 5-line briefTwo senior engineers paired daily on the load-bearing work. Every PR through Mohit’s review. Every meaningful decision into an ADR by the same evening. CI green on every merge. No exceptions.
Send a 5-line briefA 30-minute demo with your team. A written sprint report you can forward to your board or seed lead. What shipped, what slipped, what we’re doing about it. No surprises.
Send a 5-line briefA shared Slack channel with your team. We answer within the hour during UK working hours: architecture questions, blocked-PR debugs, customer escalations. No clock-billing on the channel.
Send a 5-line briefProduction codebase in your GitHub org with IP assigned on every commit. A 30-page architecture brief, six ADRs minimum in /docs/adr/, a one-page system diagram, an on-call runbook, a 30-minute video tour, a DPA and sub-processor list, and 30 days of on-call alongside your team.
Send a 5-line briefWhat seven years of this software audit methodology produces for the founders we ship for. Numbers, not adjectives. Names are codenamed; figures are real.
We don’t publish prices on a page. Every engagement runs on the same methodology, but the shape that fits you is yours to pick. Mohit sends your real number inside 24 hours.
One week, fixed cost. We strip the brief or the codebase, pick the stack, write the architecture, hand you a signed scope.
One to four-week sprints of fixed-scope shipping. Two seniors paired. Weekly demos and a written report your board can read.
After the 30-day on-call. Monthly retainer for a senior engineer plus architectural advisory while your in-house team ramps up.
“The audit week paid for itself on day five. They found the boundary our last team had bolted on wrong, wrote down why, and we never had the year-two refactor everyone warned us about.”
— CTO, UK B2B SaaS, 280 customersPain-first, soft-second.
Not on our shop. Every engagement we’ve shipped since 2019 started with an audit week, because the week is what surfaces the scope risks, the architecture decisions, and the load-bearing edge cases. Skipping it is how mid-sprint surprises become refactors. This is the whole point of an audit-first software studio: the week costs from £8K, and it saves multiples of that on a 6-12 week build.
Small changes, like copy, colour, or a logic branch, get absorbed without re-pricing. Material changes, like a new flow, a third user role, or a new payment provider, go into a written change request. We quote the delta, you decide. Nothing material is built off a Slack message. That discipline is how 100% of our fixed-scope projects ship on time.
Bus factor. The single biggest risk on a small-studio engagement is one engineer disappearing mid-build. Two seniors paired, every decision in an ADR the same day, means either one can take over the other’s work the next morning. In seven years, two engineers have left mid-project. Both handovers were inside 48 hours. Neither client noticed in their sprint.
What shipped this week. What slipped, and why. What we’re doing about the slip. The risks ahead for next week. Hours used and remaining. Your team can forward it to your board or your seed lead unchanged. We write it so you don’t have to, and it’s a fixed part of the software audit methodology, not an extra.
Yes, with 14 days’ notice. Engineers move to other projects. Your repo stays where it is. Your spend pauses. Pick it back up with 14 days’ notice and we restart at the same sprint board, same engineers. No cancellation fee. We did this six times in 2025.
You walk on, or move to a senior advisory retainer of £5K-10K a month, cancellable any month. About half our clients walk on cleanly. About half stay for 6-12 months while their in-house team ramps up. Either is fine. No lock-in either way, and IP has assigned to you on every commit since day one.
It’s a Wednesday-of-audit-week question, not an afterthought. The risk and cost model covers data residency, and the handover pack ships a DPA, a sub-processor list, and standard contractual clauses where the build crosses borders. We architect the boundary so a UK or EU data-residency requirement doesn’t become a rebuild later.
That’s what the architecture brief and the ADR set are for. When a diligence team opens the repo, they find a one-page system diagram, six or more decision records with the alternatives we considered, and a runbook. The architecture audit methodology is built so the next engineer, and the next acquirer’s CTO, inherit the why, not just the what.
our methodology, in context — the dashboards, flows and components your team actually ships, reviews and maintains.
Tell us what you want shipped, the deadline you’re holding to, and where the current codebase or sketch lives. Mohit replies inside 24 hours: a clear yes, a clear no, or the one question that decides it.
Yes, no, or the deciding question. Straight to your inbox.
We write the architecture, lock the scope, hand you the brief.
Code, brief, ADRs, runbook, video tour, DPA, and 30-day on-call.