Skip to content
Nash Software Services
NASHSOFTWARE SERVICES
Free tool

Do you know what you have?

A short quiz for founders, directors and investors who rely on software they did not write themselves. It takes about five minutes. You get a plain-English result straight away: what an independent review would need to cover, and which questions to put to your developer or supplier.

It will also tell you when a review is probably not needed. Not every business needs one.

Nothing you enter leaves your browser. There is no sign-up, nothing is stored or sent, and the result appears on this page.

Never enter code, passwords or keys here. You only need to choose answers. The quiz has no text boxes.

0 of 12 answered0%

Ownership and access

1.Does your company own the code repository (for example on GitHub, GitLab or Bitbucket), with a director listed as an owner?

Why it matters: If the code sits in someone else's account, you may not be able to get it back, move supplier or prove what you own.

2.Do you hold admin logins for the hosting or cloud account where the software runs?

Why it matters: Whoever holds these logins can switch the software off, change it or read the data in it. You want that to be you, not only a supplier.

3.Do you control the domain name and the logins for the outside services it relies on (payments, email, analytics, AI services)?

Why it matters: A product usually leans on many small accounts. Losing one, or finding it is in a former contractor's name, can stop the whole thing.

Who built it, and who has checked it

4.Who built most of it?

Why it matters: This is not about quality. It tells us how much knowledge sits with one person or one supplier, and what you would lose if they left.

5.Has anyone independent of the builders looked at the code or the setup?

Why it matters: People who build something are the worst placed to spot its blind spots. A second pair of eyes finds what the first pair cannot.

Data and users

6.Does it store personal data, take payments, or hold health or financial records?

Why it matters: Holding other people's data brings legal duties and makes mistakes more costly. It also raises what customers and investors expect of you.

7.Do you work in a regulated sector (finance, health, education, children's services), or do customers ask you for security assurances?

Why it matters: Regulators and larger customers ask for evidence, not reassurance. Knowing what you could show them is half the work.

How it was built

8.How much of the code was written with AI coding tools?

Why it matters: AI tools produce working code quickly, but they can leave gaps that look fine on screen: missing checks, tangled structure, keys left in the code.

Change and risk

9.Are there automated tests that run before changes go live?

Why it matters: Without tests, every change is a gamble and fixing one thing can quietly break another. Tests are what let a team move fast safely.

10.Are backups taken, and has anyone actually tested restoring from one?

Why it matters: A backup that has never been restored is a hope, not a plan. Many teams only find out that theirs does not work on the worst day.

11.Can the team release a change, and undo it, without one person doing it by hand?

Why it matters: If only one person knows how to release changes, you depend on them being available, and a rushed manual release is a common cause of outages.

The decision ahead

12.What is coming up for the business in the next year?

Why it matters: Investors, buyers and big customers ask hard questions about the technology. The right time to find the gaps is before they ask.

Checklists

What to gather before a review

You can start on this today, whether or not you ever ask for a review. Even finding out which items you cannot tick off is useful.

Access

  • Owner-level access to the code repository (GitHub, GitLab or Bitbucket), or a named person who can grant read access.
  • Admin or read access to the hosting or cloud account, and a list of the other services in use.
  • The domain name registrar login, and who is listed as the owner of record.
  • A list of paid services and subscriptions the product relies on, with who holds each login.

Documents

  • Any architecture notes, diagrams or setup instructions, even if they are rough.
  • The original brief, specification or contract with the supplier.
  • Past reviews, penetration tests or incident write-ups, if any exist.
  • A list of who has worked on it and when.

A safe copy of the data

  • A staging or test environment, if there is one.
  • Sample data that is made up or has had personal details removed. Real customer data should not be shared unless it is truly needed.
  • A description of what data is stored and where.

People to talk to

  • The person who knows it best, and one other who can fill gaps.
  • Whoever decides priorities for the product, to explain what matters most.
  • Any former developer or supplier contact who can answer a question.

Questions to ask your developer or supplier

A general list you can print or paste into an email. These are fair questions to ask of anyone who builds or runs software for you. A good supplier will be glad you asked.

  1. Who owns the code, the hosting accounts, the domain and the outside service accounts, and where is that recorded?
  2. Can a director of the company have owner-level access to all of them this week?
  3. How do I run the software somewhere else if I needed to? Is that written down?
  4. What would break, and who would know how to fix it, if you were unavailable for a month?
  5. What automated tests are there, and do they run before every release?
  6. How are changes released, and how is a bad release undone?
  7. What is backed up, how often, and when did you last restore from a backup?
  8. What personal or payment data does it hold, and who can see it?
  9. What outside libraries and services does it depend on, and who keeps them up to date?
  10. What has gone wrong in the last year, and what changed as a result?
  11. Which parts are you least happy with, and what would you do about them?
  12. If I asked someone independent to review it, what would you want them to look at first?

Use your browser's print command (Ctrl+P or Cmd+P) to print this page or save it as a PDF.

If the answers come back unclear

If you cannot get clear answers, or a funding round, sale or launch is close, an independent review can settle it. If your own checks come back clean, you may not need one at all, and I will tell you so.

Ask about a reviewSee what a review covers