How Investors Evaluate Startups: A Due Diligence Guide | BuildWright
How Investors Evaluate Your Startup Beyond the Pitch Deck
23 min read
due diligencestartup due diligence Indiainvestment readinessdata roomcap tablefundraisingROC compliancelegal due diligence
Need help with due diligence? We can handle it for you.
A founder in Bengaluru gets a verbal yes from a lead investor after a 40-minute pitch. Three weeks later, the deal is dead — not because the product was weak, but because the company's cap table didn't match its ROC filings, a former co-founder never signed a share transfer, and nobody could produce a single IP assignment agreement for the app the company was selling. Nothing about the business changed between the pitch and the collapse. What changed was that someone finally checked.
This happens more often than founders expect. Funding decisions in India are effectively made twice. The first decision happens in the room, after the pitch, when an investor decides you're worth pursuing. The second decision happens weeks later, in spreadsheets and document folders, when an associate or a lawyer checks whether what you said is actually true on paper. Most startups pass the first test. A surprising number fail the second — not because they lied, but because they never treated their own paperwork as a product that needed building.
BuildWright Insight — Investors rarely discover new value during diligence. They discover undisclosed risk. Diligence doesn't raise your valuation; at best, it protects the one you already earned in the pitch.
Why the pitch alone was never going to be enough
A pitch deck demonstrates a story: the market is big, the team is capable, the traction is real, the model works. Investors know decks are marketing documents, so a good pitch earns interest, not commitment. Diligence exists because interest has to be converted into something an investment committee can defend later — to their LPs, to their own board, and to themselves if the bet goes wrong.
Investors approach diligence with four goals, in this order: preserve capital, reduce uncertainty, verify the specific claims made in the pitch, and quantify whatever risk is left over after verification. Nothing in that list is about finding upside. It's entirely about finding the things that could make the downside worse than expected.
The trust pyramid: what investors actually check, and in what order
Diligence doesn't happen randomly. Serious investors work up a trust pyramid, verifying the layers in roughly this sequence:
This article is general information, not legal advice. If you need advice for your specific situation, contact BuildWright directly.
BuildWright can take this off your plate — done properly, the first time.
Get new templates and compliance updates by email.
Founder — background, references, past conduct, any undisclosed conflicts
Product — does it work the way the demo suggested, and is it defensible
Customers — are the logos and revenue numbers from the deck real and reference-checkable
Financials — do the numbers in the model match the numbers in the bank statements and filings
Legal infrastructure — is the company itself, its ownership, and its contracts sound
Governance — does the company make decisions the way a company legally has to
Founders usually over-invest in the top of the pyramid — the story, the demo, the metrics — and under-invest in the bottom two layers, because legal infrastructure and governance feel administrative rather than exciting. But the bottom two layers are exactly where deals die, because they're the layers a founder can't talk their way through. A great answer to a hard product question buys goodwill. A missing board resolution doesn't care how good your answer was.
What is due diligence, exactly?
"Due diligence" isn't one process — it's five overlapping investigations, usually run in parallel by different people on the investor's side. Knowing who's checking what tells you where to focus your prep.
Legal — Objective: confirm the company legally owns what it says it owns, and is bound only by what it discloses. Reviewer: external law firm or in-house counsel. Common red flags: missing IP assignments, unfiled board resolutions, undisclosed litigation.
Financial — Objective: verify revenue, burn, and runway match the numbers in the model. Reviewer: the investor's finance team or an appointed CA firm. Common red flags: revenue recognised before cash or contract exists, unreconciled books.
Commercial — Objective: test whether the market and customer claims hold up. Reviewer: investor associates, often via customer reference calls. Common red flags: unverifiable logos, customer concentration in one or two accounts.
Technical — Objective: assess whether the product and codebase are what they're claimed to be. Reviewer: a technical advisor or in-house engineer. Common red flags: unowned or unlicensed open-source dependencies, undocumented single-person code dependency.
Compliance — Objective: confirm statutory filings and licences are current. Reviewer: legal counsel or a compliance consultant. Common red flags: lapsed ROC filings, no GST registration despite crossing the threshold, no POSH policy.
The investment readiness framework: six pillars investors score you on
Whether or not an investor uses a formal scorecard, they're mentally scoring six pillars of your company. Treat this as your own pre-fundraise audit — score yourself honestly before someone else does it for you.
Corporate structure — Red flag: constitutional documents outdated or missing, unfiled name/address changes. Workable: documents exist but scattered, some filings pending. Investment-ready: clean incorporation record, all filings current and centrally stored.
Ownership — Red flag: cap table doesn't match ROC records, undocumented transfers. Workable: cap table accurate but no vesting on founder shares. Investment-ready: cap table reconciles exactly with statutory registers; vesting and ESOP formally documented.
Contracts — Red flag: no founder agreement, customer or vendor deals verbal or undocumented. Workable: key contracts exist but inconsistent templates, missing signatures. Investment-ready: signed, dated, standardised agreements for founders, employees, customers, vendors.
Compliance — Red flag: GST, ROC, or labour filings lapsed or never started. Workable: filings current but reactive, no compliance calendar. Investment-ready: full compliance history with a forward calendar and no pending notices.
Governance — Red flag: no board minutes, decisions undocumented. Workable: minutes exist but irregular, no policies. Investment-ready: regular board meetings, minuted decisions, related-party transaction policy in place.
Operations — Red flag: no documented processes, single points of failure undisclosed. Workable: some documentation, key-person risk acknowledged. Investment-ready: documented SOPs, succession awareness, no undisclosed dependency on one person.
Picture this as a hexagon with one axis per pillar — most early-stage startups score unevenly, strong on one or two axes (usually operations and product-adjacent contracts) and weak on the ones that require no product skill at all: corporate structure, ownership records, and governance. Those are also the cheapest pillars to fix, because fixing them is a paperwork exercise, not a business-building one.
Corporate records: the paper trail investors trust more than your pitch
Before an investor reads a single contract, they want to confirm the company itself is what it claims to be. That means checking a specific stack of documents, in this order:
Certificate of incorporation and CIN
Memorandum and Articles of Association (MOA/AOA), including every amendment
Share certificates for every allotment, matching the register
Board resolutions for every material decision (allotments, related-party transactions, borrowing, office changes)
ROC filings — annual returns, event-based filings, DIN/DPIN records for directors
Registered office proof and history of any address or name changes
A common — and entirely avoidable — scenario: a company signs a related-party lease with a director's family member 14 months before a raise. No board resolution was passed at the time, because it felt like a routine administrative matter, not a governance one. By the time the investor's counsel finds it during diligence, it looks like exactly the kind of undisclosed related-party dealing investors are trained to flag. Closing slips by three weeks while the company retroactively documents and ratifies a decision that should have taken ten minutes to record correctly the first time.
The lesson isn't that the lease was wrong — related-party transactions are often perfectly legitimate. The lesson is that undocumented decisions read as hidden ones, even when they aren't.
Ownership and the cap table
Nothing gets more scrutiny than who owns the company and how that ownership came to be. Investors are checking founder equity splits, whether founder shares carry a vesting schedule, the size and board-approval status of the ESOP pool, the terms of any convertible instruments (CCPS, CCDs, or convertible notes from earlier rounds), the paper trail behind every share transfer, and the full dilution history from incorporation to today.
Investment-ready
Red flag
Founder shares carry a documented vesting schedule
✓✕
ESOP pool size matches a board- and shareholder-approved scheme
✓✕
Every share certificate reconciles exactly with the ROC register
✓✕
Convertible instruments have signed, dated agreements with clear conversion terms
✓✕
Every past transfer has a board resolution and required regulatory filing
✓✕
One founder holds an unexplained, undocumented majority stake
✕✓
A departed co-founder's shares were never formally bought back or transferred
✕✓
Cap tables rarely start messy — they get messy incrementally, one undocumented friends-and-family allotment or one handshake agreement with an early advisor at a time. Each one is a small shortcut. By the time a Series A investor's counsel reconstructs the ownership history, small shortcuts compound into a diligence process that takes twice as long as it should.
Incorporation
Founders allot shares per the subscriber sheet. This is the cleanest the cap table will ever be — get it exactly right here.
Angel / seed round
New investor shares issued, often alongside a first ESOP pool carve-out. Convertible instruments (notes or CCPS) commonly enter here.
ESOP pool top-up
Pool expanded ahead of the next round, usually diluting existing shareholders pro-rata — this needs a fresh board and shareholder approval, not just an update to a spreadsheet.
Series A and beyond
Institutional investors take preference shares with defined rights; prior convertibles convert; the cap table needs to reconcile precisely with ROC filings before signing.
Contracts: what's missing hurts more than what's there
Investors don't read your contracts looking for clever clauses. They read them checking for absence — the agreement that should exist and doesn't. Founder agreements, employment agreements, contractor agreements, customer agreements, vendor agreements, licensing terms, IP assignments, and NDAs are the baseline set.
Founder agreement — Business risk: no clarity on roles, equity, or what happens if a founder exits. Investor signal: unresolved founder-level risk — the single biggest reason early deals fall apart.
Employment agreements — Business risk: ex-employees can dispute IP ownership or confidentiality obligations. Investor signal: the company doesn't treat its own workforce formally.
Customer agreements (MSAs) — Business risk: revenue isn't contractually guaranteed and can be disputed or cancelled. Investor signal: reported revenue may not be verifiable or durable.
Vendor / contractor agreements — Business risk: no recourse if a vendor fails to deliver or breaches confidentiality. Investor signal: operational dependencies are unmanaged.
IP assignment agreements — Business risk: contractors or early developers may retain rights to core IP. Investor signal: the company may not fully own the product it's selling.
NDAs — Business risk: sensitive information shared with no legal protection. Investor signal: weak information hygiene across the business.
Intellectual property: who actually owns what you're selling
For a technology company, IP ownership is often the single highest-stakes item in diligence, because the product is the asset. Investors check who legally owns the code and design, whether every contributor — employee, contractor, or agency — signed a valid IP assignment, what open-source licences the codebase depends on and whether any are the restrictive, copyleft kind, the status of trademark registrations, copyright in content and design assets, third-party licensing terms, and who owns the domain name and any related handles.
Ownership — is the IP registered to the company, a founder personally, or nobody at all
Assignments — signed IP assignment agreements from every contributor, not just full-time employees
Open-source risk — copyleft licences (like GPL) can force disclosure obligations that founders rarely anticipate
Trademark status — registered, pending, or unfiled, and whether the name is actually available to register
Copyright — content, design, and documentation ownership
Licensing — any third-party software or data the product depends on
Domain ownership — registered to the company, not to a founder's personal account
A recurring pattern in early-stage diligence: the founding team hired a freelance developer to build the first version of the product before incorporation. No IP assignment was ever signed, because the relationship was informal and everyone trusted each other. Two years and one funding round later, an investor's technical counsel asks a routine question — "who owns the original codebase?" — and there's no clean answer. Legally, the freelancer may still hold rights to code the company has been selling for two years. Resolving it after the fact means negotiating with someone who now knows they have leverage.
Compliance: the boring stuff that kills fast deals
Compliance gaps are the most common reason diligence drags on, precisely because they're the most fixable and the most neglected. Investors check ROC filing history, GST registration and return filing, labour law compliance (PF, ESI, POSH), income tax filings, industry-specific licences, and — increasingly — data privacy compliance.
A few thresholds founders consistently get wrong: GST registration becomes mandatory once turnover crosses ₹40 lakh for goods or ₹20 lakh for services in a financial year (lower in special-category states). Annual ROC filings — Form AOC-4 (financial statements) and Form MGT-7/MGT-7A (annual return) — are due 30 and 60 days respectively after the AGM, with a flat penalty of ₹100 per day of delay and no upper cap, which is why a filing pushed off "for later" quietly becomes expensive. Any organisation with 10 or more employees — counting contractors, interns, and temporary staff — must constitute an Internal Committee under the POSH Act; there's no grace period and no reversal once the threshold is crossed. On the data protection side, the Digital Personal Data Protection Rules, 2025 were notified in November 2025 and are rolling out in phases through May 2027 — early-stage companies handling user data should treat this as a near-term compliance item, not a someday one.
These figures were checked via current sources in July 2026. Regulatory thresholds and deadlines change; confirm the exact numbers relevant to your entity type and state before relying on them for a filing decision.
Day 0 — Incorporation
Certificate of incorporation, PAN, TAN, and the statutory registers are opened. Get the constitutional documents right here — amending them later is more expensive than doing them correctly once.
Day 30 — Operational compliance
Bank account, GST registration if the turnover threshold is likely to be crossed, shops & establishment registration, and first employment contracts.
Day 180 — First compliance checkpoints
First TDS and GST returns if applicable; POSH Internal Committee if headcount has crossed 10; first board meeting cadence should be established.
Annual — Recurring obligations
AGM, AOC-4, MGT-7/MGT-7A, income tax return, DPT-3 (return of deposits), and any sector-specific licence renewals.
ROC annual filings — "Current" looks like: AOC-4 and MGT-7 filed within 30/60 days of AGM, every year since incorporation. "Missing" costs you: ₹100/day penalty with no cap, plus director disqualification risk after repeated defaults.
GST — "Current" looks like: registered once the threshold was crossed, returns filed on schedule. "Missing" costs you: interest, penalties, and an investor question about whether other numbers in the model are equally unreliable.
POSH — "Current" looks like: Internal Committee constituted once headcount hit 10, policy circulated. "Missing" costs you: a fine up to ₹50,000 per offence, doubling on repeat, and a governance red flag disproportionate to its cost of fixing.
Labour (PF/ESI) — "Current" looks like: registered and remitted once applicability thresholds are met. "Missing" costs you: back-dated liability plus interest, discovered and quantified during diligence, not before.
Governance: how investors read your board minutes
Governance is the pillar founders most often mistake for something that only matters "once we're big enough." Investors read it the opposite way: a company that documents decisions well at 10 people will do it at 100. A company that doesn't will need to be taught how, on the investor's dime and timeline.
Level 1 — No board meetings, no minutes; decisions exist only as memory or Slack messages
Level 2 — Occasional board meetings, informal or missing minutes
Level 3 — Regular board meetings with minutes, but no related-party transaction or conflict policy
Level 4 — Minuted meetings, a related-party transaction policy, and documented decision authority levels
Level 5 — Formal governance calendar, independent oversight where applicable, and audit-ready minute books
Climbing this ladder costs almost nothing — a shared minute-book template, a fixed monthly board cadence, and a one-page related-party transaction policy will move most seed-stage companies from Level 1 to Level 3. The return on that effort shows up entirely at diligence, when "show us your last four board minutes" has an immediate answer instead of a scramble.
Building your data room before anyone asks for one
A data room is simply the corporate records above, organised so a stranger can find anything in under a minute. Building it before you start fundraising — not after a term sheet lands — turns diligence from a fire drill into a formality.
Compliance — GST registration and returns, labour registrations, industry licences
Policies — data privacy policy, information security policy, related-party transaction policy
Structure it as a folder tree that mirrors this list exactly. Investors and their counsel move faster — and form a better impression — when a data room is organised the way they expect it to be, rather than the way it happened to accumulate.
Red flags: what actually kills deals
Not every gap is equally dangerous. Some are a two-day fix; others end a term sheet. Calibrating which is which — rather than treating every finding as equally urgent — is what separates a founder who handles diligence well from one who panics through it.
Critical — Unresolved founder dispute over equity or control. Typical outcome: deal paused or withdrawn until resolved — investors rarely fund an unstable cap table.
Critical — Genuine uncertainty over IP ownership of the core product. Typical outcome: deal paused pending resolution; can trigger a valuation renegotiation.
High — Significant, undisclosed litigation. Typical outcome: renegotiated terms (indemnities, escrow) or withdrawal if severity is high.
High — Deep compliance backlog (years of lapsed ROC filings). Typical outcome: closing delayed until filings are cured; may trigger penalty indemnities.
Medium — Customer concentration (one client is most of revenue). Typical outcome: priced into valuation or structured as a milestone-based tranche.
Medium — Several missing but low-value contracts. Typical outcome: requested as a condition to closing, rarely a dealbreaker alone.
Low — Minor documentation gaps (an unsigned NDA with a dormant vendor). Typical outcome: noted as a post-closing action item, doesn't affect terms.
The pattern across nearly every collapsed deal is the same: it's rarely the severity of a single issue that ends things. It's the discovery that the founder didn't know about it, or knew and didn't disclose it. A Critical issue disclosed upfront, with a credible resolution plan, is survivable. The same issue discovered by the investor's counsel, unprompted, is not.
Where AI helps in diligence, and where it doesn't
AI tools are now a standard part of the diligence process on the investor side — mostly for the mechanical work of getting through a large document set quickly. They're a poor substitute for the parts of diligence that require judgment.
AI tools
Consultant
Lawyer
BuildWright hybrid
Document inventory & gap detection
✓✓✕✓
Summarising long contracts quickly
✓✓✓✓
Extracting key clauses at scale
✓✓✓✓
Judging what's actually material to this deal
✕✓✓✓
Negotiating terms with the counterparty
✕✕✓✓
Prioritising which risks to fix first, given limited time and cash
✕✓✓✓
Interpreting ambiguous or new regulation (e.g. phased DPDP rollout)
✕✕✓✓
The efficient split: let software do the first pass — inventorying what exists, flagging what's missing, summarising what's long — and reserve human judgment for materiality, negotiation, and anything where the regulatory answer is genuinely unsettled. Founders who try to run diligence prep entirely through AI tools tend to produce a tidy-looking data room with the same undiscovered gaps it had before, just better formatted.
Three investment journeys
These are composite, illustrative scenarios built from patterns that recur across early-stage Indian fundraises — not accounts of specific, identifiable companies.
Startup A — Ready on day one
Founders treated corporate hygiene as a monthly habit from incorporation onward.
Data room already existed when the term sheet arrived
Diligence took 9 days, entirely confirmatory
No renegotiation of terms; closed at the agreed valuation
Startup B — Three-month cleanup
Fundamentals were sound, but paperwork had never caught up with growth.
Cap table needed reconciling against three years of unfied ROC forms
IP assignments chased down from two former contractors
Closed on similar terms, three months later than planned, after visible effort to fix gaps
Startup C — Deal collapses
A founder dispute over undocumented equity splits surfaced only during diligence.
No founder agreement existed to resolve the disagreement
Investor counsel flagged it as an unresolvable Critical risk
Term sheet withdrawn; round restarted eight months later at a lower valuation with a new investor
The variable that separates these three outcomes was never product quality or market size. In each case, the product was fundable. What differed was how much of the company's paperwork the founders had already put in order before an outsider went looking.
The founder's due diligence toolkit
Before your next fundraising conversation, work through these five artefacts. Each one takes a few hours to build properly and saves weeks during diligence:
Due diligence checklist — the full document list mapped to your company stage
Data room index — the folder structure above, populated and access-controlled
Investment readiness scorecard — an honest self-score against the six pillars
Document tracker — what exists, what's missing, who owns getting it done, by when
Red flag audit — a candid list of what an investor would find today, ranked by severity
BuildWright helps founders put every piece of this in order — incorporation records, contracts, and compliance filings — before an investor asks for them.
Legal due diligence is the process by which an investor's counsel verifies that a company legally owns what it claims to own, is bound only by the obligations it has disclosed, and has no undisclosed legal risk — checked against incorporation records, contracts, IP filings, and litigation history.
How long does startup due diligence take in India?
For a well-prepared seed or Series A company, 1–3 weeks. For a company with disorganised records, it commonly stretches to 6–12 weeks, and in some cases longer, as gaps are discovered and cured one at a time instead of all at once.
Can an investor legally back out after signing a term sheet?
Yes, in most cases. Term sheets are typically non-binding on the investment decision itself (though confidentiality and exclusivity clauses within them are usually binding). A material adverse finding during diligence is the most common reason a signed term sheet doesn't convert to a closed round.
What documents are mandatory before a funding round closes?
At minimum: constitutional documents, an accurate and reconciled cap table, signed founder and employment agreements, IP assignment agreements for all contributors, current ROC and tax filings, and board resolutions authorising the round itself.
Should I prepare a data room before I start fundraising?
Yes. Building it in parallel with pitching — rather than after a term sheet arrives — is the single highest-leverage thing a founder can do to shorten diligence and avoid last-minute renegotiation.
What is an Investment Readiness Score?
An informal self-assessment across six pillars — corporate structure, ownership, contracts, compliance, governance, and operations — scored honestly to identify which gaps to close before an investor finds them.
Do I need a lawyer for due diligence, or can I self-prepare?
Founders can and should self-prepare the bulk of the data room — it's mostly organisation, not legal judgment. A lawyer becomes essential for reviewing IP assignment gaps, structuring convertible instruments, and negotiating any issue an investor flags as material.
What happens if I don't have signed IP assignment agreements?
The company may not have clean legal title to code, content, or designs built by contractors or early team members. This is one of the most common Critical-severity findings in Indian startup diligence and is often expensive to fix retroactively, since the original contributor now has negotiating leverage.
Is a missing POSH policy really a dealbreaker?
Rarely a dealbreaker on its own, but it's a fast, cheap fix that signals broader governance discipline — or its absence — so it gets flagged disproportionately to its cost of resolution. Any company with 10 or more workers (including contractors and interns) is legally required to have an Internal Committee.
What's the difference between legal, financial, and commercial due diligence?
Legal diligence checks ownership and contractual risk. Financial diligence verifies the numbers in your model against your books and bank statements. Commercial diligence tests whether your market and customer claims hold up under independent verification, often through reference calls.
How much does due diligence preparation cost founders?
Building a clean data room and closing basic compliance gaps at seed stage typically costs a small fraction of what a delayed or renegotiated round costs in lost time and valuation — most of the work is founder time plus targeted legal help for IP assignments and contract templates.
What's the single most common reason deals fail in diligence?
Discovery, not severity — an investor finding an issue the founder didn't disclose, rather than the issue itself. Most findings are survivable when flagged upfront with a resolution plan; the same finding, discovered independently, damages trust in everything else in the data room.
Do early-stage or bootstrapped startups need a data room before Seed?
A lightweight version, yes. Even angel investors increasingly ask for basic incorporation records, a cap table, and confirmation that IP is properly assigned. Starting the habit early is far cheaper than retrofitting three years of records before a Series A.
What if my cap table doesn't match my ROC filings?
This needs to be reconciled before diligence, not during it. Every allotment and transfer needs a corresponding board resolution and ROC filing (Form PAS-3 for allotments, Form SH-4-linked entries for transfers); gaps usually mean going back and filing corrective or condonation applications.
Due diligence isn't a test you cram for once a term sheet lands — it's a reflection of how the company has been run since day one. Founders who treat corporate hygiene as a routine habit, not a fundraising chore, walk into diligence with almost nothing to explain. Everyone else spends the weeks between the pitch and the close doing paperwork they could have done a year earlier, on much better terms.