Questions founders and investors should ask about architecture, security, ownership and operational risk.
Confirm ownership and access
Code, domains, cloud accounts and critical data should belong to the company, not an individual contractor. Administrator access and recovery methods need more than one responsible owner.
Examine the operating reality
Review incident history, deployment practices, backups, monitoring and key-person dependence. A modern architecture is not automatically a maintainable one.
Connect debt to the business plan
Technical debt becomes material when it slows sales, creates security exposure or prevents scale. Prioritize risks by consequence and timing instead of demanding a complete rebuild.