Fractional CTO for non-tech founders
Is your app safeto keep building on?
Your product was built by an agency, contractors or AI tools. It works, and people use it. Now a round, an audit or a big customer is coming, and someone will read your code with no reason to be kind. I read it first. Then I tell you in plain English what is safe, what must be fixed, and whether a fix or a rebuild is cheaper.
18 years
In software
3 startups
From zero to production
SOC 2 + HIPAA
Audits passed on a platform I led
2 weeks
Fixed-price review
Sound familiar?
There is nobody independent to ask. The people who could tell you the truth either built the product or want to sell you the next one. So you carry it alone, accountable for a system you cannot inspect.
Features that took hours now take days.
A fix in one place breaks something else.
The vendor says “we need two more devs”, and you cannot check if that is true.
Customers complain about bugs and downtime.
You are not sure who can see whose data.
A round, an audit or a security questionnaire has a date on it.
Four stages, one at a time
You decide on the next stage only when the last one is done.
Risk Assessment Call
Free
30 minutes
We go through who built the product, what must happen in the next 90 days, and what breaks today. An honest answer on whether a review is worth your money now, including “no, not yet”.
- Your 3 biggest risks, in writing, after the call
- No preparation needed
Production Readiness Review
$4,000
Fixed price, 2 weeks, read-only
I read your code, infrastructure and data the way an investor’s technical adviser will. Then the verdict: is it safe to keep building on, what must be fixed before real users and due diligence, and is a fix or a rebuild cheaper? Anything critical, like an exposed key, you hear about the day I find it.
- Report: findings rated by business impact, with evidence and a fix estimate
- Harden-or-rebuild verdict, with the cost of each path
- Hardening roadmap your team can execute
- One-page investor summary
- 60-minute walkthrough
Harden & Take Live
From $12,000
Per milestone, fixed price, 4‑8 weeks
If the roadmap needs a senior owner, I lead the fixes in order of risk. Your stack stays. Staging before production, rollback built in, everything in your accounts. You approve each milestone before the next starts.
- Each milestone tested against its acceptance test
- Handover docs, so a new developer can run it without me
Retained CTO
From $5,000/mo
One day a week, or two
When the product is live and stable, I stay as the person who owns the technical decisions.
- Weekly decision call with a written log
- Vendor work checked against scope before every payment
- Investor and auditor questions answered with you
- Offered after a delivered Review, never at first contact
What the Review checks
The same list an investor's technical adviser or an auditor works from.
Access control
Who can see and change whose data.
Secrets and API keys
What is exposed in the code or the browser.
Tenant isolation
Every customer's data walled off from every other.
Data integrity
Whether the numbers can be trusted.
Backups and rollback
What happens on the worst day.
What the AI-generated parts hide
Duplicated logic, fixes of symptoms instead of causes, missing tests.
Compliance gaps
SOC 2, HIPAA or GDPR, where they apply to you.
What the Review is not
- No code written during the Review
- Not a penetration test
- Not a certification
- Not a blame report. It names no people and is written to help your team ship.
Why it matters nowBroken access control is number one in the OWASP Top 10:2025. Every application in OWASP's data had some form of it. In Veracode's 2025 tests of more than 100 AI models, 45% of the code samples had a security flaw from the OWASP Top 10. The models got better at writing code that runs. They did not get better at writing code that is safe.
Three products I took to production
Each one taught me something I now check in products other people built.
- Passed SOC 2 and HIPAA audits
- 5 years, no rewrite
- Per-agency data isolation
- 5 AI features
Insurance CRM that passed SOC 2 and HIPAA audits
The client was replacing its old system with a CRM and sales platform for US life-insurance agencies. It holds personal and health data. Every agency got its own database, logins and web address, so no agency's data sits in a shared table. Security was built in from the first release, not added before the audit: encryption, a web firewall, secure key storage, a log of every data change, daily backups, and a release gate that blocks known critical flaws. Agents run the whole sale in one place, and customers can buy a policy online without an agent. I was lead architect in a team of five, through Rendered Source, for five years.
I have been through SOC 2 and HIPAA audits on a live platform. In a Review, I check your product against the same controls those auditors checked.
- 10+ external APIs integrated
- 6 web applications built
- MVP in 6 months, change of direction included
- Instant quotes from local price data
Car repair marketplace that stayed fast when suppliers were slow
YEZ is an online marketplace for car repair. Car owners pick the job, get a price for parts and labour, and book a slot at a partner repair shop. As CTO, I started with no team and no product. I hired four engineers and a designer, and we built 6 web apps on one shared core. The hard part was prices. They came from outside suppliers whose systems were slow and limited how often we could call them. So we copied supplier prices into our own database in the background. A customer's quote never waited on a supplier, and a slow supplier could not take the product down.
A product that depends on other companies' systems can pass every demo and still fail with real users. In a Review, I check what happens to your product when those systems are slow or down.
- MVP in 3 months
- Full platform in about a year
- Stays and tours on one platform
- Team of 2 developers
Hotel booking platform, MVP in 3 months for a funding round
Ecoplaces is a booking platform for country hotels and resorts. As CTO, I started with no product, a budget for two developers, and a funding round that depended on a working product. I chose the stack, hired two developers and built with them. The guest booking site and the admin back office share one core, so both run on the same data and rules. The pricing engine handles real hotel pricing: seasons, weekdays, extra guests, discounts and cancellation rules. Hotel owners confirm bookings from a secure email link, with nothing to install.
Most products I review were built fast on a small budget, like this one. I know which shortcuts are safe to keep and which must be fixed before a bigger test, because I took them myself.
What clients say
In their own words.
“Michael is in the top 1% of any architect we have worked with. ... He is a leader with good judgement, highly technical, very kind and as honest as they come.”
“Very stress-resistant, always even-tempered, responsive - perfect fit for a rapidly evolving and uncertain startup environment. Would highly recommend Michael for every team trying to tackle difficult and challenging task. He is a real pro.”
Why I do this
Fractional CTO. Founder of Softwisery.
Where I have done this
I work remotely with founders in the US, the UK and Europe.
I'm Michael. 18 years in software, three startups from zero to production. I started as a developer, then ran the teams that wrote the code. I learned three things the hard way:
- 1Products rarely fail at launch. They fail at the first audit, the first big customer or the first raise.
- 2“We need two more devs” is almost never the answer, and the founder has no way to check.
- 3Nobody who built the product, or wants to rebuild it, should be its judge.
The audit, the big customer and the raise are the moments I work for. At that point most founders do not need a full-time CTO, and cannot yet pay for one. They need one senior person on their side for those moments: a fixed-price review, or one or two days a week.
I use AI coding tools in my own work every day, the same kind of tools that built many of the products I review. So I know what they do well and what they hide. I work through Softwisery, my consulting company.
What you get
- A straight answer in plain English, in writing
- Technical decisions off your desk
- Every vendor estimate checked before you pay
- Nothing locked to me: documented so an in-house CTO can take over
Questions founders ask
Before the first call. Not on the list? Ask it on the call.
Maybe. AI tools are good at code that runs, and weak at code that is safe. The usual gaps are access control, exposed keys, customer data that is not walled off, and no way back after a bad release. The Review tells you which of these you have, and what each fix costs.
Only if a rebuild is cheaper, and the report shows the cost of both paths so you can check. The verdict is written down with evidence, not opinion.
The Review checks the same list the investor's adviser or the auditor uses. You go into that meeting with an answer you can show, not one you hope is true. Nobody can honestly guarantee the outcome of a round, and I will not.
Then the report says so. That is worth the fee on its own. It is the only version of “fine” you can show an investor.
If a customer contract requires it, yes. The Review does not replace it. But SOC 2 checks the process, not the architecture. A badge on a system that leaks data between customers is the same problem at a higher price. With a Review first, the SOC 2 auditor checks controls that already work, not gaps you find during the audit.
I can lead the fixes, and I say so up front. Two things keep the verdict honest. The Review fee is not credited against any later work, so no discount pulls the answer one way. And the roadmap is written so your team, a new team or I can do the work. If a fix is cheaper than a rebuild, the report says so.
The report names no people and assigns no blame. It lists fixes in order, each with a scope and an estimate, so your developers can start the next day. Your team keeps shipping during the Review.
Read-only access to the code, the cloud account and the database, from a one-page checklist. No code or data leaves your accounts. The code, the IP and the report are yours. You remove my access when the Review ends.
You do not need to. The Review is read-only and runs next to your team. If your deadline falls inside the two weeks, the fixes that matter for that date come first.
Some of them are good, and for a small app one may be enough. Before you choose, ask three things. Who reads the code, and have they led a product through an audit themselves? Do you get a fix-or-rebuild verdict with the cost of each path? Is there a summary you can send to an investor as it is? The Review gives you all three.
Yes. I review the spec and the vendor proposals instead of the code: what is fair, what is padded, what is missing, and the contract terms that keep the code and IP yours.
Is a deadlinecoming?
A round, an audit, a big customer, a vendor contract. Book a 30‑minute Risk Assessment Call. We go through who built your product, what must be ready before that date, and what breaks today.
Free. No preparation. You leave with your 3 biggest risks in writing, and an honest answer on whether a review is worth it now.