Baklyset Due Diligence · For M&A counsel and acquisition teams
Baklyset Due Diligence is a passive, external review of the company you are about to buy: what a counterparty can see from the outside, and what is not in the data room. The review never connects to the company's servers; everything is drawn from public sources and third parties. Within 24 hours you have the findings ranked by what they mean for the deal, questions for the seller and a report for the data room.
Why
Before signing, a buyer wants to know what the outside world can see of the company it is buying: the domains it operates, the mail that can be spoofed in its name, the certificates it has let lapse, staff credentials circulating in criminal logs, the incident the local press covered two years ago.
Every finding is tiered by what it means for the deal, not by technical urgency, and carries a number that is the same in the report, the question list and the exhibit to the purchase agreement.
The questions go to the seller in Excel. The answers are uploaded and assessed against the findings, round by round, and a new run before closing shows what has gone and what remains.
The whole run as data, with a checksum that is also printed in the report and a manifest signed by your instance. The report states what it does not show, including when a source did not respond.
What is reviewed
Matters that may affect whether, or on what terms, the deal should proceed. Numbered PC-1 PC-2 and so on, so they can be cited in negotiations.
Basis for warranties, any price adjustment and the 100-day plan. Each matter carries its warranty topic: e-mail security, domain names, security incidents and data protection, IT systems and vulnerabilities, operations and continuity.
What should be known but should not drive the negotiation. All of it with source and timestamp. The tiering follows rules a lawyer can defend: an expiring domain goes under "before signing" only when it is confirmed to be in use, and a reported incident only when it is dated, recent and assessed with confidence.
In the transaction
Organisation number, code name, purpose and language. The scope is proposed from the company register; you confirm it and include or exclude group companies.
The review waits for the certificate logs, for at most 20 hours, then examines the names. Whoever started it receives an e-mail when it is done, with the code name and a link, never the company's name.
PDF and Word in the case's language, English or Norwegian. The question list in Excel goes to the seller.
Upload the completed list. Each answer is assessed against the findings, first by rule and then by AI for free-text answers, round by round.
A new run before closing is compared with the baseline you choose, such as signing. SPA exhibit and data-room bundle.
Deliverables
An A4 report with the code name and the follow-up priority on the cover, a summary with key figures and a matrix of matters by area, the findings as cards with questions for the seller, public mentions, e-mail security per domain, leaks, suppliers with the share established in the US, indexed services, the plan, the scope, the method and what the review does not show. The same report in Word, editable.
Every finding carries neutral questions for the seller. The list is downloaded as Excel, with warranty topic, detail, data and source. The completed list is uploaded again: each answer is compared with the findings, and the list comes back assessed. Open questions, those unanswered or contradicted while the finding is still seen, are carried into the reports.
New, no longer seen and still seen since signing, matched with the seller's latest answer: "seller said fixed, the run still sees it". With leak counts then and now, the open questions and the run's gaps. A reminder goes to the case's members a week before the closing date you set.
One page for a schedule to the SPA: the before-signing and price-and-terms matters, PC numbers first, each with warranty topic, tier and one line of basis, plus one line stating the run date, the case and the checksum. No method prose. PDF and Word.
The whole run as data, with the time each source was queried. The checksum (SHA-256) is printed in the report, and the manifest is signed (Ed25519) by your instance; the key's fingerprint is printed in the report's method section. The signature protects the pack's integrity, not the truth of the third-party data in it. The data-room bundle gathers report, question list, evidence and closing update in one zip with a signed index.
Up to eight cases in one comparison, on screen and as a landscape PDF: scope and gaps, risk and matters per tier, e-mail security per protocol, the US share of suppliers, known breaches and infected machines. With a warning when the scopes differ too much to be comparable.
Each finding is marked with the point of NIS2 Article 21(2) it provides evidence towards, and the report indicates, from industry codes and employee count, whether the company is likely to fall within the scope of the Norwegian NIS2 act. An indication, marked "to be confirmed by counsel", that states what it did not consider.
The cover and every e-mail refer to the case by its code name. A case is visible only to its members and the instance's administrators; to anyone else it does not exist. Every grant of access is logged, and the log is visible to administrators only.
The list of what the review does not show is part of the deliverable: that every domain has been found, that third-party data is accurate, and what only documents, interviews and a technical review with the company's consent can answer. A run that could not complete says so in the method section, as a gap.
IT audit
For external auditors and internal audit. With the purpose "IT audit", the same passive review adds a section on IT general controls, an Excel workpaper and an action plan for the client, laid out for the audit file.
Access to programs and data, program changes, computer operations and service organisations (ISA 402). Each check belongs to one area, or to "not an ITGC area", with a short rationale next to the finding. An empty area reads "no indication from outside", never a pass.
Each row states whether the matter was observed in public DNS, reported by a third party, or inferred and in need of confirmation, with source, source date and an evidence reference into the signed evidence pack.
Cover sheet with client, scope, method, the caveat, the run's SHA-256 and the signing key's fingerprint. One row per finding per name: reference, area, observation, basis, source, tier and evidence reference, and a sheet of service organisations. Relevance, work performed and conclusion are the auditor's own columns. Text only, no formulas.
Relevant to the understanding of the IT environment and the risk assessment under ISA 315 (revised); not a test of the design, implementation or operating effectiveness of any control (ISA 330), and not an assurance engagement under ISAE 3000 or 3402. The auditor judges relevance and reliability as audit evidence. An extended collection, in which the websites are visited as an ordinary visitor would, exists only here and only with the audited company's agreement; still no port scan and no path checks.
The demonstration case "Losen" shows an IT audit in Norwegian, with report, workpaper and evidence pack. Ask to see it.
Supplier follow-up
For whoever is responsible for the supply chain under NIS2 Article 21(2)(d) and DORA. The same review of each supplier, with tiers and a plan geared to a contract: resolve before contracting, should be governed by the contract, other observations.
The list is uploaded as CSV or Excel with organisation numbers. Each number is validated and looked up in the Norwegian company register, and each supplier gets a case of its own. Only what the company itself has registered, its website and e-mail domain, is confirmed without human review; everything else is proposed for review. The portfolio page shows priority, matters per tier, the last run and the next, and can be downloaded as Excel.
A supplier case lasts 400 days by default and is run again after a year, so the case outlives the annual re-run. The report lists what is new, fixed, no longer observed and still seen since the previous run, and whether the scope has changed.
Scope and gaps, priority and matters per tier, e-mail security per protocol, the share of the supplier's own providers established in the US, known breaches and infected machines, on screen and as a landscape PDF. With a warning when the scopes differ too much to be comparable.
Every finding carries neutral questions for the supplier, in Excel; the answers are uploaded and assessed against the findings. The plan sets out the contract requirements: what to resolve before the contract is signed or renewed, and what belongs in the contract or the data processing agreement.
The demonstration case "Havbris" shows a supplier assessment in English. The continuous monitoring of key suppliers, day by day and with news about them, is part of Baklyset Assurance.
How we work
No web requests, no TLS handshakes, no port scans, no path checks, no guessed host names. Certificates are read from public logs, ports from Shodan's index and DNS from public resolvers, which may query the company's nameservers on a cache miss, as they do for any browser. That is the one place where a trace cannot be ruled out entirely. Active checks do not exist in an acquisition or supplier case; there is nothing to switch on by mistake.
The report describes what public sources showed at the times stated. It is not legal advice, not a penetration test, not a vulnerability scan and not confirmatory due diligence. It is produced automatically on the customer's instruction, without manual review, is for the customer's use only, and says so on its cover. Nobody at Baklyset forms a view on the case.
The case is stored on Baklyset's server in Norway. Every customer has its own instance, separate from all other customers, and the case is visible only to its members and administrators. Search and assessment use Brave Search and Anthropic (Claude) in the US: Brave receives the company's name with the search terms and its organisation number; Claude receives the search results, the company's register data and domains, the names of the group companies you have included, the findings and the seller's answers when you upload them. Neither learns who the customer is. The other sources receive only domain names, IP addresses or the registered name. The data processing agreement and its Due Diligence addendum describe this.
Each case has an end date, 90 days by default for an acquisition and at most two years ahead, which you can change. On that date the case, its scope, its runs and the seller's answers are deleted, and the log records it. An administrator can delete a case at any time. The billing record that remains shows only the case's code name, never the company's name.
The sentences about public mentions name no one. Breach data consists of counts only. What remains is what public DNS and registries publish themselves, such as a registrant or a DMARC reporting address. A sole proprietorship is not searched for public mentions, since its name is the owner's.
The checks come from the external security audits Baklyset has carried out, and run here in passive mode: whatever only a connection could reveal is marked as not assessed rather than guessed.
Questions and answers
Not from us directly: nothing is sent to its servers. The caveat is DNS. A public resolver without a cached answer queries the company's nameservers, as it does for every browser and mail server in the world, and the queries are the ordinary ones. The review does not stand out from ordinary traffic, but we cannot guarantee that it is invisible.
No. It is the external view: what public sources and indexes show. Ports and software come from a public index and are questions to put to the seller, not confirmed findings. A technical review with the company's consent belongs in confirmatory due diligence, and the report says so.
No. It is an indication from industry codes and employee count, marked "to be confirmed by counsel", and the report lists what it did not consider: turnover, balance sheet, group companies outside Norway, whether services are offered in Norway or the EEA, designation by an authority.
In Norway, on Baklyset's server. Every customer has its own instance, separate from all other customers. Every case uses two sub-processors in the US: Brave Search for search and Anthropic (Claude) for assessment. How we work states exactly what each receives. The data processing agreement, the Due Diligence addendum and a description of our security measures are available on request.
Yes. The demonstration case "Fjord" runs the product on Nordvik Gruppen AS, a fictional group with domains under .example, with two runs to compare, the report in Norwegian, the question list, the exhibit and the bundle. The case "Havbris" shows a supplier assessment in English, and "Losen" an IT audit. Get in touch and we will show you.
Get in touch and we will work it out together. Usage is metered per case, by code name, never by the company's name.
You get your own instance and run the cases yourselves, directly from Baklyset or through a partner. Get in touch and we will show you the demonstration case and how a case is set up. No access required, nothing to install, and no contact with the target.
or write to post@baklyset.no
Law firms, audit firms, advisers and IT service providers can offer Baklyset Due Diligence as part of their own services. Write to post@baklyset.no if you would like to become a partner.
