In the first article in our technology governance series, we argued that boards need to apply the same investigative rigor to technology assets that they already apply to financial ones. We used JPMorgan Chase's acquisition of the student-aid startup Frank as the cautionary tale: the bank paid $175 million for a company whose founder had allegedly fabricated much of its claimed user base, and only discovered the problem after the deal closed and a marketing email to "users" produced almost no response.
We think any board can build real technology fluency, given the right framing, some grounding in how to evaluate technology teams and products, and a qualified outside advisor working alongside management.
From Fraud to Embellishment: Knowing What Technology Assets Are Actually Worth
The Frank story is well known by now: the company claimed over 4 million users, but JPMorgan alleged in its lawsuit that fewer than 300,000 were real. A basic spot-check of emails and phone numbers would likely have surfaced the problem before the deal closed. That case was outright fraud, but the far more common scenario is subtler: technology assets whose value is inflated or skewed without crossing into fraud, leading acquirers to significantly overpay.
One useful lens for evaluating the "digital truth" of an acquisition is digital exhaust — the trail of data real users leave behind as they interact with digital systems. This exhaust is hard to fake convincingly, and when read properly, it offers a strong signal of whether a digital business is as healthy and authentic as it claims to be. Where these questions get technical, boards should lean on outside experts who can read a "technology balance sheet" the same way audit and finance professionals parse a company's books.
Cloud Spend Data
Cloud providers generate detailed invoices that correlate closely with user volume and service intensity. A company claiming millions of active users but spending like a small beta test is a red flag; a sudden spending spike could mean a product going viral, or it could mean poor infrastructure decisions. Either way, the bills tell a story worth reading. Boards should ask for monthly infrastructure bills broken down by compute, storage, and bandwidth, along with trends over at least a year — the emerging discipline of FinOps exists specifically to normalize this kind of spend data across providers.
Traffic and Engagement Analytics
Tools like Google Analytics, Mixpanel, and Amplitude log visits, time on site, click paths, and conversion trends in ways that are difficult to convincingly fake over time, especially at claimed scale. Boards should ask to see live dashboards rather than exported screenshots, along with historical usage patterns and traffic-source and geographic breakdowns. If a company claims 4 million active users but its site gets 100,000 visits a month, the numbers don't add up — and the team presenting the data should be able to answer hard questions about it.
Third-Party Service Data (Email, Payments, and More)
Most companies run core functions — payments, messaging, authentication — through SaaS tools like Stripe, SendGrid, Mailchimp, or Auth0, all of which retain detailed activity logs. Boards should ask for usage and spend trends from these tools over time: list growth, campaign performance, payment volume history. These external logs are hard to manipulate and often give a clean read on real business momentum.
Customer Support Tickets and Interaction Logs
Real users generate real support volume — questions, bug reports, feature requests, through email, chat, or ticketing systems like Zendesk or Intercom. A platform claiming millions of users should be fielding hundreds of tickets a week, not a few dozen a month. Boards should ask to review support dashboards and representative ticket volume and category breakdowns over time.
Building More Tech-Savvy Boards for Proper Governance
For large companies, and for private equity firms, major acquisitions typically require board approval, and directors are expected to understand the material risks involved — technology risk included. For most boards, that means bringing in outside technical help to analyze and monitor execution, not just at the pre-acquisition stage but on an ongoing basis. Technology health, like financial health, needs continuous monitoring by qualified experts, not a one-time sign-off against a generic checklist.
Even non-technical board members should be comfortable asking: How do we know it works? Where's the evidence that users are real and engaged? Have we seen unedited, direct-sourced data from core systems, not curated summaries? Have we verified the tech stack is consistent with the claimed scale?
Boards don't need to become technologists themselves, but they do need to ensure independent technical diligence is performed, documented, and challenged — and to be conversant enough in concepts like digital exhaust to know what good diligence looks like. This matters most when the core assets being acquired are intangible: users, data, engagement, and code. Even for companies where technology is purely internal infrastructure rather than the product itself, digital exhaust can reveal how efficiently a company uses its technology and whether serious problems are hiding beneath the surface. No company today becomes a great company without mastering technology, and boards that elevate technology governance to the same level as financial and legal oversight will be better positioned to fulfill their fiduciary responsibilities.