How an AI due diligence tool should verify a company

Short answer: a due diligence tool should only mark a claim verified when it can show two things. The record it found, and what ties that record to this specific company: a company registration number, an LEI, an SEC filing number, a domain the company controls. A name that matches is a lead. It should never be shown as proof.

That sounds obvious. We still shipped the same bug four times in three weeks.

Four bugs, one mistake

Aventro checks what a founder claims against the records it should appear in: company registers, the global LEI index, SEC EDGAR, patent offices. Here's what went wrong.

The company called "Other". Our intake asks for the legal entity type: Ltd, LLC, C-Corp or Other. One check read that field as the company's registered name. So for an Israeli startup that picked "Other", we asked the UK register for a company called Other. Companies House found a real business, OTHER LIMITED, and our check came back green.

The near miss. Registers list a company's legal name, and that's often different from its brand. Searching "Monzo" can't exactly match "MONZO BANK LIMITED". In the first live run an unrelated MONZORO LTD came back instead, and we reported it as verified.

The Israeli registrar had the same gap.

The stranger's repository. On a run for a company called Aventro AI, the GitHub check found someone else's repository named Aventro-AI, with zero stars, and reported the company's code as verified.

Each time we fixed it where we found it, and each time it came back somewhere else. The fix lived in one integration. The mistake lived in how we thought about verification.

Authority and identity are different questions

We'd been treating a trustworthy source as a trustworthy match. GitHub is the authority on which repositories exist. It has no opinion on who owns one. Companies House is the authority on UK companies, and it will gladly tell you about OTHER LIMITED. An official source tells you the record is real. It doesn't tell you the record is the company you're looking at.

So every check has to answer two questions:

1. Which source wins? An official register outranks a commercial aggregator, which outranks the open web.
2. Is this the same company? What, specifically, ties this record to it?

I think most tools answer the first and quietly assume the second.

What we changed

Every source now has to declare what it matched on. A registration number, an LEI or an SEC CIK identifies the company itself. A clinical trial, an FDA clearance or a government award identifies a record, and it only counts when an official body recorded the company's name on it, as the trial's sponsor or the award's recipient. A name someone typed into a repository title never counts.

A name match on its own is shown as a lead. The analyst sees that a UK company with this name exists, unconfirmed, and decides. Nobody gets a green tick it didn't earn.

We also made the mistake hard to repeat. In our code, a result can't be marked verified unless it carries the match that justifies it, and the compiler enforces that. Team convention drifted four times. The compiler doesn't.

The confidence score changed meaning too. It used to mix how strong a signal was with how sure we were of the match, so a weak result and a strong one could wear the same badge. Now it means one thing: how sure we are that this record belongs to this company.

Questions to ask any diligence tool

If you're choosing a due diligence tool, pick one claim it marked verified and ask:

• What record did you find?
• What tied it to this company, beyond the name?
• What do you show when only the name matched?
• Can I see the claims you couldn't check?

If the answer to the second one is "the name", the green ticks are guesses.

For the routine to run by hand, here's how to verify a startup's claims before investing. Every source Aventro checks, and how much each one counts, is on our verification page.