POTENTIAThe Potentia Blog
Notes on GDPR-compliant founder diligence, the Growth Readiness Score methodology, and practical guidance for investors, accelerators, and recruiters who'd rather ask than scrape.
Due diligence for recruiters: same problem, different subject
Checking a senior hire before an offer shares almost everything with checking a founder before a check — including the consent question.
How to read a Growth Readiness Score without over-indexing on one number
A 41 and a 74 both come with ten sub-scores behind them. The single number is a starting point, not the whole answer.
The real cost of skipping diligence on a co-founder
The bring-on-a-co-founder decision gets less scrutiny than the fundraise it's meant to support — and it shouldn't.
Building trust with founders: consent as a competitive advantage, not friction
Every extra step in a process is usually framed as friction. Consent is one of the rare steps that builds trust instead of costing it.
Free badge vs. full report: the difference that actually matters
Both are real, consent-based data. The difference is who they're built for and how much detail comes back.
What a Public Footprint Check can and can't tell you
A free, no-consent-required search-based check has real limits — and being upfront about them is part of using it well.
Accelerator diligence at scale: checking a whole cohort without losing the plot
Twenty founders admitted in one batch is twenty separate diligence problems, usually handled with far less rigor than one.
The angel investor's dilemma: too many founders, not enough hours
The math of angel investing rarely allows deep diligence on every founder in the pipeline — until the check itself gets faster.
Reading a pitch deck like a diligence engine does
The same slide can be read for its story, or read for what it quietly reveals about the team behind it.
Semantic Entropy: when a pitch stops telling one story
Is the current pitch tightly focused, or scattered across unrelated themes stitched together after the fact?
What "requisite variety" means for a founding team — and why it predicts survival
A team's mix of backgrounds either matches the range of problems the business will face, or it doesn't.
Founder-Market Fit: the sub-score most diligence checklists miss
Does the founder's demonstrated technical work actually match the business described in their pitch?
Operational Debt: the three-symptom test for a fragile founding team
Irreplaceable people, growth without margin, and CEO bottlenecks — three specific patterns that predict strain before it shows up in the numbers.
Why we score Narrative Consistency — and what it actually catches
A story that quietly changes every few months is a specific, checkable pattern — not just a feeling.
The Growth Readiness Score, explained: ten factors, one number
A single score is only useful if you know exactly what's underneath it. Here's what goes into a GRS.
Three questions to ask any due-diligence tool before you trust its output
Not every scoring system is built the same way underneath. A few direct questions surface the difference fast.
What happens to the data after the check? The retention question most funds skip
Collecting the data with a lawful basis is only step one. What happens to it afterward is its own separate obligation.
Building a due-diligence process your portfolio founders would thank you for
A slightly unusual test for whether a diligence process is well-designed: would the subject approve of how it was run?
Cross-border diligence: GDPR doesn't stop at the EU's border
A US fund checking a founder based in Berlin is still subject to GDPR for that specific processing.
A founder's right to know: what Article 15 means for your diligence process
GDPR gives data subjects the right to ask what's been collected about them, and get a copy of it.
Why "everyone does OSINT anyway" isn't a legal defense
Common practice and lawful practice aren't the same thing, and regulators have made that distinction before.
Data minimization in due diligence: checking less, learning more
GDPR's minimization principle isn't just a compliance checkbox — it's often a better diligence process too.
How to explain a consent-based check to a founder without sounding suspicious
Framing matters. Sent well, a consent request reads as respect. Sent badly, it reads as an accusation.
GDPR fines aren't the only risk of unconsented profiling
The regulatory penalty is the headline. The founder-relationship damage is the part that actually shows up first.
The hidden liability of scraping a founder's social graph
Checking a founder often means touching data about people who never applied to your fund at all.
What a "legitimate interest" argument really covers — and where it stops
It's the most commonly cited GDPR basis for informal diligence, and the most commonly misapplied.
Consent-based diligence, explained in one sentence
The subject agrees to the check, connects their own accounts, and can see and revoke what was shared. That's the entire model.
Five OSINT habits that quietly break GDPR
None of these look like a compliance problem in the moment. Stacked together across a portfolio, they usually are one.
What Article 6 GDPR actually requires before you profile a founder
Six lawful bases exist for processing personal data. Most informal due-diligence workflows don't clearly rely on any of them.
Why "public" isn't the same as "consented"
A LinkedIn profile being visible to anyone doesn't mean its owner agreed to be profiled, scored, and filed away by a stranger doing diligence.