"We want to invest €80,000 in the launch campaign for this new app, and we need to be sure the product can onboard 1,000 new users per day.", This is a common message from startup investors.
This is Carlos Salgado, technology and cybersecurity auditor. Investors and partners ask: "Can you look at this company and tell us if they are genuinely ready to go to production?" It is a fascinating job, because it lets you see and share the passion of entrepreneurs, their ideas, that fire burning inside them, desperate to reach the world.
Startups tend to focus on the product, on the MVP, and generally neglect scalability. There is a false belief that design is a "luxury" for when there is budget. The reality is that poor design is one of the fastest ways to burn cash, lose users and put the entire project at risk.
1. Flawed database design
Many teams design for the moment, not for integrity. Unnormalised tables, no indexes, poorly defined relationships. That is not a minor performance issue, it is a time bomb that explodes when data grows.
2. Poor logging
Two common scenarios: (1) Logs expose sensitive information (passwords, tokens, personal data in plain text). This violates data protection laws and can generate fines of millions of euros. (2) Logs are so generic that when an incident occurs they offer no traceability. You lose control and may be violating data protection laws while exposing yourself to million-euro fines.
3. Concentrated knowledge
When the architecture design lives exclusively in one person's head and there is no technical documentation, the startup has an existential risk. If that person leaves or falls ill, the system becomes a black box impossible to manage.
4. Poor monitoring (flying blind)
Designing a product without telemetry is like flying a plane without an instrument panel. If you find out your system is down because a customer tweets at you, your operations design has failed.
5. Lack of "Security by Design"
If security is added at the end as a "patch", the design has failed. Authentication flows and sensitive data handling must be integrated into the user experience organically, not as a last-minute obstacle.
6. Untested contingency plans
Having backups that have never been tested in a real restore, or that are stored on the same production server, is not contingency design. It is an illusion of security. And as an auditor, I see it constantly.
7. Neglected administration panels
Most of the budget goes to the public-facing product and little to the internal tool. A poorly designed admin panel enables catastrophic human errors, such as accidental database deletion or information leaks due to lack of visual hierarchy.
8. Excessive client-side dependency
Designing interfaces that handle critical business logic in the user's browser. As an auditor, this is the first thing I look for: if the interface allows bypassing validations that should happen server-side, the design is a security hole.
9. Silos between product design and infrastructure
Designing interfaces that require constant, heavy API calls without considering latency or compute cost. System resources cannot be exhausted during peak hours.
10. The technology "Frankenstein" (too many plugins and an inconsistent stack)
This is the tendency to solve every small problem by adding a plugin, an external library or a new database just because it is trendy. Every tool adds a potentially obsolete dependency, a security risk and operational complexity. A robust design is usually minimalist, if you can solve it with your own clean code, do not introduce a third-party black box that might lose support tomorrow.
Bonus track
Design is not the wrapping on the gift, it is the gift itself. In a startup, good design is your most cost-effective competitive advantage if it is done right from the start.
Lately people ask about including AI in startups. For me, it is like someone saying: "I have brought a family to live in my house, what do I need to do to make it work well?" Well, it depends on so many factors that it is impossible to give a generic answer. Still, happy to help in each specific case. Contact me if you have a particular question.
Please do not expose your project to premature death due to bottlenecks, security failures or regulatory non-compliance. Prevention is far more cost-effective.
Free Technology Audit
Is your startup ready to scale?
In 60 minutes we audit your technology stack, architecture and security. We show you the real risks and a concrete action plan to resolve them before it is too late.
Request Free Audit →Your team needs secure AI training
The EU AI Act requires AI literacy for all staff from August 2026. Our courses cover compliance, AI agents and governance. FUNDAE can subsidise 100% of the cost.
