Someone else decides what your stack costs next year - Daniel Uusitalo, Impact investor

Guest post by Daniel Uusitalo, Investor at 4impact capital

‍

You are unlikely to be asked about your AWS bill on a first investor call. Later in the process, depending on your stage and the size of the ticket, the investor will likely commission an external technical due diligence. I have yet to see a techDD report that did not spell out dependency risks in plain language.

Most investors do not spend much time on this today. They probably should, and my bet is that it becomes an item of sharper focus. If your investor is a friendly one, you will receive a copy of the report, or at least a summary of the core findings. In principle, this is a surgical evaluation of your business that you do not have full oversight of. So two suggestions. First, request the full report: it is a rare outside-in view of a product you have likely gone somewhat snow blind to. Second, take the dependency section seriously, even if your investor never formally raises it with you.

The rest of this piece is the short version of how.

A dependency is a price you do not control

Every external service in your stack is a standing bet that its owner keeps behaving reasonably. Sometimes they do. Sometimes they do not.

When Broadcom took over VMware, AT&T told a court its renewal quote came in around 1,050 percent above what it had been paying. Advisory firms working those renewals reported increases of five to ten times as a normal outcome for some enterprise customers. That is the price shock founders usually wave off as hypothetical, except it already happened here, to a company with far more negotiating leverage than you will have as a seed-stage company.

Licences move too. Redis left BSD in March 2024, the Linux Foundation had Valkey running within weeks, and Redis moved to AGPLv3in 2025 once Valkey had already established itself. HashiCorp moved Terraform to the Business Source Licence in August 2023, which is pretty much the reason OpenTofu exists. The licence you adopted a component under is not a property of that component. It is the current position of a company with its own funding pressures and growth expectations.

Growth deepens the bet on its own: you will use these products more, not less. And the choices that matter about them are made in someone else’s boardroom.

None of this is an argument for building everything yourself. It is an argument for knowing, line by line, what you would actually do if a price or a term changed. Could you survive for 30 days if your core tech dependency doubled its prices? Quadrupled them?

The margin question is the one that moves valuations

This is where dependencies stop being an engineering topic and start being a financing one.

ICONIQ’s January 2026 State of AI snapshot, a survey of roughly 300 software executives, puts average gross margin for AI products at about 52 percent in2026, up from 41 percent in 2024. Bessemer’s 2025 work on a small sample of high-growth AI startups found the fastest-scaling cohort, those reaching $100M ARR in around 18 months, averaging roughly 25 percent gross margin, with the more capital-efficient group nearer60. Traditional SaaS sits between 75 and 85. Both are survey data rather than audited accounts, but the direction is what matters.

The mechanism matters more than the benchmark. Software multiples were built on a cost structure where serving the next customer costs almost nothing. Inference does not behave that way. It is a variable cost that scales with usage, so it does not dilute as you grow the way fixed infrastructure does. Ten times the customers means roughly ten times the inference bill, and the gross margin you have at €1M ARR is broadly the gross margin you will have at €10M unless you engineer it down.

That gap is structural but not necessarily permanent. The move from 41 to 52 percent in two years is real, driven by falling model prices and better engineering. But it is now a number you build rather than a property of the business model, and it absolutely gets priced into your round whether or not anyone raises it with you.

So know two figures: your cost to serve the median active customer per month, and your cost to serve the most expensive one. When a founder cannot answer, the problem is rarely the number itself. It is that nobody is taking full ownership of it.

The levers are well understood by talented developers and cheap to build in early with the right approach. Route most queries to small models and escalate only when the task needs it. Cache aggressively, since the major APIs now discount cached input heavily. Batch where latency allows. All of it is increasingly painful to retrofit in later funding rounds.

The compliance floor arrives on its own schedule

The EU Cyber Resilience Act entered into force on 10 December 2024. From 11 September 2026, manufacturers must report actively exploited vulnerabilities to their national CSIRT and ENISA, with a first warning inside 24 hours. Full obligations apply from 11 December 2027.

Browser-delivered SaaS is generally outside scope. If you ship anything installable or embedded, or a backend that a device needs in order to function, you are probably inside it. And if your customers are inside it, their procurement will push bill-of-materials and vulnerability-handling requirements into your contract regardless of your own scope. That is how supply chain regulation actually reaches small companies: through the customer, not the regulator.

Tooling for half of this inventory now exists as a category. CRACI in Helsinki, which raised a €1.4M pre-seed led by Lifeline Ventures in May 2026, generates a software bill of materials straight out of CI and keeps it current as releases ship. That is the component half: the open-source and transitive dependencies nobody on your team has read, and exactly what the CRA and your customers’ procurement will come asking about. The other half, what your cloud and API providers can do to your prices and terms, no tool generates for you. That inventory is yours to write, and writing it is the point of this piece.

The part almost nobody has priced in yet

The EU Data Act has applied since 12 September 2025, and from 12 January 2027 cloud providers may not charge for switching at all, including the egress involved in moving out. Google and AWS both introduced free-egress-on-exit programmes in early 2024 ahead of it. Charges for ongoing egress in parallel multi-cloud use are a separate matter and survive.

Which exposes what the lock-in always was. Not the exit invoice. Proprietary APIs, managed service behaviour you have quietly built assumptions around, and identity plumbing. None of that disappears on a compliance date. Sorting your dependencies into commodity, meaning compute, object storage and Postgres, and proprietary, meaning a queue with vendor-specific semantics, a serverless runtime, an identity provider, is most of the work, and it takes an afternoon.

The very short guide

1. One page.Every external dependency, its monthly cost, and one named owner.

2. Tag each one: replaceable in a week, in a quarter, or only by a rewrite.

3. Compute cost per unit of usage, not just total spend. Median customer and worst customer in your customer base.

4. Check the licences on your top twenty direct dependencies. Note which are source-available rather than open source.

5. Generate a software bill of materials from your build. It doubles as the answer to a diligence question you may not be getting yet, but should be.

The tension worth naming

Depending on other people is correct at the start. You should call an API instead of training a model. You should not run your own database at pre-seed. Hours spent on portability are hours not spent finding out whether anyone wants the thingyou’re building.

The famous repatriation numbers are real without being your plan. 37signals cut its cloud bill from about $3.2Ma year to roughly $1.3M and recouped around $700k of hardware inside a year. It is also a profitable company with predictable load and no growth uncertainty, which is close to the opposite of a company at seed. Read it as proof that the pricing spread is real, not as a migration roadmap.

The goal was never full independence, but visibility and control.

When a founder can tell me their cost to serve at ten times current volume without opening a spreadsheet, I do not learn much about their infrastructure. I learn how the company is run.