How to have an application checked by a 3rd party

A friend is selling a web based application and the acquirer wants to know what they are getting. The problem is how to show the working without giving away the ip. I know you can do this contractually BUT who does this kind of thing in Chicago? I am pretty sure the acquirer has most of the large law firms on retainer so they are out.