SaaS Due Diligence Checklist
Review SaaS revenue, retention, code, infrastructure, security, customers, support and transferability before acquisition.
Revenue And Retention
Verify subscriptions, churn, NRR, cohorts, discounts and failed payments.
Product And Code
Review architecture, repositories, technical debt, dependencies and deployment process.
Customers And Support
Understand concentration, support volume, SLAs and founder relationships.
Security And Access
Review credentials, data handling, incidents, backups and critical third-party services.
Create A Request List And Evidence Standard
Before reviewing documents, decide what counts as evidence. Prefer read-only access, exports from source systems, processor records, bank statements, contracts and repository access over isolated screenshots. Keep a request list with the claim being tested, the evidence received, the period covered, unresolved questions and who is responsible for the follow-up. This makes it harder for a persuasive narrative to outrun the underlying facts.
Reconcile Claims Across Systems
Strong diligence looks for agreement between independent records. Revenue shown in a storefront should broadly reconcile with payment processing and cash received after timing differences, fees, refunds and taxes. Traffic claims should match analytics and, where relevant, search or advertising platforms. Staffing and software costs should make sense relative to the operating process the seller describes. Mismatches are not automatically fraud, but they require an explanation before you price the deal.
Separate Fixable Problems From Thesis-Breaking Risks
Not every issue deserves the same response. Messy documentation may be fixable; unclear intellectual-property ownership, non-transferable core accounts, extreme customer concentration or a product that cannot be maintained without the founder can change the acquisition thesis. Classify findings as informational, price-adjusting, deal-structure issues, closing conditions or reasons to walk away. That classification turns diligence into a decision process instead of an endless checklist.
Document The Closing Conditions
Important diligence findings should not disappear when negotiations move to closing. Translate them into the transaction process: assets that must be delivered, consents that must be obtained, data that must remain true at closing, transition support, inspection periods and any holdback or contingent consideration. Deal-specific legal and tax terms should be reviewed by qualified professionals.
SaaS Metrics That Need Context
MRR and ARR are starting points, not proof of quality. Break recurring revenue into new, expansion, contraction and churn; inspect logo and revenue retention; review cohorts; identify annual prepayments; and calculate gross margin after hosting, third-party APIs and support. A small number of customers can make apparently stable ARR fragile, while strong expansion and low churn can make the same revenue level much more durable.
Product And Technical Transfer
Map repositories, deployment, cloud infrastructure, domains, databases, monitoring, billing, support systems and third-party services. Confirm who owns the code and whether contractors assigned intellectual-property rights. Review technical debt and security issues in proportion to the deal size. The practical question is whether a competent new owner or team can operate, deploy and support the product without undocumented founder knowledge.
Practical Review Record
| Area | Evidence To Request | Decision Question |
|---|---|---|
| Financial | Source reports, processors, bank records, monthly P&L | Can the earnings be reproduced? |
| Customers / Traffic | Analytics, cohorts, channel reports, customer concentration | How durable is demand? |
| Operations | SOPs, staffing, suppliers, software | Can the business run after the founder leaves? |
| Ownership / Tech | Contracts, IP, repositories, domains, account terms | Can the assets actually transfer? |
Retention And Efficiency Before Headline Arr
A serious SaaS review should reconstruct the recurring-revenue bridge and inspect churn, retention, pricing, discounts, gross margin, support burden and customer acquisition. Annual prepayments also create service obligations after closing. The buyer is acquiring a stream of customer relationships and operating commitments, not simply an ARR number.
How To Organize The Review
Create folders for financials, customers or traffic, operations, technology, legal and transfer. Keep a question log beside the documents so every unresolved item has an owner and status. Record where each important number came from. This is especially useful when several versions of a P&L, analytics export or customer report circulate during negotiations.
When To Escalate To Specialists
Bring in specialist help when the risk exceeds your ability to verify it. Examples include complex codebases, security or privacy exposure, regulated products, significant tax questions, intellectual-property uncertainty, unusual contracts or financial statements that require quality-of-earnings work. The cost of specialist review should be weighed against deal size and the consequence of getting the issue wrong.
What A Good Diligence Conclusion Looks Like
The output should not be a pile of documents. It should state which claims were verified, which remain uncertain, the material risks, the financial adjustments, the required closing conditions and whether the original investment case still holds. That conclusion gives the buyer a basis for proceeding, repricing, restructuring or stopping the deal.
Related Guides
Frequently Asked Questions
How should I use this guide in a real transaction?
Turn the relevant sections into a written request list and decision record. Focus most deeply on issues that could materially change value, transferability or post-close operations.
Should I rely on marketplace-provided information?
Use it as one layer of evidence. Understand what has and has not been verified, then request additional primary evidence for material claims.
When should I use professional advisers?
Use qualified legal, tax, financial, technical or security advisers when a material issue falls outside your ability to verify reliably or the consequence of an error is significant.