Short answer: what is SaaS due diligence?

SaaS due diligence is the buyer’s check that your software business is what they believe it is before they pay for it. Most of it happens after the letter of intent (LOI), when the buyer has made an offer and needs to prove it.

Buyers want to confirm three things:

  1. The revenue is real and durable.
  2. The product and operations can transfer to a new owner.
  3. The risks are understood and acceptable.

Nearly every request falls into six areas: financials, revenue and retention, product and code, legal and IP, sales and growth, and operations and handoff. The checklist below covers each one.

Good diligence does not need to be scary. It does need to be organized. The more prepared you are, the less likely a buyer is to lose confidence, cut the price late in the deal, or let the process drift.

When diligence happens, and how much to share

Diligence comes in stages. Before an LOI, buyers usually see high-level performance, the customer profile, the product and your goals for the sale. After an LOI, they ask for the detail: customer lists, contracts, code access, bank statements and payroll.

Protect that order. Before you share sensitive customer, code or financial detail, know the buyer’s acquisition criteria, how they will fund the deal, their timeline and who makes the decision. Deeper access should come only after an NDA is signed and the buyer has shown serious intent.

The SaaS due diligence checklist

Use these six sections to build your data room before you go to market, not after a buyer is waiting.

1. Financials a buyer can trace

Financial diligence verifies revenue, expenses, margins, cash flow and adjustments. Expect requests for:

  • Monthly profit and loss statements and balance sheets
  • Tax returns, bank statements and payment processor reports
  • Billing platform exports
  • Revenue by month, product, plan and customer segment
  • Hosting costs and other costs of delivering the product
  • Payroll, contractor and owner compensation records
  • Support for every owner add-back and one-time expense
  • How you recognize revenue, and deferred revenue if you sell annual plans
  • Refunds, credits, chargebacks and discounts

Buyers will compare your accounting records to your subscription data. If MRR in your dashboard does not tie to revenue in your books, reconcile it or be ready to explain why before a buyer does it for you.

2. Revenue, retention and customers

A SaaS buyer is buying customer behavior as much as software. Expect requests for:

  • A customer list with revenue by account, anonymized at first if needed
  • Top customer concentration
  • Contract terms, renewal dates and pricing history
  • Churn history, with how churn is defined and calculated
  • Gross and net revenue retention, and expansion revenue
  • Cohort analysis
  • Cancellation reasons, if you track them
  • Support volume and common issues

If a few customers drive a large share of revenue, prepare a deeper explanation of those relationships, including who owns them and whether they depend on you personally. A buyer can work with a known issue. A surprise is what damages trust.

3. Product, code and security

Technical diligence tests whether the software is stable, maintainable, secure and transferable. Expect questions about:

  • Architecture, hosting and infrastructure
  • Code repository access and who wrote the code
  • Deployment process and developer documentation
  • Third-party dependencies and licenses
  • Security practices, access controls and incident history
  • Backups and recovery
  • Known bugs and technical debt
  • The product roadmap

A buyer does not expect a small SaaS company to have enterprise-grade engineering. They do expect transparency, and enough documentation to run the product after closing. If the product depends heavily on you, say so and show how that knowledge will transfer.

Legal diligence confirms who owns what, and what the company owes. Expect requests for:

  • Entity documents and ownership records or a cap table
  • Customer and vendor contracts
  • Employee and contractor agreements
  • Intellectual property assignments
  • Terms of service, privacy policy and data processing agreements
  • Any disputes, claims or litigation
  • A list of assets included in the sale, and any excluded

One common problem: contractors built part of the product, but the company has no written assignment of that IP. Fix it before a buyer finds it. Another: the founder personally owns a domain, account or tool the business depends on.

5. Sales, marketing and growth

Buyers want to know how customers arrive and whether growth can continue without you. Expect requests for:

  • Lead sources and analytics access
  • CRM exports and pipeline reports
  • Paid acquisition performance
  • SEO, content, partner and affiliate performance
  • Conversion rates and pricing history

Founder-led sales get special scrutiny. If most new revenue depends on you, document the process and prepare a transition plan. Keep the growth story factual: tie each opportunity to real operating data, not a hopeful forecast.

6. Operations, team and handoff

This section answers a simple question: can someone else run the business next month? Expect requests for:

  • A team roster with roles, compensation and contractor status
  • Standard operating procedures for support, onboarding, billing and deployments
  • A vendor and tool list with owner, cost and renewal date
  • Key person dependencies
  • An access transfer plan for accounts, code and infrastructure

List what you still do personally, then sort it into three groups: work the team already handles, work that is documented but still yours, and work that lives only in your head. The last group is what worries buyers.

The request list buyers send

After the LOI, most buyers send a written diligence request list, sometimes as a letter, that maps to the six sections above. Answer every line, even if the answer is that a record does not exist. Add a short note wherever a buyer will have a question, such as why revenue dipped in one month or why churn rose after a price change.

Keep a request log with each request, who owns it, its status and the date you answered. It stops repeated asks, keeps your answers consistent, and shows you whether a buyer is moving toward closing or just widening the scope.

How to set up the data room

A clean data room makes diligence faster. Useful folders:

  • Financials
  • Customers and revenue
  • Product and technology
  • Legal and entity
  • Team and operations
  • Sales and marketing
  • Tax
  • Transition plan

Name files clearly, keep versions current, and do not upload reports that conflict without an explanation. Open each folder to a buyer only when they reach the stage that needs it.

What slows down or kills a SaaS deal

Most diligence problems are not one bad document. They are trust gaps: the buyer sees something inconsistent, unexplained or harder to transfer than expected, and the risk they price in goes up. Watch for these before you go to market:

  • MRR that does not match accounting revenue
  • Churn calculated differently in different reports
  • Customer contracts that are missing or unsigned
  • Contractors who never assigned their IP
  • The founder personally owning key assets
  • Incomplete analytics access
  • A support load higher than you described
  • Undocumented security practices
  • Customer concentration with no explanation
  • A roadmap that depends entirely on the founder
  • Slow answers that make the business look disorganized

Most of these can be fixed or explained. The problem is a buyer discovering them late. For more of the risks that derail a sale, see 8 Deal Killers for Your Sell-Side Transaction and red flags in due diligence.

How to avoid a retrade

A retrade is when a buyer changes the price or terms after diligence. Sometimes it is justified, and sometimes it is a negotiating tactic. Either way, preparation is the defense:

  • Give accurate numbers from the start, and never overstate them
  • Disclose known risks early
  • Support every add-back
  • Explain churn and concentration before you are asked
  • Keep the business performing while diligence runs
  • Answer quickly and consistently

Having more than one serious buyer helps too. A buyer who knows others are interested has less room to reopen the price.

How long SaaS due diligence takes

A small, well-prepared SaaS deal can move through diligence in a few weeks. It takes longer when the buyer needs financing, when legal or technical issues come up, or when customer concentration needs explaining. Preparation, the buyer’s experience and how quickly both sides respond decide most of the timeline. Set a process calendar so everyone knows when calls, answers and closing steps are due.

A one-week readiness sprint

If a sale is on your horizon, a focused week before you talk to buyers closes most of the gaps:

  1. Create the data room folders above.
  2. Reconcile revenue across your accounting, payment processor and bank records.
  3. Export customer, churn, retention and support data.
  4. Document the product, infrastructure, deployments and known technical risks.
  5. List every contract, vendor, tool and contractor, and what transfers.
  6. Write short notes on the questions a buyer will obviously ask.
  7. Review the package as a buyer would, and mark the five biggest gaps.

Preparing Your Business for Sale: A Checklist and How to Prepare Your Business for Sale cover the wider preparation, and the 10 Exit Factors show which areas move buyer confidence most.

When an advisor helps

You can prepare most of the data room yourself. An advisor earns their place in running the process: qualifying buyers before they see sensitive detail, keeping several buyers moving at once, answering request lists consistently, and pushing back when a buyer tries to retrade. Hello Exit is the team behind 1,000+ acquisitions and exits, and it works with founders selling businesses from $1 million to $400 million. How it works walks through the process from the first confidential call to closing.

Before you go to market, SaaS Valuation and Key SaaS Metrics You Must Know help you prepare the story buyers will test, and the Offer Evaluator compares a headline price against its terms. For the tax side, see the tax implications of buying or selling a business and raise the questions with your CPA or tax attorney before you sign.

Common questions

What is due diligence for a SaaS company?

It is the buyer’s review of a SaaS business before closing: revenue quality, retention, customer concentration, contracts, the product and codebase, security, legal ownership, the team and transition risk. For due diligence on any kind of business, see what due diligence is when selling a business.

What documents do I need for SaaS due diligence?

Financial statements, tax returns, bank and payment processor records, billing exports, a customer list with revenue by account, retention and churn data, customer and vendor contracts, contractor IP assignments, technical documentation, and a team and tool list. The checklist above groups them into six sections.

Will a buyer need access to my code?

Usually, yes, after the LOI and under an NDA. Many buyers review the repository themselves or with a technical adviser. Share it only at that stage, and make sure every contributor’s work is assigned to the company first.

What is a due diligence request letter?

It is the list of documents and questions a buyer sends after the LOI. Answer every item, note anything that does not exist, and track each request in a log so your answers stay consistent.

Find your diligence gaps before buyers do

The Exit Readiness Tool shows where your SaaS business is strong, where buyers are likely to push back, and what to fix before you go to market. If you want help building a diligence-ready package and running the sale, talk to Hello Exit.