SaaS Due Diligence: The Complete Checklist for Acquiring a SaaS Business in 2026

Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.

Acquiring a SaaS business is fundamentally different from acquiring a content site or an e-commerce brand. The revenue is recurring, the customers have ongoing relationships with the product, and the technical infrastructure is part of what you are paying for. Every one of those differences creates specific due diligence requirements that a buyer who only knows content site acquisitions will not know to look for — and missing any of them can turn a promising acquisition into an expensive mistake.

This guide walks through every significant due diligence area for a SaaS acquisition in 2026: financial verification, customer analysis, technical assessment, legal and IP review, and operational transition. It is organized as a working checklist, not a theoretical overview, because SaaS due diligence is best approached as a systematic process, not an improvised investigation.

Phase 1: Financial Verification

SaaS financial due diligence starts with verifying the metrics that drive the entire valuation: MRR, churn, and expansion revenue. Every other financial analysis depends on getting these right.

MRR verification. Monthly Recurring Revenue should be verified directly in the payment processor — Stripe, Paddle, Braintree, or whichever platform processes the subscriptions. Do not rely on the seller's spreadsheet or the broker's summary. Request read-only access to the payment processor account and verify active subscriptions, amounts, and billing dates against the stated MRR. Common discrepancies to look for: trials or discounted plans counted at full price, annual subscriptions counted at MRR before any churn risk is factored in, and one-time fees counted as recurring revenue.

Churn rate verification. Monthly logo churn (percentage of customers who cancel per month) should be calculated from the full customer history in the payment processor, not from a seller-provided summary. Get a full CSV of every subscription start date and cancellation date for the trailing 24 months. Calculate churn yourself. The industry benchmark for a healthy B2B SaaS is under 2% monthly logo churn. Consumer SaaS can run higher. Anything above 5% monthly is a serious problem that requires explanation.

Net Revenue Retention (NRR). NRR measures whether existing customers are spending more or less over time — expansion revenue (upsells, seat additions, tier upgrades) minus contraction and churn. NRR above 100% means the business grows even with zero new customer acquisition. NRR under 90% means the existing customer base is shrinking in revenue terms even if logo count looks stable. Get NRR calculated for each of the trailing 8 quarters separately — trends matter as much as averages.

Customer Acquisition Cost (CAC) and payback period. How much does the business spend to acquire one new customer, and how long does it take to recoup that cost from subscription revenue? For bootstrapped SaaS businesses, CAC is often low because acquisition came through content or word-of-mouth. For paid-acquisition-driven businesses, CAC can be significant. A CAC payback period over 18 months is a warning sign for a small business — it means customer acquisition is expensive relative to what each customer is worth.

Average Revenue Per Account (ARPA). Higher ARPA businesses ($200+/month per customer) are generally more defensible than low-ARPA ($15/month) businesses, because high-ARPA customers are businesses with a real budget for the tool, while low-ARPA customers are more price-sensitive and more likely to churn at a competitor's lower price. Get the distribution of ARPAs — not just the average — to understand the customer base composition.

Cohort analysis. Ideally, request a cohort analysis showing how customers who signed up in each month are performing over time. Good SaaS businesses show flattening churn curves — cohorts that survive six months tend to stick around indefinitely. Bad SaaS businesses show continuous decay even among long-term customers. If the seller cannot produce a cohort analysis, build one yourself from the subscription history data.

Phase 2: Customer Analysis

Understanding the customer base is as important as understanding the financials. A SaaS business's customers are its most durable asset — or its most significant liability if they are churning, concentrated, or contractually problematic.

Customer concentration. What percentage of MRR comes from the top 5 customers? Top 10? If a single customer represents more than 15% of MRR, that customer's decision to cancel materially changes the business's financial profile. If the top 3 customers represent 50% of MRR, you are not acquiring a SaaS business — you are acquiring a consulting relationship with three clients who have a subscription wrapper around it. Get the full customer list sorted by MRR contribution.

Customer tenure distribution. How long have the current customers been subscribed? A customer base with 60% of accounts having been active for over 24 months is dramatically more stable than one where 60% of accounts are under six months old. Long-tenure customers have already decided the product is part of their workflow — they are the most defensible revenue.

Customer type analysis. Are customers individuals (B2C) or businesses (B2B)? B2B customers churn less because switching costs are higher and the purchase decision involves multiple stakeholders. B2C customers churn more because cancellation requires one click and often no consequence. The customer type composition should align with the churn rate you are seeing in the data.

Contract terms and obligations. Do customers have annual contracts or month-to-month? Annual contracts lock in revenue but also mean the business has obligations to deliver — if the product degrades significantly, annual customers can seek refunds or legal recourse. Month-to-month customers can leave at any time, but there are no deferred revenue liabilities. Understand the breakdown clearly, and get copies of the standard subscription agreement terms to understand cancellation and refund policies.

Customer support burden. How many active support tickets does the business handle per month? What is the average resolution time? A SaaS product that requires significant ongoing human support per customer is more operationally intensive than one that runs largely self-serve. High support burden is not necessarily a dealbreaker, but it is a real operational cost that should be reflected in your SDE calculation.

Churn interview with 3–5 recent churned customers. Ask the seller to connect you (anonymously if needed) with three to five customers who canceled in the last six months. The reasons customers leave are the most honest assessment of the product's weaknesses you will find anywhere. Common churn reasons that are concerning: product too buggy, customer support too slow, cheaper alternative available, use case was not actually solved. Common churn reasons that are acceptable: customer's business changed, they stopped needing the category of tool, price was prohibitive for their stage.

Phase 3: Technical Due Diligence

Technical due diligence is the area where most non-technical buyers skip steps — and where the most expensive surprises hide. You do not need to be a developer to evaluate technical risk, but you need to know what questions to ask and what the answers mean.

Tech stack assessment. What languages, frameworks, and infrastructure does the product run on? A well-maintained Rails, Django, or Node.js application with standard cloud infrastructure (AWS, GCP, Heroku) is significantly easier to hire for and maintain than a legacy PHP application running on a bare metal server that only the seller knows how to maintain. Ask what it would cost to hire a developer to work on this stack and whether that cost is reflected in your operating expenses.

Code quality and documentation. Request a code review by a trusted developer before close — even a half-day review of the repository is worthwhile. Signs of poor code quality: no test coverage, minimal documentation, spaghetti architecture where a single bug can crash the whole product, outdated dependencies with known security vulnerabilities. Good code quality is not just aesthetics — it determines your maintenance burden and your ability to improve the product post-acquisition.

Infrastructure cost and scalability. What does the product cost to run per month? Is that cost fixed or does it scale with user count? A product with variable infrastructure costs that scale non-linearly with users can have dramatically different unit economics at 2x current user counts than the seller's current P&L shows. Get the hosting and infrastructure invoices for the trailing 12 months and understand what drives cost changes.

Third-party API and service dependencies. Does the product depend on any third-party APIs, data sources, or services that could raise prices, change terms, or shut down? Stripe for payments, Twilio for SMS, Sendgrid for email — these are standard and low risk. But if the product is built on a niche API that has a single provider and limited alternatives, that dependency is a risk. Get a list of all third-party services and their associated costs and terms.

Security vulnerabilities. Has the product had security incidents? Is customer data encrypted at rest and in transit? Is there a process for handling security bug reports? For B2B SaaS especially, customers care about security compliance — SOC2, GDPR, HIPAA as relevant. Any outstanding known security issues should be disclosed and either resolved before close or priced into the deal.

Data portability. Can you move the product to a different host, or is there lock-in to a specific infrastructure provider? Can you export all customer data if needed? Understanding your infrastructure portability options gives you leverage over future cost decisions and protects against a hosting provider shutting down or changing terms dramatically.

Phase 4: Legal and IP Due Diligence

Legal due diligence in a SaaS acquisition focuses on confirming that the business's valuable assets are properly owned, that there are no undisclosed liabilities, and that the transfer of assets is clean and complete.

IP ownership confirmation. Who owns the code? If contractors or employees wrote portions of the codebase, are there work-for-hire agreements or IP assignment agreements in place that transfer ownership to the company? Open-source components used in the product should be licensed permissively (MIT, Apache) — copyleft licenses (GPL) can create obligations that constrain how the software can be commercialized.

Trademark and domain ownership. Confirm that the brand name and domain are owned by the business entity, not by the founder personally. Trademark searches should be run to confirm there are no conflicting registrations in your target markets that could create future legal exposure.

Customer contract review. Review the standard customer subscription agreement (Terms of Service). Pay attention to: limitation of liability clauses (what is the business's maximum legal exposure to a customer claim?); data processing agreements (are there GDPR data processing commitments that transfer to you post-acquisition?); and auto-renewal terms (do customers have to be notified before annual renewals?)

Employment and contractor agreements. Review all active contracts with developers, support staff, and other contractors who work on the business. Confirm there are no non-solicitation provisions that prevent you from continuing to work with the same team. Understand termination terms for all contractor relationships.

Outstanding litigation or disputes. Ask directly and require representations and warranties in the APA: are there any pending or threatened legal claims against the business? Unresolved customer disputes, intellectual property claims, or regulatory issues should be disclosed and addressed before close.

Phase 5: Operational Transition Assessment

The technical business can be perfect and the financials can be verified — and the acquisition can still go poorly if the operational transition is mishandled. SaaS transitions are more operationally complex than content site transitions because there are active customer relationships, ongoing product development, and technical infrastructure that must continue to run without interruption.

Key person dependencies. Are there team members or contractors whose departure would materially affect the business's operation? If the only developer who understands the codebase is leaving with the seller, that is a critical risk. Map every operational function to a person and assess whether that person is staying, replaceable, or currently irreplaceable.

Seller transition period. Negotiate a transition support period of at least 60–90 days for a SaaS acquisition. The technical complexity and customer relationship continuity requirements mean you need more time than in a content site transition. Define specifically what the seller will do during the transition: training sessions, introduction to key customers, documentation of undocumented processes, code review and explanation sessions.

Customer communication plan. How will you communicate the ownership change to customers? For B2B SaaS especially, a change of ownership can trigger customer anxiety about product continuity and support quality. A well-managed communication plan — often co-signed by the seller and the buyer — that emphasizes continuity reduces churn risk in the post-acquisition period.