When you buy a SaaS business, you are not buying last year's revenue — you are buying the probability that this month's customers are still paying you 18 months from now. Most buyers analyze the wrong number and overpay by 30%. This is the framework that fixes that.
Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.
This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.
By Sophal Lanh, Founder of Deal Alert AI
I have looked at hundreds of SaaS listings across marketplaces, brokers, and off-market deal flow. The pattern is consistent: buyers get seduced by the multiple, skim the profit and loss statement, ask two questions about churn, and wire the money. Twelve months later they are running a business that generates 40% less than the number on the listing page — not because the seller lied, but because the buyer measured the wrong thing.
SaaS is the most attractive asset class in online business and also the most unforgiving. Recurring revenue cuts both ways. When retention is strong, compounding does the work for you. When retention is weak, you are on a treadmill that speeds up every month, and you inherited it at a 4x multiple. This guide is the complete framework I use, broken into six dimensions of diligence that actually predict post-acquisition performance.
Every other online business model is evaluated backward. An affiliate site's trailing twelve months of revenue is a reasonable proxy for next year, adjusted for traffic trends. An Amazon FBA brand's sales history tells you a lot about demand. SaaS does not work like that. A SaaS business's trailing twelve months can look excellent while the underlying engine is dying, because revenue from customers acquired 18 months ago is still flowing in even after new customer acquisition has collapsed.
Here is a concrete example. A B2B tool doing $34,000 MRR, up from $28,000 twelve months prior. On paper: 21% year-over-year growth, listed at 4.2x SDE. Looked great. When I pulled the MRR movement data, new MRR had dropped from $4,100/month in the first half of the period to $1,900/month in the second half. Churned MRR had crept from $1,600 to $2,400. The business was still growing on a trailing basis purely because a large expansion event in month three papered over the decline. Project that forward six months and MRR goes negative. The listing was priced off history. The reality was already in decline.
So the first question is never "what did this business earn last year." It is "how durable is this revenue base, and will it persist under a new owner who does not have the founder's relationships, technical fluency, or product intuition?" Everything below is designed to answer that one question with evidence instead of vibes. If you want to see how this filter changes which listings are worth your time, the screening logic behind Deal Alert AI is built on exactly these signals.
We scan Empire Flippers, Flippa, Acquire.com and Quiet Light daily — scoring every listing. Start free.
Monthly recurring revenue is not one number. It is the net result of four separate forces, and a serious buyer analyzes each one independently over at least 24 months. New MRR is revenue from customers who did not exist last month. Expansion MRR is additional revenue from existing customers upgrading, adding seats, or crossing usage tiers. Contraction MRR is revenue lost when existing customers downgrade without leaving. Churned MRR is revenue lost when customers cancel entirely.
The net number can look flat while the components tell a dramatic story. A business at $50,000 MRR flat for a year could be adding $6,000 in new MRR monthly and losing $6,000 to churn — a leaky bucket that requires enormous ongoing acquisition effort. Or it could be adding $2,000 in new and $3,000 in expansion while losing $5,000 to churn from a specific legacy plan being sunset. Those are completely different businesses with completely different risk profiles, and they would trade at completely different multiples if the buyer knew the difference.
Do not accept a seller-prepared spreadsheet for this. Request read-only access to Baremetrics, ChartMogul, or ProfitWell, or export raw subscription events directly from Stripe or Paddle and rebuild the movement analysis yourself. I have seen sellers classify a customer who downgraded from $299 to $49 as "retained" — technically true, materially misleading. Independent verification of MRR movement is the single highest-leverage hour you will spend in SaaS due diligence. On marketplaces like Empire Flippers, this data is usually organized well; on Flippa, quality varies enormously by listing, so verification effort scales accordingly.
Aggregate churn is a blended average that hides everything important. Cohort retention analysis groups customers by the month they signed up and tracks what percentage of that group's original MRR remains at month 3, 6, 12, 18, and 24. This is the closest thing to a lie detector in SaaS diligence, because it reveals whether product-market fit is improving, stable, or deteriorating over time.
The benchmarks I use: a healthy B2B SaaS cohort retains 85% or more of its original MRR at month 12, and best-in-class businesses exceed 100% because expansion revenue from surviving customers outweighs the losses from churned ones. That is net negative churn, and it is the most valuable characteristic a SaaS asset can have. B2C or prosumer SaaS runs lower — 60-70% at month 12 is workable if customer acquisition cost payback is under six months. What should terrify you is a cohort losing 30% or more of its MRR within the first six months. That is not a churn problem, it is a product-market fit problem, and it means the business is buying customers who never should have signed up.
The second thing to look for is whether cohorts are improving or degrading. Line up the month-6 retention figure for cohorts from 24 months ago, 18 months ago, 12 months ago, and 6 months ago. If retention is climbing, the founder has been fixing onboarding, tightening targeting, or shipping features that matter — you are buying an improving asset. If retention is falling, either the market is getting more competitive or acquisition channels have drifted toward lower-intent traffic. In that case, you are buying a business whose best cohorts are behind it, and the price should reflect that.
Ask for a revenue-by-customer breakdown covering the top 20 accounts, anonymized if necessary, with the monthly amount and tenure of each. Then calculate what percentage of total MRR the top customer, top 5, and top 10 represent. For B2B SaaS in the sub-$5M valuation range, concentration risk is frequently the most material risk factor in the entire deal, and it is the one buyers most often skip.
My rule of thumb: if a single customer represents more than 20% of MRR, that customer effectively holds a veto over your investment returns. If the top five exceed 50%, you are not buying a SaaS business — you are buying an agency relationship with a software wrapper, and it should be priced closer to a services multiple than a software multiple. I have walked away from otherwise excellent deals purely on concentration, and every time, I later learned that the anchor customer had renegotiated or churned within 18 months.
Concentration is not automatically disqualifying if you can underwrite the specific relationships. Find out how long each large customer has been paying, whether they are on annual contracts with auto-renew, whether the relationship is founder-dependent, and whether the product is embedded in their operational workflow. A five-year customer with the tool wired into their daily operations is very different from an eighteen-month customer on a month-to-month plan who was sold personally by the founder. Where concentration exists and you still want the deal, structure around it: hold back 20-30% of the purchase price in an earnout tied to those specific accounts still paying at month 12.
Spending $1,500 to $3,000 on an independent developer to audit the codebase is the best money you will spend in a SaaS acquisition, and the vast majority of buyers skip it to save a rounding error on a six-figure purchase. The auditor should evaluate four things: code quality and structure, security vulnerabilities, technical debt and dependency risk, and documentation completeness.
What you are trying to discover is the true cost of ownership. A SaaS product built on a clean, modern stack with automated tests, containerized deployment, and a written architecture document can be maintained by a competent contract developer at maybe $1,500 to $3,000 per month. The same revenue coming from an undocumented ten-year-old PHP monolith with hardcoded credentials, no test coverage, and three abandoned dependencies can require a dedicated senior developer at $8,000+ per month just to keep the lights on. That difference alone can consume the entire profit margin you are underwriting.
Specific things to flag: outdated framework versions past end-of-life support, absence of any automated testing, secrets stored in the repository, no staging environment, a single points-of-failure deploy process that only the founder understands, and third-party API dependencies that could change pricing or terms. Also ask about infrastructure cost trends — I have seen businesses where hosting costs were growing 4% monthly against 1% revenue growth, which is a slow-motion margin collapse hidden inside "cost of goods sold."
Retention data tells you what happened. Moat analysis tells you whether it will continue. The question to answer is deceptively simple: why do customers choose this product over the alternatives, and what would have to happen for them to leave? Write down the answer in one paragraph. If you cannot, you do not understand the business well enough to buy it.
Real moats in small SaaS come in a handful of forms. Data lock-in, where the customer has years of historical records inside the product that would be painful to migrate. Workflow embedding, where the tool is wired into daily operations across multiple team members. Integration depth, where the product connects to systems the customer already depends on. Compliance or certification, where the product satisfies a regulatory requirement and the switching cost includes re-auditing. Niche specificity, where the product solves a narrow problem so precisely that generalist competitors are not credible substitutes.
Things that are not moats: a nice interface, a price advantage, being first to market five years ago, or the founder's personal reputation in a community. Price advantages get competed away. Interfaces get copied. Founder reputation does not transfer to you. Also spend two hours doing competitive reconnaissance yourself — search the primary keywords, check what appears in AI-generated answers, look at G2 or Capterra alternatives pages, and note whether well-funded competitors have entered the category in the last 18 months. A category with three new venture-backed entrants is a category where your churn assumptions are about to be tested.
The final dimension determines whether this is an investment or a job. Two SaaS businesses can generate identical MRR with identical retention and require wildly different amounts of owner involvement. You need to know which one you are buying before you sign, not after.
Ask for a written breakdown of where the seller's hours go each week, then verify it against evidence. If they say support takes five hours weekly, ask for ticket volume from the helpdesk and average response times. If they say the product requires no development, ask for the commit history over the last twelve months — commits do not lie. If the founder pushed 400 commits last year while claiming the product is "stable and complete," you are inheriting a full-time development obligation that was never priced into the multiple.
The two dependency questions that matter most: does the product require continuous development just to remain competitive, and does customer support require technical expertise that only the founder possesses? A business where support tickets are mostly billing questions and password resets can be handled by a trained virtual assistant at $900 a month. A business where every ticket requires reading application logs and debugging customer configurations needs a technical support engineer, and that is a different cost structure entirely. Price the replacement of the founder's labor at market rates and subtract it from SDE before you calculate your return. This adjustment is one of the core filters we apply inside Deal Alert AI when deciding whether a SaaS listing is worth surfacing to buyers at all.
Frameworks are useful, but execution requires a sequence. This is the order I work through, and each item should be completed before advancing to the next major stage of negotiation. Items one through four happen before you sign an LOI. Items five through nine happen during the exclusivity period. Items ten through twelve happen before funds are released.
Budget roughly 25 to 40 hours of your own time for a deal in the $200,000 to $1M range, plus $2,000 to $5,000 in third-party costs for the technical audit and, if the deal size warrants it, a financial review. That sounds like a lot until you compare it to the cost of buying a business whose MRR falls 35% in year one.
Work the list in order and do not let deal momentum or broker urgency compress your timeline. Good sellers understand thorough diligence. Sellers who pressure you to skip steps are telling you something.
Diligence is not an academic exercise — every finding should translate into either a price adjustment, a structural protection, or a walk-away. In practice, SaaS businesses in the sub-$3M range trade somewhere between 2.5x and 5x annual SDE, and where a specific deal falls in that range is almost entirely determined by the six dimensions above.
The businesses that earn the top of the range share a profile: net revenue retention above 100%, cohorts at 85%+ at month 12, no customer above 10% of MRR, clean and documented code, a genuine switching cost, and under ten hours a week of non-technical owner involvement. The businesses that deserve the bottom of the range — or a pass — have flat aggregate MRR hiding a leaky bucket, a top customer at 30%, an undocumented codebase, and a founder who is also the product's only support engineer.
Be specific and evidence-based when you adjust. "Your top customer is 24% of MRR, so I want 25% of the price in an earnout tied to that account renewing" is a reasonable, defensible position. "I feel like this is overpriced" is not. Sellers and brokers respect buyers who bring data, and the fastest way to lose a good deal is to be vague about your reasoning. Whether you are sourcing from Empire Flippers, Flippa, or direct outreach, the framework is the same — only the quality of the pre-packaged data changes.
The hardest part of SaaS acquisition is not diligence — it is that thorough diligence takes 30+ hours and most listings do not survive the first three. Buyers burn out running full analyses on deals that were never viable, and the good deals get taken by someone who moved faster.
That is the problem we built Deal Alert AI to solve. We monitor listings across the major marketplaces continuously and score them against the same signals described in this article: revenue durability indicators, pricing relative to comparable transactions in the same model and size band, evidence of operator dependency in the listing language, technology stack signals, and concentration disclosures. Listings that fail the basic screens never reach your inbox.
The result is a shorter list where the deals you do investigate deserve the 30 hours. You still do the work — no tool replaces a code audit or a customer interview — but you spend that work on deals with a realistic chance of closing profitably instead of grinding through listings that a five-minute MRR movement check would have eliminated. Buy SaaS on evidence, structure the deal so the remaining uncertainty is not yours alone to carry, and let the compounding do what it does best.
We scan Empire Flippers, Acquire, Flippa, and Quiet Light daily. The best sub-$500K businesses are gone within 48 hours.