Most buyers lose money because they buy the revenue story, not the reality. Before you wire a single dollar, you need to see the raw data. Here is the exact list of documents to request to protect your investment.
Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.
This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.
Buying an online business is not the same as buying a physical store. There are no inventory boxes to count, no lease agreements to scrutinize, and often, no employees to check references. The entire value of the asset is digital. It lives in spreadsheets, server logs, and marketing dashboards. Because the underlying assets are intangible, the margin for error is razor-thin. If the seller tells you the business makes $20,000 a month, that is just a number until you verify it. If you skip the verification process, you are not buying an asset; you are gambling.
As a buyer, your primary job during the pre-purchase phase is to dismantle the seller's narrative and rebuild the truth using data. You need to look at the business with surgical precision. You are looking for discrepancies between the "seller's profit" and the "realistic profit" you will earn if you take over the keys. This process is known as due diligence. It is the most critical phase of the acquisition, yet it is where most beginners cut corners. They are excited about the potential and rush to sign the Letter of Intent (LOI), only to realize later that the business is built on shaky foundations.
At Deal Alert AI, we have helped hundreds of buyers navigate this process. We have seen deals fall through because the seller deleted their analytics history. We have seen buyers overpay because they failed to identify hidden operational costs. And we have seen buyers get stuck with broken automated systems because they did not request access to the code or API keys. The difference between a profitable acquisition and a financial disaster is almost always found in the data room. This guide provides the comprehensive checklist of documents you must request, how to interpret them, and the red flags that should make you walk away immediately.
The first and most obvious category of documents involves the money. You need to see exactly how much money is coming in, where it is going, and what is actually left over. However, "profit" is a slippery term. Sellers often report "SME profit" (Seller's Manually Edited profit or Seller's Monthly Earnings), which includes their salary, personal expenses, and sometimes their personal life costs. As a buyer, you must strip these away to find the true "EBITDA" or net profit. If a seller claims the business makes $10,000 a month but you cannot see the breakdown of expenses, you have no deal.
You must request the last 24 months of P&L (Profit and Loss) statements. If the business has been operating for less than two years, ask for every single month since inception. Why 24 months? Because one or two years can hide seasonality. A business might make huge profits in Q4 but lose money in Q1. Without two full cycles, you cannot predict future cash flow. Additionally, you need bank statements for the same period. P&Ls are created by the seller; they are subjective. Bank statements are created by the bank; they are objective. If the deposit amounts in the bank do not match the revenue on the P&L, you have found a red flag. Do not argue with the data. Walk away.
Beyond the standard P&L, you need to see the payment processor statements. If it is a Shopify store, request the Shopify Payouts report. If it is a SaaS, look at the Stripe or PayPal Transaction History. These raw feeds are the ground truth of revenue. Compare every single month against the P&L. There should be no variance. If there is, ask for an explanation in writing. Hidden fees, refunds, and chargebacks will eat your margins alive if you do not account for them now. A business that looks profitable on paper but loses money once fee structures and refunds are applied has no value to you. Your goal is to model the clean, realistic profit you can expect, not the inflated fantasy the seller is selling.
We scan Empire Flippers, Flippa, Acquire.com and Quiet Light daily — scoring every listing. Start free.
An online business is only as good as its traffic acquisition strategy. You need to know not just how many people visit the site, but where they come from and how much it costs to acquire them. Request the full history of Google Analytics (GA4 or Universal Analytics, depending on when the account was created) and Google Search Console. You need to see the "Referrals" and "Acquisition" reports. If a business derives 90% of its traffic from a single source, such as one Facebook ad or one influencer blog post, it is highly fragile. If that source dries up, the business collapses. You want to see a diversified mix of organic search, direct traffic, social media, and paid advertising.
For paid traffic, the data requirements are much stricter. You need access to the ad accounts themselves, or at minimum, a full export of the campaign history for the last 12 to 24 months. You need to see the Cost Per Click (CPC) and Return on Ad Spend (ROAS) over time. Be wary of sellers who show you average ROAS but hide the monthly volatility. A business might have a 3.0 ROAS average, but maybe it was 5.0 in Q3 and 1.2 in Q4. The trend matters more than the average. If the CPCs are rising year over year while conversion rates stay the same, your margins will compress the moment you take over. You need to model the future cost of traffic, not the past average.
You also need to verify organic traffic health. Check the Search Console data for Core Web Vitals and index coverage. Have there been any manual actions or algorithmic penalties? Look at the click-through rate (CTR) from search results. If the seller claims high domain authority but organic traffic is declining, they may be using black-hat SEO tactics that will eventually hurt you. You are not just buying the website code; you are buying the relationship it has with search engines. If that relationship is toxic, the asset is toxic. Ensure that all offline marketing or email lists are also verified. If they claim to have a list of 10,000 subscribers, ask for a screenshot of the email platform dashboard showing the active subscriber count and open rates. A list with 20% open rates is an asset; a list with 2% open rates is a liability.
Before money changes hands, you must confirm that the person you are talking to actually owns the business. This sounds basic, but many scams involve "bros" who are selling domains or stores they do not legally own. They might be a partner who is quitting, or a contractor who holds the domain in their personal name. Your first step is to verify the registered owner of the domain. Use a WHOIS lookup to see the owner's name. It must match the seller's legal name or the business entity name. If it does not match, stop. Do not send the money until the domain transfer is initiated or a holder of power is established.
Next, you must review the corporate structure of the business. Is it a Sole Proprietorship, an LLC, or an S-Corp? This matters for your tax implications and liability protection. If the business is an LLC, request a copy of the Certificate of Formation and the Operating Agreement. You need to know if there are other members or partners who need to sign off on the sale. If the business has debt, you need to see the loan agreements. Will the seller pay off the debt from the proceeds, or are you buying the liability? Be extremely clear in the Letter of Intent. If there is a business credit card with $5,000 in debt, you need a clear plan for how that liability is extinguished. Do not assume it will be handled. Put it in writing. Ambiguity in legal structure is the breeding ground for future disputes.
Finally, check for any active or pending litigation. If the business is involved in a lawsuit, or if there are consumer complaints on sites like the Better Business Bureau or Trustpilot, you need to evaluate the risk. Sometimes, a few negative reviews are normal. But if there is a pattern of theft, non-delivery, or fraudulent claims, the business may be facing legal action or chargeback ratios that will get your payment processor suspended. You are buying the legal entity just as much as you are buying the website. Ensure that all indemnification clauses in the purchase agreement protect you from pre-closing liabilities. You do not want to be sued for something the seller did six months before you bought the store.
Once you own the business, you need to operate it. This means you need full access to every asset that keeps the lights on. During the due diligence phase, you should initiate the "login transfer" for all critical tools. You are not asking to change the passwords yet, but you are asking for access to verify functionality. For e-commerce stores, this includes the Shopify or WooCommerce backend, the product feed, and the inventory management system. You need to verify that the inventory the seller claims to have is actually in the system and is not backordered or out of date. If the seller says they have 500 units in stock, check the warehouse reports. If the stock levels do not match, the cash flow projection is wrong.
For service-based businesses or agencies, the infrastructure is different. You need to see the project management tools, such as Asana, Trello, or Monday.com. You need to see the client database. Who are the clients? How long have they been with the business? Is the revenue recurring or one-time? If 50% of the revenue comes from one client who is about to expire, your runway is months, not years. You must request a churn rate history for SaaS businesses. What is the monthly retention rate? If a business has one customer for a year, then loses 20% of customers every month, it is a leaky bucket. You need to see the Unit Economics. What is the Lifetime Value (LTV) versus the Customer Acquisition Cost (CAC)? If LTV is less than 3x CAC, the business is not scalable and may not be worth buying.
You also need to verify the hosting and technical setup. Who is the hosting provider? Is the contract in the seller's name? How much is the monthly cost? Are there any automations, such as Zapier or Make.com scripts, that run the business? You need to see these flows. If the business relies on complex automations that the seller built personally, you need to know if they are documented. If the seller leaves and the documentation is in their head, you are buying a fragile empire. Request a "Technical Audit" or a "Runbook" that details how every part of the business functions. If the seller does not have a runbook, you should assume it takes you 6 months to learn the business, and price the purchase accordingly. You are buying a machine, not just a brand. Ensure the machine has a manual.
Most small online businesses are sold without employees, but many have contractors. If the business relies on a virtual assistant (VA), a developer, or a content writer, you need to understand the relationship. Is the contractor an independent employee, or are they legally tied to the seller? If the VA is the seller’s spouse or sister, they are unlikely to continue working for you after the sale. This is a common trap. The seller might sell you a "hands-off" business, but the "hands" are their family members. You need to verify who is actually doing the work. Request emails or chat logs that show the workflow. If you cannot identify the key personnel, you cannot value the business.
If there are W-2 employees, this changes the risk profile entirely. You will need to go through a proper Employee Retention and Transition plan. You need to review their employment contracts, salary history, and benefit obligations. Are there any pending terminations? Are there any non-compete agreements? If you buy the business, you become the employer. If the employees are unhappy or underperforming, you have inherited a management crisis. This is why many buyers prefer "asset deals" where they buy the IP and assets but reject the liabilities and employees. However, if you must buy the entity, you must diligence the human capital. Talk to the employees (with the seller’s permission). Ask them why they like the job and what would make them stay. If the answer is "we love the founder," the business is not transferable.
For businesses that use dropshipping or third-party logistics (3PL), verify the relationship with the suppliers. If the seller has a special pricing agreement with a supplier, is it transferable? Will the supplier raise prices once the seller is gone? Send a test order to the supplier or warehouse to ensure the products are in stock and shipable. If the supplier is a random person on AliExpress who might get banned tomorrow, your supply chain is at risk. You need to know the durability of the supply chain just as much as the durability of the marketing. A business with great traffic and a broken supply chain is a money pit. Verify that the products you are selling can actually be delivered to the customer consistently.
The value of an online business is largely in its Intellectual Property (IP). This includes the website code, the domain, the brand assets, the content, and the algorithms. You must verify that you will own all of this. If the website was built by a freelancer, do you own the code? Many freelancers retain copyright unless explicitly told to sign a "Work for Hire" agreement. If you do not own the code, you are renting your own website. You need to request all source code files, design assets (Figma, Photoshop), and brand guidelines. If the seller says "I can send you the files later," do not trust it. You need to see them in the data room now.
Check for trademark challenges. Is the brand name trademarked? If so, in which countries? If the trademark is not registered, you are vulnerable to copycats. You should perform a preliminary trademark search to ensure that your acquisition of the brand will not lead to a cease-and-desist letter from a larger player in the future. For content sites, check the copyright ownership of the articles. Did the writer sign over the rights? If the content is scraped or AI-generated without proper licensing, it could be a legal liability. You are buying the library, not the liability. Ensure that all assets are clean and that you have the right to modify them. If the business uses licensed music, stock photos, or software, verify that the licenses are transferable and that no payments are overdue.
Another critical IP area is the email list. As mentioned, verify the size and health, but also verify the consent. Did the users opt in legally under CAN-SPAM and GDPR? If the list was bought from a third-party vendor, it is dangerous. Sending emails to a bought list will get your domain blacklisted by Gmail and Yahoo, killing your organic traffic as a side effect. You need a clean, organic subscriber base. Look at the growth rate of the list over time. Did they buy a burst of 10,000 subscribers in one month? That is a red flag. A healthy list grows organically through content and offers. Verify that the email marketing software account is in the seller’s name and that the domain authentication (SPF, DKIM, DMARC) records are set up correctly in the DNS. If these records are messed up, you will have a nightmare trying to fix deliverability after the purchase.
To summarize the above sections, here is the actionable checklist you must use for every potential acquisition. Print this out. Check every box. If you cannot check a box, you are not ready to close the deal. This list covers the financial, technical, and legal bases that protect your capital.
Once you have collected all the documents, the final step is the cross-verification audit. Sit down with these documents and build a financial model. Project the next 12 months of cash flow based on the verified data, not the seller’s promises. If the business has a 5% month-over-month growth rate, do not assume it will continue forever. If it is flat, assume it will decline slightly because you will not have the seller’s intimate knowledge of the niche. This conservative modeling is how you protect your investment. If the numbers work only in a "best-case" scenario, the business is too expensive. Use Empire Flippers or similar vetted marketplaces because they often pre-screen for these basics, but always do your own final verification. Even vetted businesses can have hidden issues that only a deep dive will reveal.
Before you sign the Purchase Agreement, have a business attorney review the specific indemnification clauses. You want a "knowledge qualifier" clause that says you do not bear liability for things you didn't know about pending legal issues or tax debts. You also want a "escrow holdback" clause where 10-20% of the purchase price is held in escrow for 6-12 months to cover any post-closing discoveries. This is your insurance policy. If the business fails to deliver the promised cash flow in the first few months, you have a claim against the escrow. Do not waive this protection. It is standard in serious transactions.
Finally, remember that the goal of due diligence is not to find a perfect business. There is no such thing. The goal is to find a business where the risks are known and priced in. If you find a risk, ask yourself: "Can I fix this?" and "How much will it cost?" If the answer is yes and the cost is manageable, the business may still be a good deal. But if you are flying blind, you are buying a liability. Use resources like Deal Alert AI to help you analyze the data quickly and spot the anomalies that human eyes might miss. The market is full of opportunities, but it is also full of traps. Your edge is not luck. Your edge is diligence. Do the work. Ask for the files. Verify the numbers. And only when the data is solid, you close the deal. Your future cash flow depends on the rigor of your today.
The process of buying an online business is a marathon of data verification. It is tedious, sometimes frustrating, and requires a high level of skepticism. But it is the only way to buy with confidence. Sellers who are transparent will make the process easy. They will provide the files quickly because they know their business is solid. Sellers who are evasive, who offer excuses for why they can’t provide bank statements or ad account access, are telling you the truth: their business has problems. Listen to the silence. When a seller is quiet about the data, ask why. And if the silence doesn't answer with clarity, walk away. There is always another deal on Flippa or other marketplaces. You do not need this specific business; you need a profitable asset. Only this checklist leads you to that asset.
We scan Empire Flippers, Acquire, Flippa, and Quiet Light daily. The best sub-$500K businesses are gone within 48 hours.
We scan Empire Flippers, Flippa & Acquire every morning. The best deals sell in 48 hours.