SaaS Due Diligence
SaaS Acquisition Due Diligence Checklist 2026: 35 Questions Before You Sign
Buying a SaaS business is one of the highest-potential acquisitions in the online business market — predictable recurring revenue, high margins, scalable growth. It's also where the most sophisticated buyers get burned, because SaaS metrics are easy to misrepresent and the risks are subtle.
This checklist covers everything you need to verify before signing any SaaS LOI. Work through it methodically. A deal that passes all 35 questions is one you can buy with confidence.
The #1 SaaS acquisition red flag: Monthly churn above 3%. At 3% monthly churn, you lose 30% of your customer base per year. You need a constant stream of new customers just to stay flat. Always calculate what churn means for MRR 12 and 24 months out before you value the business.
Financial Verification (Questions 1–8)
01
Request Stripe/Paddle/payment processor raw export — not screenshots. Export 24 months of actual charge data. Cross-check the total against seller's stated MRR. Discrepancies over 5% are a serious red flag.
02
Verify MRR vs ARR math. Annual subscriptions are not MRR × 12 until revenue is recognized monthly. Confirm whether reported MRR is monthly billing or annualized ARR divided by 12.
03
Calculate gross revenue churn rate — revenue lost from cancellations each month divided by beginning MRR. Request month-by-month data for 24 months. Look for trend — churn accelerating is a major warning sign.
04
Calculate net revenue retention (NRR). Does the remaining customer base expand (upgrades, seat additions) or contract? NRR above 100% means the business grows even without adding new customers.
05
Request P&L for 24 months with all expense line items. Identify any expenses the seller is removing that you'll need to replace (paid tools, contractor work, their own time).
06
Validate CAC (Customer Acquisition Cost) — total marketing and sales spend divided by new customers acquired. Is CAC trending up or down? Rising CAC with flat or declining MRR growth is a core business problem.
07
Calculate LTV:CAC ratio. LTV (average revenue per customer × gross margin ÷ monthly churn rate). Healthy SaaS has LTV:CAC of 3:1 or better. Below 2:1 means the unit economics are structurally weak.
08
Identify deferred revenue. Annual plan prepayments are deferred revenue — liability, not asset. If $80K in annual plans were sold last quarter, $60K of that is still "owed" as months of service and should be reflected in the deal structure.
Customer Analysis (Questions 9–16)
09
Customer concentration audit. Export the top 20 customers by revenue. Does any single customer account for more than 10% of MRR? More than 20%? Losing one whale customer can devastate the business.
10
Contract types analysis. What % of revenue is month-to-month vs annual plans? Annual plans provide revenue visibility but front-load churn risk (customers can cancel at renewal). Month-to-month is riskier but more predictable in its churn pattern.
11
Churn reason analysis. Request the last 50 cancellation reasons from support tickets or exit surveys. Systemic complaints (missing features, pricing, competitor alternative) are fixable. Random churn is healthier.
12
Average subscription age of current customers. A customer base that averages 6 months of tenure is far less stable than one averaging 24 months. Long tenure = product-market fit.
13
Cohort retention analysis. Of customers who signed up 12 months ago, what % are still paying? Of 24-month cohort? Request cohort data by signup month for the past 2 years.
14
Usage/engagement data. Are active customers actually using the product? Low engagement correlates with high churn risk — customers forget they're paying and cancel during credit card updates.
15
Support ticket volume and resolution time. High support burden means the product has usability problems or gaps. Request 6 months of support ticket volume data.
16
Talk to 3 current customers before close. Ask what they'd do if the product stopped working tomorrow. Their answer tells you more about retention risk than any metric.
Score any SaaS listing instantly
Our AI extracts churn signals, MRR claims, and customer concentration risk from any listing description. Get BUY / NEGOTIATE / WALK AWAY in 30 seconds.
Technical Due Diligence (Questions 17–23)
17
Codebase review. Hire a technical consultant to spend 4–8 hours in the codebase. Key questions: Is it modern and maintainable, or legacy code with technical debt? Can a competent developer maintain it?
18
Bus factor assessment. How many people need to be hit by a bus before the codebase becomes unmanageable? Solo founder built with no documentation = extreme key-person risk. Require code documentation as a closing condition.
19
Infrastructure costs and scalability. Request AWS/GCP/hosting bills for 12 months. Are margins going to compress as you grow, or is the cost structure efficient?
20
Third-party dependencies. What APIs and third-party services does the product depend on? Any deprecated integrations, pricing changes, or terms-of-service risks that could break the product?
21
Security posture. When was the last security audit? Any known vulnerabilities? Any history of breaches? SOC 2 or similar compliance requirements in target customers?
22
Uptime and reliability record. Request the incident log for the past 12 months. High-frequency outages indicate infrastructure problems or poor engineering practices.
23
Roadmap and feature backlog. What do customers expect next? If there's a year-old feature request with 200 upvotes and it hasn't been built, either it can't be built or the founder lost motivation — both matter for your thesis.
Legal and Ownership (Questions 24–30)
24
Intellectual property ownership. Does the seller own all code? Were contractors signed IP assignment agreements? Any co-founder IP disputes?
25
Customer contracts and assignability. Do customer terms of service allow assignment to a new owner? Confirm with your attorney before close.
26
GDPR/CCPA compliance. Is the product compliant with data privacy regulations in its target markets? Non-compliance is a liability that transfers with the business.
27
Employee and contractor agreements. Are all employees and contractors on proper agreements? Any equity promises or verbal arrangements that create unexpected obligations?
28
Outstanding litigation or disputes. Request representations and warranties covering any known or threatened legal claims.
29
Domain and trademark ownership. Verify the domain is registered to the seller. Confirm trademark status for the brand name and any product names.
30
Tax liabilities. Are there any outstanding tax obligations — state sales tax nexus issues, payroll tax problems, international VAT exposure? These transfer to you as asset buyer if not disclosed.
Transition and Operations (Questions 31–35)
31
Seller transition commitment. How long will the seller stay on? For a solo-built SaaS, 60–90 days of seller availability post-close is minimum. Build it into the LOI as a condition.
32
Team retention plan. If there are employees or key contractors, what's the plan to retain them? Key developers who leave post-acquisition can be catastrophic.
33
Vendor and tool access transfer. Create a complete list of every tool, service, and subscription. Transfer credentials as part of the closing checklist — you don't want to discover a key tool is tied to the seller's personal email 90 days later.
34
Customer communication plan. How will the ownership change be communicated to customers? Surprise announcements often trigger churn spikes. Plan the messaging before close.
35
Growth hypothesis verification. What's your thesis for growing this business post-acquisition? Before closing, validate that the opportunity is real — test the hypothesis with one or two potential customers, confirm the untapped channels exist.
Free Checklist
47-Item Due Diligence Checklist
Don't buy until every box is checked.
What to do with this checklist
Work through these 35 questions with every SaaS deal that survives your initial screening. Use our free AI deal analyzer to do the initial screen — it identifies the top red flags in any listing description in under 30 seconds, so you spend your DD time on deals that actually have a chance.
For serious SaaS acquisitions, budget $2,000–$5,000 for professional due diligence: a technical reviewer ($150–$200/hr for 8 hours) and a legal review of the purchase agreement ($1,500–$3,000). The cost of a bad acquisition dwarfs these numbers many times over.
Find SaaS deals worth analyzing on Empire Flippers (best vetting) and Acquire.com (largest SaaS selection).