Buying a SaaS business is not a lottery ticket; it is a forensic audit wrapped in a handshake. If you skip a single metric, you risk paying for future liabilities that have yet to surface. This guide breaks down the 35 non-negotiable questions that separate professional buyers from expensive mistakes.
Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.
This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.
The first and most critical phase of any SaaS acquisition is the deep dive into financial statements. However, standard income statements often tell a incomplete story in the subscription economy. You are not just buying current cash flow; you are buying a prediction of future cash flow based on customer retention. In my experience advising buyers through Deal Alert AI, I have witnessed too many deals fall apart because the seller’s revenue was consistent on paper but volatile in reality. You must look beyond the top-line number and dissect the quality of that revenue.
The most important metric here is not Monthly Recurring Revenue (MRR) in isolation, but the trend and composition of MRR. Is the revenue coming from a handful of large enterprise clients, or is it distributed across hundreds of small and medium-sized businesses? Concentration risk is a silent killer. If one client represents 30% of your total MRR, your business is not actually a diversified software company; it is a single-client consultancy operating under the guise of a tech startup. You need to analyze churn rates monthly, not just annually. An annual churn rate of 20% sounds manageable, but if 30% of that churn happens in the first three months of the customer lifecycle, you have a severe product-market fit problem that no amount of sales marketing can fix.
Furthermore, you must verify the source of revenue. Does the seller have proof of payments for every single active subscription? I recommend asking for the last 12 months of bank statements that have been matched against the billing platform export (like Stripe or Chargebee). Discrepancies between what the seller claims in their dashboard and what actually hit the bank account are red flags. This could indicate "gross up" revenue strategies, where developers count cancelled or paused trials as active revenue to inflate valuation. This financial autopsy must be thorough. If you cannot trace every dollar of recurring revenue to a valid, current customer contract and a successful payment transaction, you do not have a SaaS business; you have a mystery.
Finally, scrutinize the Average Revenue Per User (ARPU) and Average Order Value (AOV) trends. Are customers upgrading to higher tiers, or are they staying in the lowest plan indefinitely? In 2026, the market favors SaaS businesses that show clear expansion revenue. If a company has been flat for two years, the seller will likely claim they are "perfecting the product." In reality, flat revenue in a growing market often indicates stagnation or a saturated niche. You need to understand the unit economics of each customer cohort. If the cohort from two years ago is churning at a higher rate than the new cohort, your product may have deteriorated, or your onboarding process may have failed to retain long-term users. These questions form the backbone of your financial due diligence and should be answered with data, not opinions.
We scan Empire Flippers, Flippa, Acquire.com and Quiet Light daily — scoring every listing. Start free.
Many buyers, particularly those from non-technical backgrounds, make the mistake of assuming that if the software works for them, it will work for a thousand customers. This is a dangerous assumption. The codebase of a SaaS company is the engine of your investment, and just like a car engine, it suffers from wear and tear if notproperly maintained. Technical due diligence is not about you becoming a developer; it is about understanding the maintainability, scalability, and security of the product you are buying. You need to engage a third-party technical auditor who specializes in SaaS acquisitions. Their job is to find the technical debts that will become your liabilities in the first year of ownership.
The first area to inspect is the "Technical Debt." Ask the seller for a recent technical audit or code review if one exists. If not, your auditor should run static analysis tools on the codebase. High levels of technical debt manifest as slow development cycles, frequent bugs, and high maintenance costs. If the developer who built the product is leaving, and the code is poorly documented, you are buying a library of cryptic puzzles. The "Bus Factor" is critical here. Is there only one person who truly understands how a core feature works? If that person leaves on day one, can the new team keep the server running? If the answer is no, you have a continuity risk that must be priced into the deal.
Secondly, assess the scalability and infrastructure costs. Look at the relationship between sales growth and infrastructure costs. In a healthy SaaS model, infrastructure costs should scale sub-linearly with revenue. Does the current hosting environment allow for easy horizontal scaling? If the architecture is monolithic and tightly coupled, splitting it for performance improvements will be expensive and risky. Look for dependencies on specific, potentially outdated technologies that are hard to staff in the current market. For example, if a company relies heavily on a legacy JavaScript framework that has very few developers available in 2026, your hiring pool is restricted, and your maintenance costs will rise. You are buying a technology stack, not just a user interface.
Third, examine the security posture. In 2026, data breaches are not just bad PR; they are existential threats. Ask for the last two penetration test reports. If the seller cannot provide recent security audits, treat the lack of documentation as a sign of negligence. Check for compliance with GDPR and CCPA, especially if you are dealing with European or California-based customers. Non-compliance can lead to fines that dwarf the annual revenue of small SaaS companies. Furthermore, verify that all user data is encrypted at rest and in transit. If the codebase contains hard-coded credentials or poor access management protocols, you are buying a liability. The technical lead of the business must be willing to discuss these vulnerabilities openly. If they become defensive or vague, walk away.
Beyond the financials and the code, you must scrutinize the legal agreements that bind the business to its customers. This is where many deals die quietly. A SaaS business is essentially a collection of long-term service agreements. You are not just buying a piece of software; you are buying the right to enforce usage and billing terms against a specific set of entities. The quality of these contracts determines your negotiating leverage and your risk exposure. I have seen buyers struggle to collect payments from customers because the contracts were loosely written, ignoring late fees or termination clauses. This is not a bug; it is a feature of many early-stage companies that grew too fast without legal oversight.
First, review the standard Terms of Service (ToS) and Subscription Agreements. Are they enforceable? Do they clearly define the "Product," the "Service Level Agreement (SLA)," and the specific exclusions of liability? In 2026, customers are more litigious and aware of their rights. Your contracts must protect you from suing for every minor downtime or service interruption. Look for "uncapped liability" clauses that might have been signed with larger enterprise clients. If you are buying a company that has 50 clients under uncapped liability, you are exposing yourself to ruinous financial risk if a major client sues for damages. You need to have your own legal counsel review the top 10 largest contracts specifically for these types of clauses.
Second, check for "evergreen" clauses or automatic renewal terms. Are customers locked in for 12-month terms, or can they cancel with 30 days' notice? The difference between a 12-month contract and a 30-day cancellation window is massive for cash flow predictability. A business with 90% of its revenue on annual contracts has a very different risk profile than one where customers can leave at any moment. Verify the percentage of revenue that is "committed" versus "transactional." Additionally, look for any unique custom terms granted to major clients. Did the seller agree to free custom development work in exchange for a longer contract? If so, you are now obligated to provide that development service, which increases your operational burden without increasing your revenue. These hidden service level agreements can eat into your margins quickly if you are not aware of them during diligence.
Third, investigate intellectual property (IP) ownership. This is often overlooked but critical. Does the company actually own all the code, designs, and trademarks they are using? If the founder built parts of the product on their personal laptop using personal time, there could be arguments about IP ownership. Ensure that all employees have signed work-for-hire agreements. If the developer team consists of freelancers or contractors, you must have reviewed their contracts to ensure that all IP created for the company belongs to the company, not the freelancer. If a freelancer leaves and claims ownership of a core module, you are in significant legal trouble. Use a platform like Flippa or similar marketplaces where IP transfers are standardized, but always double-check with legal counsel. In 2026, with the rise of AI-generated code, you must also clarify the copyright status of any AI-assisted components to avoid future lawsuits regarding originality.
The SaaS business you are buying is only as good as the people who operate it. This is true even for technical products, because someone has to manage sales, support, and marketing. The transition of key personnel is the most fragile phase of an acquisition. The value of a SaaS company is often embedded in the tacit knowledge of the founder and core team. If you buy the code and the customers but lose the person who understands why certain features exist or how to handle difficult client escalations, you have bought half the company. You need to treat the human capital assessment with the same rigor as the financial audit.
First, assess the "Founder Trap." How much of the pricing, sales strategy, and customer relationship management relies solely on the founder’s personal network and charisma? Try to observe the founder in action during the due diligence process. If every customer call requires the founder’s presence, the business is not scalable and is at high risk once they exit. You need a sales process that is documented and can be executed by a mid-level account executive. Ask for a detailed sales playbook. If one does not exist, the sales process is likely ad-hoc and fragile. The goal is to buy systems, not personalities. If you are buying a personality, you are buying a job, not an asset.
Second, evaluate the key employee retention plan. Who are the top 3-5 non-founder employees that the business cannot survive without? Do they have signed contracts that include a non-compete and non-solicitation clause? Are they incentivized to stay? A common structure in SaaS acquisitions is a deferred payment or equity rollover for key employees to retain them for the first 12-24 months. If key staff leave within 90 days of closing, the operational continuity will be severely compromised. You need to have retention bonuses in place and agreed upon before closing. Interview these key employees separately. Their answers will often differ from the founder’s narrative. Listen for hesitations, dissatisfaction, or vague stories about the company culture. The vibe of the remaining team is a direct indicator of the future performance of the business.
Third, look at the diversity of skills within the team. A SaaS company needs more than just developers. It needs a marketer who understands content and SEO, a support specialist who can retain users, and an operations manager who can handle billing and compliance. If the team is skewed heavily toward engineering with no one handling growth or retention, you will face immediate friction after closing. You will need to hire new talent, which takes time and money. Calculate the cost of filling these gaps and subtract it from your valuation. If the team is top-heavy with executives and lacks mid-level executioners, you may face a management bottleneck that stifles growth. Ensure that the organizational chart you are buying is capable of executing your growth strategy without immediate massive restructuring.
In 2026, the acquisition of a SaaS business is fundamentally an acquisition of its customer acquisition channels. The value of the business is derived not just from the current customers, but from the predictable, repeatable engine that brings in new customers. Many first-time buyers look at the product and love it, but then they ask, "How do we get more customers?" and the answer is often thin or non-existent. This is a fatal flaw. You are not buying a product you will fix; you are buying a growth engine you will operate. If the growth engine is broken or dependent on luck, the valuation is overstated.
Analyze the customer acquisition cost (CAC) and the lifetime value (LTV) ratio per channel. Do not just look at the blended average. Break it down. If you have 80 customers coming from organic SEO and 20 from paid ads, your risk profile is different than a company that relies 90% on paid ads. Organic traffic is compounding and low cost, but slow to grow. Paid traffic is instant but expensive and stops when the budget stops. If the seller is primarily driven by paid social media ads, ask for the history of ad fatigue. Are they having to increase Creative Refresh rates? Is the CPO (Cost Per Order) rising? A rising CPO is a sign that the channel is becoming saturated or that the targeting has run out of steam. You need a business with at least two reliable, independent growth channels to mitigate risk.
Examine the content and SEO assets. If the company ranks highly for specific commercial keywords, verify the stability of those rankings. Are they ranking because of domain authority, or because of a singular blog post that went viral? Viral traffic is not recurring. Look at the Organic Traffic trend over the last 18 months. Is it growing, flat, or declining? In 2026, with AI Overviews dominating search results, traditional SEO is changing. Does the company have a strategy for the post-AI search landscape? If they are solely relying on top-of-funnel blog traffic that is being intercepted by AI assistants, you need to reassess the sustainability of that traffic source. Check the backlink profile for any toxic links or manipulative link-building schemes that could result in a Google penalty. A penalty in SEO can wipe out 50% of your inbound leads overnight.
Finally, audit the sales funnel conversion rates. What is the visitor-to-lead conversion rate? What is the lead-to-customer conversion rate? If the traffic is high but the conversion is low, you have a product or landing page problem. If the traffic is low but the conversion is high, you have a demand generation problem. Fixing the latter is usually more expensive than fixing the former, but it is faster. Ask for the funnel data from your CRM (like HubSpot or Pipedrive). Look for seasonality. Are there periods of zero sales? What causes them? Understanding the rhythm of your sales pipeline is crucial for forecasting cash flow. If you do not understand how the money comes in, you cannot manage it once you own it. This is where platforms like Empire Flippers come in handy, as they often provide detailed funnel diagnostics as part of their listing process, saving you weeks of internal auditing.
Due diligence can be overwhelming with hundreds of data points. To simplify the process and ensure you are not missing critical red flags, I have distilled the essential verification steps into a strict checklist. This is not optional. If you cannot check off every one of these items with confidence, you are not ready to sign the purchase agreement. Share this list with your lawyer, your CTO, and your financial advisor. If any of these items are missing or vague, assume the worst until proven otherwise.
This checklist serves as the final gate before you release the escrow funds. It is your insurance policy. Do not rush through it. Many buyers feel pressure to close quickly because they fear losing the asset to another buyer. This pressure is exactly what sellers hope you will feel. Take your time. A business that cannot survive due diligence is not a good business. Use this list to gain confidence in your valuation and to identify areas where you can negotiate a lower price or require specific indemnifications from the seller.
Remember, the goal of due diligence is not to find every single bug; it is to find the fatal ones. If you find five minor issues, you can price them in. If you find three fatal issues (unverified revenue, no IP ownership, or critical legal liabilities), you walk away. That is a successful outcome. Walking away from a bad deal saves you six figures. Treat this checklist as a sacred instrument of due diligence.
Once you have completed your due diligence, you enter the negotiation phase. This is where your findings directly translate into deal terms. A strong due diligence report gives you leverage to negotiate not just the price, but the structure of the payment. In 2026, cash-on-closing is rarely the entire story for SaaS acquisitions. You will likely be dealing with Earn-Outs, Seller Notes, and Escrow periods. Understanding how to structure these components is vital to protecting your downside risk.
The Earn-Out is the most common mechanism used to bridge the gap between what the seller believes the business is worth and what the buyer is willing to pay based on verified data. The seller says, "I will make you $1 million in the first year if the acquisition goes well." You say, "I will pay you that $1 million only if you actually make it." The danger is in the definition of "earned." How is revenue defined? Are one-time consulting fees included? If you include non-recurring revenue in the Earn-Out calculation, you are giving the seller an incentive to push one-off services that may not be scalable or desirable. You must define the Earn-Out metrics clearly in the purchase agreement, tying them strictly to recurring revenue or EBITDA, excluding one-time items.
Escrow is your safety net. Typically, 10-20% of the purchase price is held in escrow for 6 to 12 months. This money is released at the end of the period provided no material breaches of warranty have occurred. What are "material breaches"? This must be defined very specifically in the contract. If the seller lied about a customer contract and you only find out six months later, that money in escrow is your compensation. If you do not have an escrow period, or if the amount is too small, you are absorbing the risk of fraud or gross negligence. In my advice through Deal Alert AI, I always recommend a minimum 12% escrow for SaaS deals, with a release schedule that is not too aggressive. The last payment should be held for at least 6 months post-closing to cover any latent liabilities that take time to surface.
Additionally, consider the structure of the seller note. If the seller is financing part of the purchase, you are effectively lending money to them. They must provide security for this loan, usually in the form of a first-lien on the assets of the company. If the business fails in year two, do you get paid before the seller? Yes, if you hold the note. Ensure that the seller note has a default clause that allows you to seize assets if payments are missed. Do not rely on the seller’s goodwill; rely on collateral. The deal structure is just as important as the price. A $1 million deal with a 50% escrow and a secured seller note is safer than a $800,000 deal with no security and a 100% cash payment.
The acquisition is complete, but the work is just beginning. The first 90 days post-closing are critical for stabilizing the business and integrating it into your portfolio. This phase is often called the "Integration" or "Onboarding" period. It is where you test the theories from your due diligence. You will see if the revenue is stable, if the team is engaged, and if the technology holds up under your management. This is not the time to make radical changes. It is the time to observe, document, and stabilize.
The first 30 days should be dedicated to financial and operational stabilization. Implement the financial controls you identified as missing during due diligence. Set up a real-time dashboard that tracks MRR, churn, and cash flow daily. Meet with every single employee, one-on-one, to understand their role, their pain points, and their vision for the company. This builds trust and gives you insight into the cultural health of the organization. Do not cut headcount immediately. SaaS businesses rely on specialized skills, and sudden layoffs can trigger a brain drain that is much more expensive than the salary of the employee you hoped to save. Instead, focus on performance management and clear goal-setting.
Days 31 to 60 are for process optimization. Review the sales and marketing channels. Identify the highest CAC channels and pause them if they are underperforming. Reallocate budget to organic channels and email marketing, which have lower costs. Work with the engineering team to prioritize the technical debt list you created during due diligence. Do not try to fix everything at once. Focus on the top 3 critical bugs or scalability issues. Communicate these priorities clearly to the team. Transparency is key. Owners who hide the fact that they are analyzing the business create a culture of fear. Owners who openly discuss challenges create a culture of collaboration. This is how you build a long-term asset, not just a short-term cash cow.
Days 61 to 90 are for growth planning. Now that you have stability, you can look at the horizon. What is the expansion strategy? Are there new markets to enter? Is there a product feature that can be launched to increase ARPU? Use the data you have gathered to make informed decisions. This is where your investment in Deal Alert AI or other analytical tools pays off. You now have a baseline to measure growth against. If you hit your targets, you can scale. If you miss them, you know exactly which metric is the bottleneck. The first 90 days are a test of your management capabilities. They determine whether the acquisition will be a success or a burden. Approach this phase with humility and urgency. You are the owner, not the owner-manager. Your job is to hire, delegate, and control. Let the experts do the work, and use your due diligence findings to keep them accountable.
We scan Empire Flippers, Acquire, Flippa, and Quiet Light daily. The best sub-$500K businesses are gone within 48 hours.
We scan Empire Flippers, Flippa & Acquire every morning. The best deals sell in 48 hours.