SaaS diligence is unusual in how much of it is data rather than documents: buyers verify the business by re-deriving your metrics from raw exports, then confirm the legal and technical foundations underneath them.
Sellers who prepare the exports, contracts, and technical documentation below before going to market compress diligence from months to weeks, and defend their multiple by leaving buyers nothing surprising to find.
Financial and metrics workstream
- Monthly P&L and cash flow for at least 24 months
- MRR movement schedule: new, expansion, contraction, churn, by month
- Cohort retention tables, revenue and logo, from raw billing exports
- Billing system export reconciling to bank deposits
- Customer list by plan with start dates (anonymized until late stage)
- CAC, channel spend, and payback analysis where paid acquisition exists
- Deferred revenue and annual-prepay liabilities
Legal workstream
- IP assignments from every founder, employee, and contractor who touched the code
- Customer terms of service and any negotiated enterprise agreements
- Data processing agreements and privacy policy versions over time
- Open-source license inventory and compliance review
- Trademarks, domains, and app store account ownership
- Corporate records, cap table, and any prior financing documents
- Vendor agreements: hosting, payments, critical APIs
Technical workstream
- Architecture overview and infrastructure diagram
- Hosting and third-party dependency inventory with costs
- Security posture summary: access controls, backups, incident history
- Codebase statistics and dependency health, without code access yet
- Deployment and on-call processes, and who holds the keys
- Product roadmap and known technical debt, stated honestly
Staging the disclosure
Sequence matters as much as content: anonymized metrics and summary financials for early conversations, full financials and contracts under NDA at LOI, and technical deep-dives with time-boxed code access only in confirmed diligence. Customer names come last.
A data room with tiered permission groups makes the staging mechanical rather than a judgment call per request; Papermark's per-buyer analytics also show which of a marketplace's many browsers actually read the cohort tables, which is the best serious-buyer signal a seller gets.
Next steps
FAQ
How long does SaaS acquisition diligence take?
Micro-acquisitions can verify in two to four weeks; deals above a few million dollars with legal and technical workstreams commonly run 45 to 90 days from LOI.
What do SaaS buyers verify first?
Revenue reality: the billing export reconciled to bank deposits, then churn and cohort behavior. Everything else waits until the revenue story checks out.
What is the most common problem found in SaaS diligence?
Missing contractor IP assignments and metric definitions that flatter (counting reactivations as new, netting churn inside expansion). Both are fixable before market, expensive after LOI.