SaaS Due Diligence Checklist: What to Verify Before You Buy

Short answer: SaaS due diligence means verifying six things before you wire funds: that revenue reconciles to the bank and the billing system, that churn and retention hold up on a cohort basis, that the code and infrastructure are what the seller claims, that AI model and data dependencies actually transfer, that the IP and customer contracts are legally assignable, and that the business can run without the founder. Budget two to six weeks for a sub-$5M deal. Most failed acquisitions trace back to one of these six being skipped. Last updated July 2026. Educational only, not investment or legal advice.

The six areas of SaaS due diligence

Why diligence matters for a SaaS acquisition

Diligence is where good acquisitions are protected and bad ones are caught. Skipping it, or doing it shallowly, is how first-time buyers overpay or inherit problems they never saw coming. Work through each section below before you wire any funds. This is educational only, not investment, legal, or financial advice, and it does not guarantee the outcome of any deal.

Why diligence matters more for AI SaaS

This page is deliberately SaaS-specific. If you are buying a business of any other kind, the general workstreams, the documents that prove each claim and the venue by venue picture are set out in our M&A due diligence checklist. Every SaaS acquisition needs diligence, but AI products carry extra failure modes that generic checklists miss: dependence on a single third-party model, inference costs that quietly erode margin, unclear rights to training data, and thin defensibility when the product is a simple wrapper. A buyer who only checks the financials and ignores these can buy a business whose economics collapse the moment model pricing shifts. Treat the AI-specific section as essential, not optional. Our guide to AI tools for buying a business covers where those tools genuinely help and where they still require your own verification.

Financial diligence

Confirm the money is real and the numbers reconcile to source data, not just a spreadsheet.

• Verify MRR and ARR against the billing system (Stripe, the payment processor, or bank deposits).
• Reconcile reported revenue with bank statements over at least the trailing twelve months.
• Separate recurring subscription revenue from one-off or services income.
• Confirm gross margin after all costs, including inference and model spend.
• Review expenses and add-backs to confirm true profit or SDE.
• Check for any deferred revenue, refunds, or chargeback patterns.

Above a certain deal size this work stops being something you do yourself and becomes a formal engagement. What that costs, and the point at which an SBA lender makes it mandatory rather than optional, is covered in quality of earnings report cost.

Customer and revenue-quality diligence

Two businesses with identical MRR can be worth very different amounts depending on revenue quality. Read the cohort numbers you rebuild against SaaS churn rate benchmarks, since what counts as healthy retention depends entirely on the customer type and price point.

• Verify churn rate and net revenue retention from real cohort data.
• Check customer concentration, since heavy reliance on one or two accounts is a major risk.
• Review the acquisition channels and how much growth depends on paid ads, then check what the spend earns back against CAC payback period benchmarks.
• Confirm active users versus paying users so you are not buying inflated counts.
• Look at support volume and outstanding customer issues.

Technical diligence

You are inheriting the codebase and infrastructure, so understand what you are taking on.

1. Review the architecture, code quality, and documentation.
2. Map the full tech stack, hosting, and third-party services.
3. Identify technical debt and any single points of failure.
4. Confirm security basics: data handling, access controls, and known vulnerabilities.
5. Understand the deployment and operations burden you will own day one.

AI-specific diligence

This is the section that separates an AI-aware buyer from a generic one.

• Model dependencies. Which models power the product, and what happens if pricing, access, or terms change?
• Inference margin trend. How has gross margin behaved as usage scaled? Improving or eroding?
• Data rights. Who owns the training data, prompts, and any fine-tuned models? Are the rights transferable?
• Defensibility. Is there a real moat (proprietary data, workflow, integrations) or is it a thin wrapper?
• Compliance. Confirm how customer data is used and whether usage respects model and data terms.

Legal and ownership diligence

Confirm the seller can actually transfer everything you are paying for.

• Verify IP ownership and that all contributors signed assignment agreements.
• Confirm ownership of the domain, code repositories, and all critical accounts.
• Review customer contracts, terms of service, and any outstanding obligations.
• Check third-party licenses and whether they transfer with the sale.
• Surface any pending disputes, liabilities, or regulatory issues.

Transition and handoff

The handoff is where deals quietly go wrong, so plan it before you close. Agree on a transition period where the seller helps you take over, build a complete asset transfer list covering every account and integration, and define how customer relationships and credentials move across. Then close through escrow so funds are only released once the transfer conditions are met. For more on protecting the close, see our overview of SaaS escrow.

What documents are needed for SaaS due diligence?

The SaaS due diligence documents a buyer should request fall into five bundles. Ask for all of them in one list at the start rather than trickling requests out over three weeks, because a seller who can produce the full set quickly is telling you something useful about how the business is run.

Two documents carry more weight than the rest: the payment processor export, because it is the one revenue record a seller cannot easily edit, and the IP assignment agreements, because an unassigned contribution from a former contractor can follow the business for years. If a seller hesitates on either, treat it as the finding. Sellers preparing this bundle in advance usually get a better price for it, which is part of why the cost of selling a SaaS business is lower than most founders expect once the paperwork is already in order.

Using the checklist well

The point of a checklist is to slow you down at the moments that matter. Verify before you trust, reconcile every claimed number to source data, and treat anything you cannot confirm as a discount or a deal-breaker rather than a benefit of the doubt. This checklist pairs naturally with our complete guide to buying a SaaS business and our valuation guide. When you are ready, you can browse verified listings with full metrics on the marketplace. Diligence starts once an offer is signed, so it is worth knowing what a SaaS letter of intent commits you to before you grant exclusivity.

This article is educational only and is not investment, financial, legal, or tax advice. It does not guarantee the outcome of any acquisition. Consult qualified professionals before completing a purchase.