SaaS acquisition due diligence checklist

24 months P&L reconciled to Stripe. Cohort retention by month. Refund and chargeback rate. Discount codes and effect on ARPU. Free-plan-to-paid conversion. Deferred revenue at close. Recurring vs one-off breakdown.

Dependency audit, security scan, uptime last 12 months, backup/DR plan, incident log, deploy pipeline demo, secrets inventory, hosting bills for last 6 months.

IP assignments for every contractor. Data-processing agreements. GDPR/CCPA posture. Trademark status. Any open disputes. Founder non-compete scope.

Inference cost per active user. Model provider contracts. Rate-limit exposure. Eval suite. Prompt/version control. Data-training rights on customer inputs.

On SaaS due diligence checklist, the first 30 days after close should be about not breaking anything. Run the seller's cadence, ship no new features, change no vendors, send no ‘new owner' email the seller didn't co-sign. You paid for a working machine — don't take it apart on day two.

Days 31–60 are the audit: read 12 months of support tickets, sit on a sales call, watch a churn call, look at the actual bank-statement expense pattern. Days 61–90 are your first small change — one process improvement the previous owner had been meaning to make. That rhythm becomes your operating model.

Sub-$500k deals on SaaS due diligence checklist clear at 2.6x–3.8x SDE, with a discount for owner-hours over 20/week and a premium for MRR concentration above 70%. The $500k–$2M band sees 3.5x–5.2x SDE or 2.8x–4.5x ARR — buyers pick whichever framework flatters the deal less.

Levers that actually move the number: 5-point NRR improvement is worth 0.4x–0.7x; each 10 points of sustainable YoY growth adds ~0.5x; owner-independence buys 0.5x–0.9x; single-customer exposure above 25% costs 0.3x–1.0x. Anchor every claim to a comparable deal that closed in the last two quarters, not 2021 vibes.

A serious buyer looking at SaaS due diligence checklist works off a written question tracker in six buckets — financial, commercial, technical, legal, team, and platform. If any bucket has two red flags, the deal usually re-trades or dies. Great sellers preempt this by publishing the answers before diligence starts.

Reconcile 24 months of P&L to bank statements line by line. Export Stripe/Paddle at raw-event level, not the dashboard summary. Have every contractor's IP assignment in a single PDF. Sit for a 60-minute recorded ‘objection interview' with a friendly buyer before you publish — it's the cheapest diligence rehearsal you'll ever run.