SaaS Due Diligence Checklist
48 items across 6 categories. Work through it before you sign a letter of intent, and catch red flags early.
Print this page or copy the items into your own tracker. ← All resources
Financial due diligence
Verify revenue, expenses and financial health.
| Item | What to check |
|---|---|
| Revenue verification | Read-only access to Stripe or the payment processor showing MRR and ARR trends |
| Bank statements | The last 12 to 24 months of business bank statements |
| Profit and loss statements | Monthly P&L for at least 24 months |
| Expense breakdown | Every recurring expense: hosting, tools, contractors and so on |
| Tax returns | The last 2 to 3 years of business tax returns |
| Accounts receivable | Outstanding invoices and collection history |
| Cash flow analysis | Actual cash in versus cash out |
| Revenue concentration | The share of revenue from the top 5 customers |
Customer and metrics due diligence
Understand the customer base and the key SaaS metrics.
| Item | What to check |
|---|---|
| Customer list | Every customer with subscription tier, start date and MRR |
| Churn analysis | Monthly churn for the past 12+ months, with reasons for cancellation |
| Net revenue retention | NRR including expansion and contraction |
| Customer acquisition cost | CAC by channel, with historical trends |
| Lifetime value | LTV and the LTV to CAC ratio |
| Customer interviews | Talk to 3 to 5 customers about satisfaction and renewal plans |
| Support ticket analysis | Support volume, response times and common issues |
| Satisfaction scores | NPS or any other customer survey data |
Technical due diligence
Assess the codebase, infrastructure and technical debt.
| Item | What to check |
|---|---|
| Code repository access | Read access to review code quality, history and documentation |
| Architecture overview | Tech stack, hosting and system design |
| Security review | Security practices, known vulnerabilities and past incidents |
| Technical debt | Known issues, outdated dependencies and needed refactoring |
| Scalability | Whether the system can handle 10x the current load |
| Third-party dependencies | Every API and service, with its cost and risk |
| Deployment process | CI/CD setup, rollback procedures and monitoring |
| Backup and recovery | Backup frequency and a tested recovery process |
Legal due diligence
Review contracts, intellectual property and compliance.
| Item | What to check |
|---|---|
| Corporate structure | The business entity, ownership and good standing |
| IP ownership | All code, trademarks and domains properly owned |
| Customer contracts | Terms of service, SLAs and enterprise agreements |
| Vendor contracts | Third-party agreements and whether they transfer |
| Employee and contractor agreements | IP assignment clauses, non-competes and key-person risk |
| Privacy and compliance | GDPR, CCPA, SOC 2 or HIPAA as applicable |
| Litigation history | Any past, pending or threatened legal issues |
| Licenses and permits | Any required business licenses or regulatory approvals |
Operational due diligence
Understand how the business actually runs.
| Item | What to check |
|---|---|
| Team structure | Org chart and roles, with full-time, part-time and contractor breakdown |
| Key-person dependencies | Who knows what, and any single points of failure |
| Documentation | SOPs, runbooks and an internal knowledge base |
| Founder involvement | Hours a week, critical functions and a transition plan |
| Sales process | How customers are acquired, with pipeline and conversion data |
| Support operations | Who handles support, the tools used and the SLAs |
| Marketing channels | Traffic sources, content and paid acquisition |
| Vendor relationships | Key partnerships, affiliate agreements and resellers |
Growth and market due diligence
Evaluate market position and growth potential.
| Item | What to check |
|---|---|
| Market size and trends | TAM, SAM and SOM, market growth and industry trends |
| Competitive landscape | Direct competitors, positioning and moat |
| Product roadmap | Planned features, customer requests and the backlog |
| Growth channels | What works, what has been tried, and untapped opportunities |
| Pricing analysis | Current pricing against competitors, and room to raise it |
| Expansion opportunities | Upsell potential, adjacent markets and new regions |
| Risk factors | Platform dependencies, regulatory risks and market shifts |
| Post-acquisition plan | What you will do differently, and a 100-day plan |
Do not rush
A thorough diligence process takes weeks, not days. Resist pressure to skip steps: the issues you find now save expensive surprises later.
Talk to customers
Numbers tell part of the story. Customer conversations reveal satisfaction, switching risk and feature requests you will not find in a spreadsheet.
Get technical help
If you are not technical, hire a developer to review the codebase before you commit.
Get deal alerts and new resources
Join the list to hear when listings open and when we publish new guides.
We only email about SaaSClose listings and resources. Reply to any email to stop.