Legal Due Diligence for SaaS Acquisitions

Most buyers spend their diligence energy on the revenue. But a deal can have flawless numbers and still collapse — or come back to haunt the buyer years later — because of what legal due diligence uncovers, or fails to.

Legal diligence answers two questions the financials never touch: can this business actually be transferred to a new owner, and what liabilities come attached to it? For SaaS specifically, the answers hinge on things founders rarely think about until a buyer's lawyer asks.

This is the legal companion to the broader SaaS due diligence checklist. A note before we start: this is general information, not legal advice — every deal and jurisdiction differs, so run your specifics past a qualified attorney.

What legal due diligence covers

Legal diligence is the buyer's review of the target's legal foundation — ownership, contracts, compliance, and liabilities. For a SaaS company, a handful of areas carry most of the risk.

IP ownership — the one that sinks SaaS deals

For a software business, the code is the asset. So the first question a buyer's counsel asks is deceptively simple: does the company actually own its intellectual property?

It's not always yes. Common problems:

Contractor-built code without assignment. If a freelancer or agency wrote part of the product and never signed an IP assignment, they — not the company — may own it. Founder IP not assigned to the entity. Code written before incorporation, or by a founder personally, that was never formally transferred to the company. Open-source license violations. Using open-source components under licenses (like GPL) whose terms weren't followed can create obligations that transfer with the code.

Clean, documented chain of IP ownership — signed assignment agreements from every contributor — is what a buyer needs to see. Gaps here can delay or kill a deal.

Contracts and assignability

A buyer inherits your contracts, so they read them for two things:

Change-of-control and assignability clauses. Do your customer and vendor contracts survive a sale, or can the counterparty walk or renegotiate when ownership changes? Terms that transfer liabilities. Auto-renewals, refund commitments, SLAs, and unusual guarantees the new owner would take on.

Customer contracts that can't be assigned are a real risk, because the revenue attached to them may not survive the transaction.

Data privacy and compliance

SaaS businesses hold customer data, which brings regulatory exposure a buyer must assess:

GDPR, CCPA, and regional privacy laws — and whether the company actually complies. SOC 2 or other security attestations — increasingly expected, especially for B2B. Data processing agreements with customers and subprocessors. Where and how data is stored and transferred across jurisdictions.

Non-compliance isn't just a fine risk; it can reduce the value of the customer relationships being acquired.

Corporate structure and cap table

The buyer needs clean ownership with no surprises:

A clear cap table with no undocumented equity, options, or promises. Outstanding SAFEs, convertible notes, or warrants that affect what's actually being bought. Proper corporate records, filings, and good standing.

Messy ownership is one of the most common reasons small SaaS deals stall.

Liabilities and litigation

Finally, the buyer looks for what they'd be inheriting:

Pending or threatened litigation and disputes. Unpaid taxes, debts, or vendor obligations. Regulatory issues or investigations. Employment and contractor matters, including whether IP assignment agreements are actually in place for the team. How legal and financial diligence connect

Think of it as three parallel questions. Legal diligence asks can this be transferred, and what comes with it? Financial diligence asks is it worth what we're paying? And verification asks are the numbers even real?

They reinforce each other. A business can have clean legal standing and inflated revenue, or real revenue and a broken cap table — and a buyer needs all three to line up. On the revenue side, that's where source-connected verification does the work legal review can't: confirming the financial story is genuine while counsel confirms the legal one.

For founders: get your legal house in order early

Most legal red flags are fixable — but not overnight. Chase down IP assignments from every past contractor, confirm your open-source compliance, clean up your cap table, and organise your contracts and corporate records well before you go to market. Legal problems discovered mid-diligence cost time and leverage; the same problems solved in advance cost neither.

FAQs

What is legal due diligence for a SaaS acquisition? The buyer's review of the target's legal foundation — IP ownership, contracts, data compliance, corporate structure, and liabilities — to confirm the business can be transferred cleanly and to identify what risks come with it.

What's the biggest legal risk in a SaaS deal? Usually IP ownership. If contractors or founders built parts of the product without signing assignment agreements, the company may not fully own its own code — a serious problem for a software acquisition.

Does a SaaS company need SOC 2 to be acquired? Not always, but security attestations like SOC 2 are increasingly expected, especially for B2B SaaS, and their absence can slow diligence or affect terms.

How is legal due diligence different from financial due diligence? Legal diligence confirms the business can be transferred and surfaces liabilities; financial diligence confirms the revenue is real, recurring, and worth the price. Both run in parallel and a buyer needs both to hold up.