SaaS Due Diligence Checklist
A complete framework for verifying a SaaS business before acquisition — covering revenue integrity, traffic analysis, churn, legal, technical, and operational risk.
Revenue & Financial Verification
- Verify MRR/ARR directly from Stripe, Lemon Squeezy, or your payment processor — not from screenshotscritical
- Reconcile TTM revenue month-by-month via MRR bridgecritical
- Confirm revenue recognition method (cash vs. accrual)
- Check for one-time payments inflating recurring revenue figurescritical
- Validate billing platform refund and dispute rates
- Review pricing history — sudden price hikes before sale are a red flag
- Confirm no deferred revenue obligations owed to customers
Traffic & Analytics Verification
- Connect to Google Analytics directly via OAuth — reject CSV exportscritical
- Verify session counts are consistent with reported conversion rates
- Check traffic source distribution (organic vs. paid vs. direct)critical
- Identify any traffic spikes that don't align with revenue movements
- Validate bounce rate and engagement metrics for plausibilitycritical
- Check for bot traffic or artificial inflation patterns
- Confirm GA4 property matches the domain being acquired
Churn & Retention Analysis
- Calculate logo churn rate for the past 12 months
- Calculate revenue churn (MRR lost to downgrades + cancellations)
- Compute Net Revenue Retention (NRR) — target > 90 %critical
- Request customer cohort data showing retention by signup month
- Identify customer concentration risk (any customer > 20 % ARR?)critical
- Review reasons for largest churned accounts
- Check trial conversion rate and time-to-convert trends
Product & Technical Review
- Audit infrastructure costs as a % of revenue (healthy: < 20 %)critical
- Identify single points of failure or key-man technical dependencies
- Review open-source licence compliance for all dependencies
- Check for outstanding security vulnerabilities (run a basic scan)
- Evaluate technical debt and estimated remediation cost
- Confirm ownership of all code, IP, and third-party licencescritical
- Review uptime history and SLA compliance if applicable
Legal & Contracts
- Review all customer contracts for assignment clauses (can they transfer?)critical
- Confirm IP ownership — no contractor work without signed IP assignmentcritical
- Review Terms of Service for any liability caps or refund obligations
- Check for active or pending litigation
- Verify trademark registrations in relevant markets
- Review data processing agreements (GDPR compliance for EU customers)
- Confirm no change-of-control provisions that allow customer cancellationcritical
Team & Operations
- Identify which team members are critical and their post-close intentionscritical
- Review employment contracts and non-compete clauses
- Map all operational processes — is anything in the seller's head only?critical
- Check customer support ticket volume and resolution times
- Evaluate vendor and supplier concentration risk
- Review any pending regulatory or compliance requirements
Automate the two hardest items on this list
ProofCap connects directly to your billing platform and Google Analytics via read-only OAuth to verify revenue figures and traffic independently — producing a signed report you can share with co-investors or advisors in minutes.
Common questions
Due diligence, clarified
What should I check in SaaS due diligence?
A complete review covers six categories: revenue & financial verification, traffic & analytics verification, churn & retention analysis, product & technical review, legal & contracts, and team & operations — 41 checklist items in total, laid out below. Verifying revenue directly from the payment processor rather than screenshots is the single most commonly skipped step.
Why is revenue verification important in SaaS acquisitions?
It confirms reported MRR and ARR match what's actually flowing through the payment processor — not a spreadsheet or screenshot the seller prepared. A mismatch between reported and verified revenue is one of the most common reasons deals fall through in late-stage diligence.
How do you assess key-person risk in a SaaS acquisition?
Identify which team members are critical and their intentions post-close, check for single points of technical failure or key-man dependencies, and confirm whether operational knowledge is documented or exists only in the founder's head. Heavy dependency on one person — for customer relationships or technical operations — is a red flag worth pricing in.
What's the difference between MRR and ARR?
MRR (Monthly Recurring Revenue) is recurring revenue measured per month; ARR (Annual Recurring Revenue) is MRR multiplied by 12. Both should be verified directly against the payment processor — Stripe, Lemon Squeezy, or equivalent — rather than taken from a seller-provided summary.
SaaS M&A insights, monthly
Due diligence frameworks, valuation guides, and forensic audit case studies — sent once a month, no spam.