SaaS due diligence: the checks buyers and investors run, and how to be ready

How SaaS diligence differs from a general checklist

A SaaS review covers the same basics as any company: formation, cap table, financials, contracts and HR. For those, use the general due diligence checklist. This page covers only what is different about a software business:

• Recurring revenue and the metrics built on it.
• Revenue recognised over time, not when cash arrives.
• Code, open source and contributor IP.
• Security, infrastructure and customer data.

Selling the company? Read sell-side due diligence for the wider process. This is a starting list, not legal or accounting advice.

Revenue and SaaS metrics

Reviewers rebuild your metrics from source data. Have the source ready.

Item	What a reviewer checks
ARR and MRR definitions	How you define each, written down, and applied the same way every month
Billing system export	Invoices and subscriptions by customer, by month
Tie-out to the bank	Billing totals reconciled to bank deposits
Logo churn and revenue churn	Shown separately, with the formula you used
Net revenue retention by cohort	Expansion, contraction and churn for each starting cohort
Customer concentration	Revenue share of your largest customers
Discounts, credits and free months	Listed, so recurring revenue is not overstated

State your own definitions. Do not borrow benchmarks. A reviewer cares that your numbers tie out, not that they match someone else's.

Revenue recognition and deferred revenue

Cash, bookings and recognised revenue are three different numbers. Reviewers want all three, and a bridge between them.

Illustrative example (not a real company): a customer signs a 12-month plan for $12,000, paid up front in January. Bookings and cash in January are $12,000. Recognised revenue is $1,000 a month across the year. At the end of January, $11,000 sits on the balance sheet as deferred revenue.

Item	What a reviewer checks
Revenue recognition policy	Written, and applied the same way to every plan type
Deferred revenue schedule	By customer, tied to the balance sheet
Bookings vs recognised revenue	A monthly bridge between the two
Multi-year and prepaid contracts	Terms, renewal dates and any refund rights
Setup and services fees	How they are treated, separate from subscription revenue

Confirm your policy with your accountant or a Trusted Advisor before the review starts.

Customers and contracts

Item	What a reviewer checks
Top customer agreements	Executed copies, current terms
Change-of-control and assignment clauses	Which contracts need consent if the company is sold
SLAs	Uptime commitments and any credits paid
Data processing agreements	Signed DPAs where customers require them
Termination for convenience	Which customers can leave early, and on what notice

Product, code and IP

Item	What a reviewer checks
Contributor IP assignments	Signed by every founder, employee and contractor who wrote code
Open-source licences	A list of open-source components and their licence types
Third-party code and APIs	Licences and terms for what the product depends on
Trademarks and domains	Registered to the company, not to a founder
Repository access	Who has access today. Code access, if given, tends to come late in the process, under tight controls

Security and infrastructure

Item	What a reviewer checks
Cloud and vendor inventory	Every hosting provider and key vendor, with its contract
Incident history	Past security incidents and how each was handled
Security reports	A SOC 2 report or similar, if you have one. If not, say so plainly
Backups and recovery	How data is backed up and when recovery was last tested
Access control	Who can reach production, and how access is removed when people leave

Cap table and equity

Reviewers check the fully diluted cap table against the executed documents. SAFEs and convertible notes need their terms and a view of how they convert. Prepare your cap table before the room opens.

On Diligence Ready, What-If lets you "test a priced round, an option-pool refresh, or an exit waterfall against the live table, then hand the board a clean PDF."

Team and key-person risk

Item	What a reviewer checks
Founder dependence	Which systems, customers or decisions rely on one person
Runbooks	Written steps for deploys, on-call and billing operations
Key employee agreements	Executed offers, confidentiality and IP terms
Contractors	Agreements, and IP assignments for any code they wrote

Putting it in a data room, with a status for each item

A list helps only if you know where each item stands. Put every item above in the room and mark it Ready, Missing or Out of date. Use the data room checklist for the folder structure, and how to set up the data room for the sharing steps.

After the deal, keep it current. See staying diligence-ready.

FAQ

What do buyers check first in a SaaS company?

Often recurring revenue. Many reviewers rebuild ARR from the billing export and tie it to bank deposits before they move on to churn, retention and contracts.

What SaaS metrics are reviewed in due diligence?

ARR and MRR, logo and revenue churn, net revenue retention by cohort, and customer concentration. Reviewers check how each is defined and whether it ties to source data.

Do I need a SOC 2 report for due diligence?

Not always. Share one if you have it. If you do not, describe the security controls you do have, plainly and accurately.

Is this checklist for buyers or sellers?

Sellers and founders. It lists what a buyer or investor will check, so you can prepare the answers.