Due Diligence
SaaS due diligence checklist: 24 things to verify before a swap
Diligence is not about distrust — it is how you avoid discovering a problem after the keys have changed hands. This is the checklist we would run before swapping any SaaS, grouped so you can work through it in order.
Updated September 12, 2026
1. Financials (six checks)
- Stripe read-only access. Look at the dashboard yourself instead of trusting screenshots. Every serious listing should offer this.
- Revenue vs. MRR. Monthly recurring revenue excludes one-off payments. A product can look like $5k MRR while half the “MRR” is setup fees and lifetime deals.
- Net MRR movement. Compare new MRR against churn and downgrades for the last 6–12 months. Flat net growth means churn is eating expansion.
- Churn by cohort. Blended churn hides a cohort that leaves after 90 days. Ask for retention by signup month.
- Refunds, disputes and failed payments. High involuntary churn is an unglamorous but fixable problem — know whether you are buying it.
- Real cost base. Hosting, APIs, email, support tools, contractors. A $2k/month product with $1.4k of costs is a very different asset to one with $200 of costs.
2. Product and code (six checks)
- Who owns the code. Confirm every contributor assigned their work to the company, including freelancers and agencies.
- Deployment you can actually run. If only one person can ship, you are buying a dependency as well as a product. Ask for a walkthrough or a deploy from a clean environment.
- Third-party dependencies. Auth providers, AI APIs, payment processors, scraping services — note pricing tiers and the cost of one outage.
- Technical debt with a deadline. Deprecated APIs, expiring certificates, language versions past end of life.
- Security basics. Who can access production, is there 2FA, are secrets in the repo, when was the last dependency audit?
- Known outages. Ask for the last 12 months of incidents — a founder who tells you about them is more trustworthy than one who claims none.
3. Customers (four checks)
- Concentration. One customer at 30% of revenue is a business risk, not a win.
- Support load. Read a week of real support tickets — they show you what is actually broken and how demanding the base is.
- Contracts and commitments. Annual plans, SLAs, and enterprise discounts set expectations you inherit.
- Why customers stay. Ask for the reasons given in cancellation surveys and feedback forms, not the founder's summary of them.
4. Legal exposure (four checks)
- Trademarks. Is the product name registered, or does it collide with someone who is? This is one of the most common post-transfer surprises.
- Privacy and data handling. What personal data is stored, where, under what legal basis, with what deletion process?
- Open-source licences. A copyleft dependency in a commercial product is a real problem.
- Outstanding disputes. Chargebacks, DMCA notices, unpaid contractors, refund threats in writing.
5. Transfer mechanics (four checks)
- Repository and CI. Ownership of the repo, issue history, and pipeline must move together.
- Domains and DNS. Registrar access plus the zone file — not just a screenshot of records.
- Accounts in your name. Payment processor, hosting, email, analytics. Move billing to accounts you control before the handover is called complete.
- A signed transfer receipt. Write down what changed hands, when, and what was excluded — it is the difference between a clean swap and a year of ambiguity.
How to run this without killing the deal
Diligence works both ways. Send your own list to the other founder at the same time and keep the same standard. Ask for read-only access rather than exports — it is faster for them and more trustworthy for you.
Set a time box: a two-week diligence window is usually enough for a small product. Anything that cannot be shown in that window should be documented as an open item rather than skipped silently.
If you are still deciding whether a swap or a cash sale suits you, read swap vs. selling for cash first — diligence is cheaper than a bad decision.
Frequently asked questions
- How long should SaaS due diligence take?
- For a small product, a two-week window is usually enough if both founders share read-only access to the accounts that matter: Stripe, hosting, analytics and support. Larger products with contracts and customer concentration take longer.
- What is the most important thing to check?
- Revenue quality — net MRR movement and cohort churn over at least six months. It is the hardest thing to fake and it determines whether the product grows or quietly dies after the transfer.
- Should I hire a lawyer for a swap?
- For a small asset-for-asset swap, a written agreement and a transfer receipt covering what changed hands are often enough. If trademarks, customer contracts, personal data, or significant value are involved, a lawyer is worth the cost.
- What if the other founder will not grant access?
- Treat it as a signal. Read-only access to Stripe, analytics and hosting is standard and costs the other founder nothing. Refusing it means you cannot verify the numbers you are paying or trading for, and the right move is usually to walk away.
Ready to make a move?
HeySaaS is a founder-to-founder exchange for SaaS products, websites, and domains — no brokers, no commission, no cash between users. Listing is free until November 2026.