- What is the most important thing to verify when doing SaaS due diligence?
- Churn rate is the single most important metric to verify and the hardest to fake accurately. A seller claiming 1% monthly churn but with declining MRR over the past 6 months is inconsistent — verify churn independently by calculating it from the raw customer-level subscription export, not from a summary the seller provides. After churn, verify the independence of the customer base from the founder: if the top 3 customers are personal contacts of the seller who will leave when the founder does, the business is worth far less than its headline metrics suggest.
- Do I need to be technical to do SaaS due diligence?
- No, but you need access to someone technical. The financial, customer, legal, and traffic due diligence areas can all be completed without coding knowledge. The technical due diligence area — codebase review, security assessment, dependency audit — requires a developer. Hiring an independent developer for a one-time technical review ($300–$1,000) is standard practice for any SaaS acquisition over $10,000. Frame it as a structural inspection before buying a house. Even if you plan to hire a developer post-acquisition to maintain the product, an independent pre-acquisition review gives you leverage to negotiate price and protects you from discovering critical technical debt after closing.
- How long does SaaS due diligence take?
- For a small SaaS ($5,000–$50,000 acquisition price), plan for 1–2 weeks of active due diligence after the seller grants access. Financial and revenue verification (2–3 days), churn and cohort analysis (1–2 days), technical review by a developer (3–7 days), customer base and concentration analysis (1 day), and legal review (1–3 days if you use a lawyer). For deals above $100,000, budget 3–5 weeks and consider commissioning a formal Quality of Earnings (QoE) report ($2,000–$8,000) from an independent accountant — this is standard for mid-market transactions and gives you the most defensible basis for price negotiation.
- What SaaS due diligence red flags should cause me to walk away?
- Walk away if you find: (1) MRR that cannot be reconciled with bank statements — unexplained discrepancies of more than 10% indicate revenue fabrication. (2) Monthly churn above 8% — the business will shrink faster than you can replace customers. (3) More than 40% of MRR from one customer — single-customer concentration makes the acquisition a bet on one relationship. (4) Hardcoded credentials in the codebase combined with a seller who won't allow a developer review — this combination suggests hidden technical liabilities. (5) A recent MRR spike (last 1–3 months) that the seller cannot explain with verifiable customer data — this pattern often indicates a lifetime deal campaign designed to inflate trailing MRR before listing. Any one of these, if confirmed, is sufficient justification to walk away or demand a significant price reduction.