What is the most important metric to verify when buying an online tool or app?

Monthly churn rate is the most critical metric, and it is the one sellers most commonly misrepresent, intentionally or otherwise. Verify churn independently by exporting all active subscriptions from the billing platform and calculating the monthly cancellation rate yourself, not from a summary the seller provides. A product claiming 1% monthly churn but with flat MRR over 12 months is mathematically inconsistent unless growth is also zero, investigate the discrepancy. After churn, verify the composition of the active user base: a product with 500 subscribers where 200 are non-renewing lifetime deal users has an effective recurring MRR from only 300 customers and a true churn rate that is meaningfully higher than the headline figure.

Do I need technical skills to buy a software tool or app?

No, but you need access to someone technical before you close. The financial, customer, legal, and traffic due diligence areas can all be completed without coding knowledge. The technical review, codebase quality, dependency audit, API risk assessment, and infrastructure evaluation, requires a developer. Hiring an independent developer for a one-time technical review ($300-$1,000) is standard practice for any tool or app acquisition over $10,000. Frame it as a structural inspection before buying a house: even if you plan to hire a developer post-acquisition to maintain the product, the pre-acquisition technical review gives you leverage to negotiate price, reveals what you are actually inheriting, and protects you from discovering critical technical debt after closing.

How long does tool and app due diligence take?

For a small tool ($5,000-$50,000 acquisition price), plan for 1-2 weeks of active due diligence after the seller grants access. Financial and revenue verification (2-3 days), churn and cohort analysis (1-2 days), technical codebase review by a developer (3-7 days), customer base and concentration analysis (1 day), API dependency audit (1-2 days), and legal and IP review (1-3 days if you use a lawyer). For deals above $100,000, budget 3-5 weeks and consider a formal Quality of Earnings (QoE) report ($2,000-$8,000) from an independent accountant. Tools with complex infrastructure, multi-region deployments, significant mobile components, or third-party data licensing, take longer to review on the technical side.

What due diligence red flags should cause me to walk away from a tool acquisition?

Walk away or demand a significant price reduction if you find: (1) MRR that cannot be reconciled with bank statements by more than 10%, unexplained discrepancies indicate revenue fabrication or undisclosed costs; (2) Monthly churn above 8%, the product will shrink faster than you can replace customers regardless of your growth efforts; (3) No source code repository access before closing, the code is the core asset; a seller who refuses developer access during due diligence has something to hide; (4) AI API or third-party costs exceeding 40% of revenue, a single pricing change by the provider can make the product uneconomical; (5) Core infrastructure accounts (Apple App Store developer account, payment processor, hosting) that cannot be independently transferred to a new owner's accounts without the seller. Any single confirmed red flag is grounds to renegotiate; two or more is grounds to walk away.

Tool & App Due Diligence Checklist

A complete 8-area due diligence framework for evaluating an online tool, web app, or browser extension before acquisition. Use this checklist alongside the general website due diligence guide and the website acquisition checklist. Tool and app acquisitions require deeper technical scrutiny than most other business types because the core assets, the codebase, the API integrations, and the infrastructure accounts, are entirely invisible until you dig in.

1.Financial due diligence: MRR, ARR, and revenue verification

Request Stripe, Paddle, or Lemon Squeezy dashboard access, verify MRR by exporting all active subscriptions and summing recurring charges independently
Cross-reference billing platform MRR against seller's stated MRR, a discrepancy of more than 5% requires a detailed explanation
Review MRR over the trailing 24 months, identify growth trend, plateau, or decline and any unexplained spikes
Verify that MRR excludes one-time charges, setup fees, AppSumo lifetime deal (LTD) payments, and non-recurring revenue
Request bank statements for the past 12 months, confirm deposits match billing platform payouts (accounting for processor fees)
Identify and isolate any lifetime deal users, calculate what MRR looks like when LTD users are excluded, since they do not renew
Confirm SDE: (MRR × 12) minus all annual operating costs (hosting, API costs, tools, support staff, software subscriptions) plus add-backs for owner salary
Verify add-backs are credible: non-recurring expenses or personal costs claimed to increase SDE must be documented with receipts or invoices

2.Churn analysis and user retention

Request monthly churn rate data for the trailing 24 months, calculate as (users cancelled in month / users at start of month) × 100
Ask for cohort retention data: for users who started 1, 3, 6, and 12 months ago, what percentage are still active?
Calculate Net Revenue Retention (NRR), above 100% signals expansion revenue offsets cancellations; below 85% indicates a retention problem
Separately calculate Gross Revenue Retention (GRR) excluding expansion, GRR above 90% for B2B and 80% for B2C is a healthy benchmark
Identify whether churn is concentrated in a specific pricing tier, acquisition channel, or user segment
Check whether the annual plan rate is above 50%, users on annual plans churn at 3-5× lower rates than monthly subscribers
Request cancellation survey data, what reasons do users give when they cancel?
Verify that a churn improvement trend is real, not cosmetic, a seller may have tightened cancellation flows without improving product retention

3.Technical due diligence: codebase and infrastructure

Hire an independent developer to review the codebase, budget $300-$1,000 for a technical review; this is non-negotiable for any acquisition over $10,000
Identify the programming language, framework, database, and hosting infrastructure, confirm the stack is modern and maintainable by a generalist developer
Check for hardcoded API keys, credentials, or secrets in the repository, these represent a security risk and signal poor engineering practices
Review dependency list for outdated packages with known CVEs (security vulnerabilities) using tools like npm audit or Snyk
Assess test coverage, low or no automated tests significantly increase the risk of breaking functionality when making post-acquisition changes
Check database size, schema design, and complexity, large, poorly structured databases are expensive to modify and migrate
Review hosting and infrastructure costs for the trailing 12 months, verify that cost-to-revenue ratio is sustainable and predictable
Evaluate completeness of technical documentation, architecture diagrams, runbooks, and deployment procedures reduce post-acquisition risk significantly

4.API and third-party dependency risk

List every third-party API the product calls, classify each as critical-path (product breaks without it) or non-critical
For each critical-path API, assess: pricing model (flat vs usage-based), pricing history (any increases?), provider financial stability, and availability of alternatives
Check whether the product is built primarily on top of a single platform (OpenAI, Zapier, Notion, Slack), platform-dependent tools face existential risk from policy changes
Verify that all API keys, service accounts, and developer platform memberships (Apple Developer, Google Play) can be fully transferred to a new owner
Calculate API costs as a percentage of revenue, if third-party API costs exceed 30% of revenue, price increases create direct SDE compression risk
Verify any AI API (OpenAI, Anthropic, Google AI) usage, confirm cost per request, current monthly spend, and what happens to SDE if API pricing doubles
Identify licensed data suppliers or datasets, confirm that data licenses are transferable and review their terms
Review the Terms of Service for each critical API, confirm that transferring the product to a new owner does not violate usage restrictions

5.Customer base and concentration analysis

Request the full customer list with MRR per customer, identify the percentage of total MRR from the top 5, 10, and 20 customers
Red flag: any single customer contributing more than 20% of MRR creates dangerous concentration risk that may not survive an ownership change
Identify whether the customer base is B2B or B2C, B2B customers churn less but are harder to replace; B2C has higher volume but higher churn
Check the distribution of pricing tiers, a healthy tool has customers across multiple price points, not all in the cheapest plan
Ask how many customers came from lifetime deals, LTD users inflate customer count without contributing to recurring MRR
Verify customer acquisition channels and whether those channels will continue to work for a new operator without the seller's personal brand
Request feature usage data, identify which features are actually being used to understand where the product's core value lies
Ask for Net Promoter Score (NPS) data if available, an NPS above 40 is a strong signal of user satisfaction and retention moat

6.Legal and IP ownership review

Confirm the business structure, are you buying assets (code, domain, customer list) or the legal entity? Most tool acquisitions are asset purchases
Verify that all code in the repository was written by the seller or by contractors under valid work-for-hire agreements, IP gaps mean you may not own what you paid for
Check all open-source licenses in the codebase, MIT and Apache licenses are generally permissive; GPL licences may restrict commercial use or require code disclosure
Confirm all customer contracts allow assignment to a new owner without requiring individual customer consent
Review Terms of Service and Privacy Policy for GDPR and CCPA compliance, verify a new owner can continue to use and process customer data
Review payment processor terms, confirm Stripe, Paddle, or other accounts can be transferred or that a migration path exists
Check for any outstanding disputes, chargebacks, or refund requests in the past 12 months
Confirm that all domain names, trademarks, and brand assets included in the acquisition are owned by the seller with no third-party claims

7.Traffic, SEO, and growth channel verification

Request read-only access to Google Analytics 4, verify monthly active users, traffic sources, and trend over the trailing 24 months
Request read-only access to Google Search Console, verify organic keyword rankings, click-through rates, and check for manual action warnings
For tools with SEO-driven acquisition, cross-reference GA4 organic traffic against Ahrefs or Semrush estimated organic traffic, significant divergence can indicate bot traffic
Verify paid acquisition channels: request ad platform data, confirm CAC, ad spend, and whether paid CAC is sustainable without the seller's personal involvement
For product-led growth tools, verify trial-to-paid conversion rate and activation rate independently from the billing platform
Check for any traffic drops or ranking declines in the 1-3 months before listing, a sudden traffic loss shortly before a sale is a major red flag
Verify that any MRR growth is from genuine new paying customers, not a one-time LTD campaign or a single enterprise contract
Confirm that organic discovery or product-led growth does not depend on the seller's personal brand, social following, or content production

8.Transfer planning and handover checklist

Confirm that the source code repository (GitHub, GitLab, or Bitbucket) can be fully transferred, verify repository ownership with no shared co-owners or contributors who hold admin access
Verify all hosting accounts (AWS, GCP, Vercel, Render, Heroku, DigitalOcean) can be transferred or migrated, confirm no shared tenancy with other products owned by the seller
Confirm domain name and DNS control, obtain the EPP/auth code for domain transfer before releasing escrow funds
Verify payment processor account transfer feasibility, Stripe supports account ownership transfers; Paddle and Lemon Squeezy require new accounts with customer migration
List all third-party accounts that must transfer or be recreated: email service providers, monitoring tools (Sentry, Datadog), analytics, and support platforms
Verify App Store or Google Play account transferability if the product has a mobile component, developer account transfers require identity verification and can take weeks
Negotiate a transition support period of 30-90 days, define specific weekly availability (e.g., 2-3 hours/week) and scope of support in the Asset Purchase Agreement
Use Escrow.com and release funds only after verifying full access to every critical system, do not release escrow based on a promise of post-close access

Key tool and app due diligence benchmarks

Monthly churn rate

Good: Under 2%

Caution: 2-5%

Red flag: Over 5%

Annual plan rate

Good: Over 60%

Caution: 30-60%

Red flag: Under 30%

API cost as % of revenue

Good: Under 15%

Caution: 15-30%

Red flag: Over 30%

Customer concentration

Good: Top customer under 10% MRR

Caution: Top customer 10-20% MRR

Red flag: Top customer over 20% MRR

Net Revenue Retention

Good: Over 100%

Caution: 85-100%

Red flag: Under 85%

LTD users as % of active base

Good: Under 20%

Caution: 20-40%

Red flag: Over 40%

Frequently asked questions

What is the most important metric to verify when buying an online tool or app?: Monthly churn rate is the most critical metric, and it is the one sellers most commonly misrepresent, intentionally or otherwise. Verify churn independently by exporting all active subscriptions from the billing platform and calculating the monthly cancellation rate yourself, not from a summary the seller provides. A product claiming 1% monthly churn but with flat MRR over 12 months is mathematically inconsistent unless growth is also zero, investigate the discrepancy. After churn, verify the composition of the active user base: a product with 500 subscribers where 200 are non-renewing lifetime deal users has an effective recurring MRR from only 300 customers and a true churn rate that is meaningfully higher than the headline figure.
Do I need technical skills to buy a software tool or app?: No, but you need access to someone technical before you close. The financial, customer, legal, and traffic due diligence areas can all be completed without coding knowledge. The technical review, codebase quality, dependency audit, API risk assessment, and infrastructure evaluation, requires a developer. Hiring an independent developer for a one-time technical review ($300-$1,000) is standard practice for any tool or app acquisition over $10,000. Frame it as a structural inspection before buying a house: even if you plan to hire a developer post-acquisition to maintain the product, the pre-acquisition technical review gives you leverage to negotiate price, reveals what you are actually inheriting, and protects you from discovering critical technical debt after closing.
How long does tool and app due diligence take?: For a small tool ($5,000-$50,000 acquisition price), plan for 1-2 weeks of active due diligence after the seller grants access. Financial and revenue verification (2-3 days), churn and cohort analysis (1-2 days), technical codebase review by a developer (3-7 days), customer base and concentration analysis (1 day), API dependency audit (1-2 days), and legal and IP review (1-3 days if you use a lawyer). For deals above $100,000, budget 3-5 weeks and consider a formal Quality of Earnings (QoE) report ($2,000-$8,000) from an independent accountant. Tools with complex infrastructure, multi-region deployments, significant mobile components, or third-party data licensing, take longer to review on the technical side.
What due diligence red flags should cause me to walk away from a tool acquisition?: Walk away or demand a significant price reduction if you find: (1) MRR that cannot be reconciled with bank statements by more than 10%, unexplained discrepancies indicate revenue fabrication or undisclosed costs; (2) Monthly churn above 8%, the product will shrink faster than you can replace customers regardless of your growth efforts; (3) No source code repository access before closing, the code is the core asset; a seller who refuses developer access during due diligence has something to hide; (4) AI API or third-party costs exceeding 40% of revenue, a single pricing change by the provider can make the product uneconomical; (5) Core infrastructure accounts (Apple App Store developer account, payment processor, hosting) that cannot be independently transferred to a new owner's accounts without the seller. Any single confirmed red flag is grounds to renegotiate; two or more is grounds to walk away.

Related guides

Ready to browse online tools and apps for sale?

Apply this checklist to live listings, browse tools and apps with verified revenue, direct from founders, no broker fees.

Browse tool and app listings Tool and app buying guide