Due diligence checklist for buying a SaaS or AI startup

Due diligence for a SaaS or AI startup means proving five things before you pay: the revenue is real, the customers will stay, the code works and belongs to the seller, the contracts transfer, and the business does not depend on one fragile input. Use the checklist below as a working document and tick off each item with evidence, not promises.

This is general education, not legal or financial advice. Have a lawyer and an accountant review any real deal.

How to run due diligence without drowning

Start with the items most likely to kill the deal, which are revenue and ownership. Then work outward. Ask for documents through a shared folder, keep a log of questions and answers, and put the seller's key claims into the purchase agreement as warranties.

The sellers' side of the table works from similar lists. FE International's sell-side due diligence checklist is a good picture of what a prepared seller should hand you, and it says buyers will try to tie revenue to bank statements, check add-backs and rebuild ARR from contracts. You should do the same.

1. Financial due diligence

Revenue and bank proof

• Monthly financial statements for the past 24 to 36 months, with the books closed.
• Payment provider reports and a read-only login or a verified connection. Stripe supports restricted keys with read-only permissions, so a seller can share data without giving up control, as described in Stripe's restricted API keys guide.
• Bank statements showing payouts that match the payment provider's totals.
• A schedule of refunds, disputes and chargebacks.

Profit and add-backs

• A profit and loss statement where every add-back is backed by an invoice, payroll record or contract.
• A list of recurring costs: hosting, AI and API usage, software, contractors, support tools.
• A 24-month view of working capital and seasonality.

Tax and compliance

• Sales tax and VAT treatment for digital services in the countries where customers live.
• Contractor versus employee classification.
• Any open tax notices or audits.

For larger deals, a quality of earnings report from an independent accountant is worth the cost.

2. Customer and revenue quality

• Cohort retention. Monthly tables showing how many customers and how many dollars remain after 3, 6 and 12 months.
• Net revenue retention and churn. FE International notes that buyers commonly test for net revenue retention above 100 percent, annual churn below 10 percent and gross margin above 75 percent. If the business falls short, ask for the reasons and the fixes.
• Top 20 customers. Revenue, plan, contract length and renewal date.
• Concentration. Any customer above 10 percent of revenue should be called, with the seller's permission.
• Pricing history. Discounts, promotions and grandfathered plans that may reverse.
• Acquisition channels. Where customers come from, and whether one channel such as a single search ranking or a single affiliate carries most of the load.

You can sanity check demand from the outside. The traffic checker models monthly visits and shows top regions, tech stack and SEO health for any domain, which helps you compare what the seller says with what the public data suggests.

3. Product and code

Ask a developer you trust to review the code before closing. Do not rely on the seller's description alone.

• Repository access. Full history, not a zip file of the latest version.
• Architecture and documentation. How the app is deployed, how data flows, how backups run.
• Open source licenses. Watch for copyleft licenses such as GPL or AGPL in code the product ships. A software composition analysis tool can scan this quickly.
• Security. Recent penetration tests, an incident log, access control and backup restoration tests.
• Technical debt. How long a typical new feature takes, how many known bugs exist and how many hours a week the owner spends on maintenance.
• AI-generated code. Ask whether assistants wrote parts of the codebase and whether anyone reviewed licensed snippets. FE International's checklist flags this as an item sellers should check.

4. AI-specific checks

AI startups carry risks that ordinary SaaS does not.

• Model dependence. Which providers and models does the product call? What happens if pricing, rate limits or terms change? Is there a fallback model?
• Unit economics. Compute cost per customer and per unit of revenue. Heavy users on a flat plan can erase margin.
• Training and data rights. Where did the data come from, and does the seller have the right to use it commercially? Does the business use customer data to improve models, and do customers know?
• Prompt and pipeline assets. Are prompts, fine-tuned weights and evaluation sets stored in the repository and included in the sale?
• Output risk. Does the product make claims in regulated areas such as health, finance or legal advice? Are there content filters and abuse controls?
• Defensibility. What stops a competitor from copying the product with the same model? Proprietary data, integrations and distribution matter more than prompt wording.

5. Legal and IP

• Chain of title. Signed IP assignments from every founder, employee and contractor who wrote code, designed the product or made content. Offshore freelancers and early helpers are the usual gaps.
• Ownership of brand assets. Trademarks, domains and social handles registered to the company or seller, not to a former partner.
• Customer contracts. Check for assignment limits, change-of-control clauses, exclusivity, most-favored-customer pricing and uncapped liability.
• Vendor agreements. Hosting, data and API contracts that may not transfer to a new owner.
• Privacy and compliance. Privacy policy, data processing agreements, consent records and a sub-processor list that matches how data actually flows.
• Cap table. If the seller is a company with investors, reconcile equity, options, SAFEs and convertible notes to signed documents.
• Litigation. Any pending or threatened claims, takedown notices or platform warnings.

6. Operations and dependencies

• A map of everything the business runs on: domain registrar, DNS, cloud, email, support desk, payment provider, analytics, app stores.
• A list of recurring tasks with hours per week for each, so you know what you are inheriting.
• Support volume and the ten most common customer complaints.
• Single points of failure, such as one contractor who knows the system.

7. Platform and channel risk

Ask what happens if a major channel goes away.

• If most traffic comes from search, review the SEO audit and backlinks. The 16 SEO checks in a StartupsIntel site report are a quick outside view, and a full crawl by your own SEO tool is better.
• If distribution runs through an app store, a marketplace or a partner, read the terms and look for any history of warnings.
• If most revenue comes from one country or one payment method, understand why.

8. A simple scoring system

Mark each category green, amber or red.

Category	Green	Red
Revenue	Ties to payment data and bank	Gaps or only screenshots
Retention	Stable or improving cohorts	Churn hidden by new sales
Code	Documented, licensed cleanly	Unknown licenses, no history
IP	Signed assignments for everyone	Missing contractor agreements
Dependencies	Fallbacks exist	One provider can sink margin

Any red in revenue, IP or code ownership should pause the deal until fixed. Amber items belong in price negotiations or in the warranties. See red flags in startup listings for patterns worth walking away from.

9. After due diligence

Turn what you found into deal terms.

• Adjust the price, or use an earn-out for risks the seller believes are small. See financing a startup acquisition.
• Add warranties covering revenue accuracy, IP ownership and absence of undisclosed liabilities.
• Hold back part of the price in escrow for a period after closing.
• Write a transition plan with named tasks and dates. Then follow the first 90 days after buying a startup.

For a faster start, listings on the Buy a startup marketplace have revenue verified from the payment provider, which removes the first and most common problem.

FAQ

How long does due diligence take for a small SaaS?

For a small deal, expect two to four weeks if the seller has organized records. Missing documents, slow answers or a code review that finds problems can double that.

What is the biggest due diligence mistake buyers make?

Trusting screenshots and summaries instead of source data. Always tie revenue to the payment provider and bank deposits yourself.

Do I need a lawyer for a small acquisition?

It is strongly advisable. An asset purchase agreement, IP assignments and warranties protect you, and a lawyer will spot clauses a buyer would miss.

What should I do if I find a problem?

Decide whether it is fixable, priceable or fatal. Fixable issues can be solved before closing, priceable ones go into the offer, and fatal ones mean you walk away.