SaaS due diligence: the metrics, code and contracts a buyer will ask for

Selling a software business is selling a promise about future renewals. The buyer cannot see the future, so it looks for evidence: how past customers behaved, how revenue was counted, whether the product can be maintained and secured, and whether anything in the contracts or the codebase could stop the revenue moving with the company.

That makes SaaS diligence more data-heavy than many sectors. A manufacturing deal leans on assets and contracts. A SaaS deal leans on spreadsheets that must tie to invoices. This guide covers what buyers ask for, in what order, and how to set up the room so the answers are ready.

What is SaaS due diligence?

SaaS due diligence is the investigation a buyer or investor runs on a software-as-a-service company before a transaction, covering recurring revenue metrics, financial reporting, technology and code, security and privacy, customer and vendor contracts, and people. It overlaps with general technology due diligence but puts more weight on subscription economics.

The buyer may be a strategic acquirer, a private equity fund, or a growth investor. Private equity buyers tend to go deepest on metrics and cost structure; strategic buyers go deepest on product overlap and integration. Our private equity hub covers how sponsor processes run.

Which SaaS metrics will a buyer test?

The core set is small, but each metric has a definition fight hidden inside it. Agree definitions in a metrics memo at the top of the folder.

A buyer will usually rebuild ARR from the billing system and a sample of contracts. If the seller’s bridge does not reconcile to that rebuild, every other number becomes suspect. This is where a quality of earnings review often starts.

How should a SaaS data room be organized?

The folder structure above puts the metrics and code folders where reviewers expect them. A few practical points:

• Data exports, not screenshots. Provide metrics as spreadsheets with formulas intact, plus the raw billing export they are built from.
• One version of the truth. If the board pack, the management accounts and the metrics pack show different ARR, explain the differences in a reconciliation file.
• Customer contracts by tier. Upload all contracts for the top customers and a representative sample for the long tail, with a schedule listing every customer and key terms.
• Restricted folders for the sensitive parts. Source code access, customer names for a competitor buyer, and individual salaries belong behind tighter permissions.

What does revenue recognition review look for?

Under ASC 606 and IFRS 15, SaaS companies recognize subscription revenue over the service period, not when invoiced. Reviewers check that the policy matches the contracts: how multi-year prepaid deals are handled, whether implementation fees are separate performance obligations, how discounts and free months are spread, and how usage-based fees are estimated.

Deferred revenue gets close attention because it is a liability the buyer inherits. A roll-forward that ties billings, recognized revenue and deferred revenue month by month answers most questions before they are asked. The standard-setters’ material is published by the FASB and the IFRS Foundation.

How is the code reviewed?

Technical diligence on a SaaS company has three main parts.

Ownership. Does the company own everything it ships? Every employee and contractor who wrote code should have assigned their IP. Contractors and early founders are the usual gaps, especially if the first version was built by an agency.

Open-source use. Almost all software uses open-source components. Reviewers run a scan to list them and their licenses, then look for copyleft licenses that could require disclosure of proprietary code if distributed. For a purely hosted service, the risk profile is different from distributed software, but some licenses address network use specifically. The Open Source Initiative maintains the list of approved licenses and their texts.

Quality and scalability. Architecture, technical debt, test coverage, deployment practices, and whether the system can handle the growth in the plan. This part usually happens in interviews and a controlled code review, not by uploading the repository.

What security and privacy evidence should be ready?

A SaaS company holds its customers’ data, so the buyer inherits that risk. Expect requests for:

• SOC 2 Type II or ISO 27001 evidence, or a clear statement that the company has neither.
• Recent penetration tests and how findings were fixed.
• An incident log, including near misses, and any customer notifications.
• The standard data processing agreement and a subprocessor list.
• Privacy notices and any regulator correspondence.
• A list of AI features and the model providers they use, if any.

Buyers increasingly map these to a recognized framework such as the NIST Cybersecurity Framework to compare targets consistently. Our guide to the data room security questionnaire covers the same evidence from a buyer of software, which is a useful mirror for a seller preparing its own pack.

Which customer contract terms can block a deal?

Read the top customer contracts for:

How long does SaaS due diligence take?

For a growth-stage company with clean records, four to eight weeks is typical from data room opening to signing. Metrics disputes, code ownership gaps and customer consent requirements are the usual reasons it runs longer. Preparation shortens it more than anything the buyer can do; a seller who has run a mock diligence will answer most first-round questions from the room.

How to prepare a SaaS company for due diligence

1. Write the metrics memo

   Define ARR, retention and churn exactly as you calculate them, and keep the definitions stable across all periods.

2. Reconcile the numbers

   Tie the ARR bridge to the billing export and the accounts, and explain every difference in one reconciliation file.

3. Close IP gaps

   Collect signed IP assignments from every past and present engineer and contractor, and fix gaps before the room opens.

4. Run an open-source scan

   Commission a scan, review the license report with counsel and remediate anything problematic.

5. Assemble the security pack

   Gather audit reports, pen tests, the incident log, DPA and subprocessor list in one folder.

6. Schedule customer contracts

   List every customer with term, renewal, assignment and termination rights, and upload top contracts in full.

Which data room features help a SaaS sale?

Spreadsheet-heavy rooms need good Excel handling: view-only access that preserves formulas for reviewers who need them, or download rights for the buyer’s financial advisers only. Permission groups matter because a strategic buyer may be a competitor and should see customer names only through a clean team. Q&A volume is high, so a module with categories and approval saves time.

Our M&A hub and venture and fundraising hub list rooms suited to each stage. Ellty, iDeals and Datasite, all full deal rooms in our directory, cover Q&A, granular permissions and an audit trail; check spreadsheet handling during a trial.