What buyers and growth investors request from a software-as-a-service company – recurring revenue data, customer contracts, technology, security and IP – organised as a numbered data room index.
SaaS due diligence starts from the same corporate, legal and tax folders as any company sale, but the price is set on recurring revenue, so most of the work goes into three questions: is the ARR real and contracted, will the customers stay, and can the product scale and stay secure without a rewrite? The metrics folder answers the first two, the technology and security folders the third.
Expect your numbers to be recomputed. Buyers, their quality-of-earnings providers and growth investors rebuild ARR, retention and churn from customer-level billing exports and contracts, not from the board deck – so upload the raw data, state the definitions you use and make sure the metrics reconcile to the accounts. A gap between the ARR in the deck and the ARR in the contracts is the most common reason for a price discussion late in the deal.
The technical review usually runs in parallel: a CTO or technical due diligence firm reads the architecture, the security reports and an open source scan, and talks to your engineering leads. Source code access, customer names and individual salaries come last, often only for the preferred buyer's outside advisers. Use the numbering below as folder names, so every request and answer points to the same index.
Numbered like a data room index: use the sections as folders and keep the numbers in file names.
The CSV opens in Excel, Numbers or Google Sheets. A practical starting point – adapt it to your deal and jurisdiction with your advisers.
The buyer's or investor's finance team or a quality-of-earnings provider (metrics, revenue recognition), a CTO or technical due diligence firm (architecture, code, security), lawyers (contracts, IP, data protection) and tax advisers (sales tax and VAT on digital services).
For an acquisition, commonly 4–12 weeks from the letter of intent, with technical due diligence running in parallel; for a Series A or B round, 3–6 weeks of confirmatory diligence after the term sheet.
Expect your metrics to be rebuilt from raw data, not read from your board deck. Put the raw exports in the room and state the definitions you used.
| Metric | How it is checked | Documents that support it |
|---|---|---|
| ARR / MRR | Recomputed per customer from contracts and billing; one-off services and usage that is not contracted are taken out | Customer-level ARR schedule, billing system export, contracts |
| ARR bridge | Opening ARR + new + expansion – contraction – churn = closing ARR, by month | Monthly ARR bridge for 24–36 months |
| Gross and net revenue retention | Cohort by cohort, with the definition stated (logo vs revenue, 12-month window) | Cohort table, customer-level data |
| CAC and payback | Sales and marketing cost by period against new ARR | P&L by function, headcount by team |
| Gross margin | Hosting, support and third-party costs in cost of revenue | Hosting invoices, cost allocation method |
| Deferred revenue | Reconciled to billing and the balance sheet | Deferred revenue roll-forward, revenue recognition policy |
For a software company the technical review often decides the price adjustments. A buyer's CTO or a technical due diligence firm typically asks for:
Share code walkthroughs and the repository under the same staged-access rules as customer data: the most sensitive material goes to the last remaining party, view only, with a watermark.
The review a buyer or investor runs on a software-as-a-service company before signing: recurring revenue and retention data, customer contracts, technology and security, IP and open source, team, tax and the usual corporate and legal documents.
ARR or MRR per customer, the monthly ARR bridge (new, expansion, contraction, churn), gross and net revenue retention by cohort, CAC and payback, gross margin and deferred revenue – recomputed from billing data and contracts.
A review of architecture, hosting, scalability, development process, security reports, incidents and open source licences, usually by the buyer's CTO or a specialist firm, with code access late in the process.
Late, with the preferred buyer only, and often only with its outside technical advisers – view-only access or a supervised session rather than a copy of the repository.
From a flat team price or a one-off pass (HelpRange: $199 for 90 days) to quote-based M&A rooms. Published prices and pricing models of 15 providers are compared in the data room software pricing comparison.