---
title: SaaS Due Diligence Checklist: Metrics, Tech, Security (CSV) | HelpRange
url: https://www.helprange.com/due-diligence-checklist/saas
---

[Due diligence checklists](https://www.helprange.com/due-diligence-checklist)

# SaaS due diligence checklist

What buyers and growth investors request from a software-as-a-service company – recurring revenue data, customer contracts, technology, security and IP – organised as a numbered data room index.

 [See the checklist](#checklist)

SaaS due diligence starts from the same corporate, legal and tax folders as any company sale, but the price is set on recurring revenue, so most of the work goes into three questions: is the ARR real and contracted, will the customers stay, and can the product scale and stay secure without a rewrite? The metrics folder answers the first two, the technology and security folders the third.

Expect your numbers to be recomputed. Buyers, their quality-of-earnings providers and growth investors rebuild ARR, retention and churn from customer-level billing exports and contracts, not from the board deck – so upload the raw data, state the definitions you use and make sure the metrics reconcile to the accounts. A gap between the ARR in the deck and the ARR in the contracts is the most common reason for a price discussion late in the deal.

The technical review usually runs in parallel: a CTO or technical due diligence firm reads the architecture, the security reports and an open source scan, and talks to your engineering leads. Source code access, customer names and individual salaries come last, often only for the preferred buyer's outside advisers. Use the numbering below as folder names, so every request and answer points to the same index.

## SaaS due diligence checklist – 8 folders, 47 documents

Numbered like a data room index: use the sections as folders and keep the numbers in file names.

### 1. Corporate & cap table

1. 1.1Certificate of incorporation and articles / bylaws
2. 1.2Fully diluted cap table with options, warrants, SAFEs and notes
3. 1.3Financing documents and investor rights agreements
4. 1.4Board minutes and shareholder resolutions (3 years)
5. 1.5Group structure and subsidiaries

### 2. Financials & SaaS metrics

1. 2.1Audited or reviewed financial statements and monthly management accounts
2. 2.2Customer-level ARR / MRR schedule (24–36 months)
3. 2.3Monthly ARR bridge: new, expansion, contraction, churn
4. 2.4Cohort retention: gross and net revenue retention, logo churn
5. 2.5CAC, payback and sales and marketing spend by period
6. 2.6Revenue recognition policy and deferred revenue roll-forward
7. 2.7Billing system export reconciled to the general ledger
8. 2.8Budget, forecast and pipeline

### 3. Customers & contracts

1. 3.1Top 20 customer agreements (MSA, order forms, amendments)
2. 3.2Standard terms of service and SLA
3. 3.3Renewal calendar with notice periods and auto-renewal terms
4. 3.4Contracts with termination for convenience, MFN, exclusivity or change-of-control clauses
5. 3.5SLA credits paid and customer escalations (2 years)
6. 3.6Reseller, marketplace and partner agreements

### 4. Product & technology

1. 4.1Architecture diagram and hosting set-up
2. 4.2Hosting and key infrastructure contracts with 12 months of spend
3. 4.3Product roadmap
4. 4.4Uptime history and incident post-mortems
5. 4.5Development process: code review, deployment, backups and restore tests
6. 4.6Known technical debt and planned rewrites
7. 4.7Source code escrow agreements

### 5. Security & data protection

1. 5.1SOC 2 Type II report or ISO 27001 certificate
2. 5.2Latest penetration test and remediation status
3. 5.3Information security policies
4. 5.4Security incident and data breach log
5. 5.5Standard data processing agreement and sub-processor list
6. 5.6Records of processing and data residency
7. 5.7Completed security questionnaires sent to enterprise customers

### 6. IP & open source

1. 6.1IP assignments from founders, employees and contractors
2. 6.2Open source licence scan of shipped code (copyleft flagged)
3. 6.3Third-party software, API and data licences
4. 6.4Trademarks, domains and patents
5. 6.5IP disputes or claims

### 7. Team

1. 7.1Organisation chart with engineering, sales and support headcount
2. 7.2Key employment contracts and non-competes
3. 7.3Option plan and grant register
4. 7.4Contractors and offshore development agreements
5. 7.5Commission plans and sales quotas

### 8. Tax

1. 8.1Corporate tax returns (3 years)
2. 8.2Sales tax / VAT registrations and collection by country or state
3. 8.3R&D tax credits and capitalised development costs
4. 8.4Transfer pricing for intercompany IP or services

   [Interactive checklist](https://www.helprange.com/tools/due-diligence-checklist)

 [Download Excel (XLSX)](https://www.helprange.com/due-diligence-checklist/saas.xlsx) [Folder structure (ZIP)](https://www.helprange.com/due-diligence-checklist/saas.zip)

Copy to Google Sheets

Open a new Google Sheet (sheets.new), click cell A1 and paste this formula – the checklist loads with Status, Owner, Due date and Notes columns:

To edit it, select all, copy and paste as values only (Ctrl+Shift+V).

The CSV opens in Excel, Numbers or Google Sheets. A practical starting point – adapt it to your deal and jurisdiction with your advisers.

[Create this room in HelpRange](https://www.helprange.com/?start=data-room-index#signUpSection)

** Who asks**

The buyer's or investor's finance team or a quality-of-earnings provider (metrics, revenue recognition), a CTO or technical due diligence firm (architecture, code, security), lawyers (contracts, IP, data protection) and tax advisers (sales tax and VAT on digital services).

** Typical timeline**

For an acquisition, commonly 4–12 weeks from the letter of intent, with technical due diligence running in parallel; for a Series A or B round, 3–6 weeks of confirmatory diligence after the term sheet.

** Red flags**
- ARR that includes one-off services or usage that is not contracted
- Net revenue retention computed without stating the definition
- Large customers on termination for convenience or with change-of-control rights
- Copyleft (GPL / AGPL) code in software shipped to customers
- Selling to enterprises without a SOC 2 or ISO 27001 report
- Sales tax or VAT on subscriptions not collected where it is due
- Core code written by contractors without IP assignments

### Turn this checklist into a data room

Generate the folder structure, upload documents under the same index numbers and share them with NDA acceptance, per-folder permissions, watermarks and page-level tracking. Max plan $87 per team per month for data rooms with NDA, Unlimited $174, or a one-off Deal Room Pass for $199 (90 days).

 [Generate a data room index](https://www.helprange.com/tools/data-room-index-generator) [Deal Room Pass – $199](https://www.helprange.com/deal-room-pass) [Compare plans – from $39 per team](https://www.helprange.com/pricing?from=checklist-cta)

## SaaS metrics buyers and investors recompute

Expect your metrics to be rebuilt from raw data, not read from your board deck. Put the raw exports in the room and state the definitions you used.

| Metric | How it is checked | Documents that support it |
|---|---|---|
| ARR / MRR | Recomputed per customer from contracts and billing; one-off services and usage that is not contracted are taken out | Customer-level ARR schedule, billing system export, contracts |
| ARR bridge | Opening ARR + new + expansion – contraction – churn = closing ARR, by month | Monthly ARR bridge for 24–36 months |
| Gross and net revenue retention | Cohort by cohort, with the definition stated (logo vs revenue, 12-month window) | Cohort table, customer-level data |
| CAC and payback | Sales and marketing cost by period against new ARR | P&L by function, headcount by team |
| Gross margin | Hosting, support and third-party costs in cost of revenue | Hosting invoices, cost allocation method |
| Deferred revenue | Reconciled to billing and the balance sheet | Deferred revenue roll-forward, revenue recognition policy |

## Technical and security due diligence

For a software company the technical review often decides the price adjustments. A buyer's CTO or a technical due diligence firm typically asks for:

- Architecture diagram, hosting set-up and the hosting bill for the last 12 months
- Uptime history, incident post-mortems and the SLA credits actually paid
- The latest penetration test with the remediation status of each finding
- SOC 2 Type II or ISO 27001 reports, or the security questionnaire you send enterprise customers
- An open source licence scan of the code that ships to customers (copyleft licences flagged)
- Development process: code review, deployment, access to production, backups and restore tests
- Access to the code itself – usually late, read-only, and sometimes only for outside advisers in a clean room

Share code walkthroughs and the repository under the same staged-access rules as customer data: the most sensitive material goes to the last remaining party, view only, with a watermark.

**Next steps:** [Data room software pricing comparison 2026](https://www.helprange.com/data-room-pricing-report) · [Data room index generator](https://www.helprange.com/tools/data-room-index-generator) · [M&A data room](https://www.helprange.com/virtual-data-room-for-ma) · [Fundraising data room](https://www.helprange.com/fundraising-data-room)

FAQ

## SaaS due diligence – questions

What is SaaS due diligence?

The review a buyer or investor runs on a software-as-a-service company before signing: recurring revenue and retention data, customer contracts, technology and security, IP and open source, team, tax and the usual corporate and legal documents.

Which SaaS metrics do buyers check?

ARR or MRR per customer, the monthly ARR bridge (new, expansion, contraction, churn), gross and net revenue retention by cohort, CAC and payback, gross margin and deferred revenue – recomputed from billing data and contracts.

What is technical due diligence for a SaaS company?

A review of architecture, hosting, scalability, development process, security reports, incidents and open source licences, usually by the buyer's CTO or a specialist firm, with code access late in the process.

When should source code be shared?

Late, with the preferred buyer only, and often only with its outside technical advisers – view-only access or a supervised session rather than a copy of the repository.

What does a SaaS data room cost?

From a flat team price or a one-off pass (HelpRange: $199 for 90 days) to quote-based M&A rooms. Published prices and pricing models of 15 providers are compared in the data room software pricing comparison.

 Related checklists

 [M&A due diligence](https://www.helprange.com/due-diligence-checklist/m-and-a)[Startup fundraising due diligence](https://www.helprange.com/due-diligence-checklist/startup-fundraising)[Financial due diligence](https://www.helprange.com/due-diligence-checklist/financial)[Legal due diligence](https://www.helprange.com/due-diligence-checklist/legal)

All checklists: [M&A due diligence](https://www.helprange.com/due-diligence-checklist/m-and-a) · [Legal due diligence](https://www.helprange.com/due-diligence-checklist/legal) · [Financial due diligence](https://www.helprange.com/due-diligence-checklist/financial) · [Tax due diligence](https://www.helprange.com/due-diligence-checklist/tax) · [Real estate due diligence](https://www.helprange.com/due-diligence-checklist/real-estate) · [Startup fundraising due diligence](https://www.helprange.com/due-diligence-checklist/startup-fundraising) · [Vendor due diligence](https://www.helprange.com/due-diligence-checklist/vendor) · [overview](https://www.helprange.com/due-diligence-checklist)
 Tools & data rooms

 [Interactive due diligence checklist](https://www.helprange.com/tools/due-diligence-checklist)[Data room index generator](https://www.helprange.com/tools/data-room-index-generator)[Due diligence cost calculator](https://www.helprange.com/tools/due-diligence-cost-calculator)[M&A data room](https://www.helprange.com/virtual-data-room-for-ma)[Fundraising data room](https://www.helprange.com/fundraising-data-room)[Data room with NDA](https://www.helprange.com/data-room-nda)[Best virtual data rooms](https://www.helprange.com/best-virtual-data-room)