SaaS buyers examine whether the company owns what it sells, can transfer its commercial relationships, and has documented its legal obligations. Buyer’s counsel will review corporate records, equity issuances, tax history, employment matters, disputes, and regulatory compliance. SaaS diligence adds deeper review of source code, subscription contracts, customer data, and third-party software.
IP ownership often becomes a threshold concern. A buyer will trace code and other intellectual property back to founders, employees, and contractors. If an early developer never signed an invention-assignment agreement, payment records or repository access will not establish that the company owns the work. Counsel may need to obtain a confirmatory assignment before the transaction proceeds.
Recurring revenue receives similar scrutiny because contract terms determine whether revenue can continue after closing. Buyers review renewal rights, termination provisions, service commitments, pricing concessions, and change-of-control requirements. They often focus first on contracts representing the most revenue or operational dependence. A consent requirement in a major customer agreement can affect transaction timing and structure.
Software and data practices create additional diligence work. Buyers may scan the codebase for open-source components whose licenses require disclosure or distribution of derivative code. They also compare privacy policies and customer promises against actual data handling, security controls, breach records, and vendor agreements. Gaps between written commitments and company practices can require remediation or specific disclosure.
Founders should also expect review of the cap table, option grants, board approvals, contractor classifications, litigation, and sales tax exposure. Cross-border operations may add foreign subsidiaries, international data transfers, and local employment obligations.
Late discoveries give a buyer more room to request additional protections, holdbacks, indemnities, consents, or closing conditions. Early sell-side diligence lets founders identify missing documents and decide which issues can be corrected before a buyer controls the timetable. Preparation can make diligence more orderly, but it cannot guarantee a valuation or closing.
Buyers treat IP ownership as a threshold issue because the company must own the software and related assets included in the sale. A clean chain of title connects each contributor’s work to the company through signed agreements. Product use, repository access, or payment records do not transfer ownership by themselves.
Founders should collect signed invention and IP assignment agreements from every founder, employee, and contractor who contributed to the product. Employee agreements should cover inventions, source code, documentation, and other work created within the person’s role. California agreements should include the required notice about statutory limits on employee invention assignments. Counsel should review the governing law and scope for contributors in other states or countries.
Contractor records often create the largest gaps. Under U.S. copyright law, a contractor generally owns their work unless a written agreement transfers the relevant rights. A contract that labels software as “work made for hire” may not provide a complete transfer, so the agreement should include a present assignment of intellectual property rights. Confidentiality language alone does not establish ownership.
Early contributors require separate attention. A friend who wrote code without pay, an agency hired before incorporation, or a founder who developed the product through another entity may retain rights. You should identify each contributor, match that person or entity to a signed assignment, and document any later transfer to the current company. If an assignment is missing, counsel can prepare a confirmatory assignment before buyer diligence begins.
The diligence folder should include executed agreements, amendments, and confirmatory assignments. It should also contain records for company trademarks, domains, patents, and acquired code. Zecca Ross Law Firm can review startup contracts and trace ownership gaps as part of pre sale diligence for SaaS transactions under $100 million. Counsel should complete that review early because former contributors become harder to locate and negotiate with over time.
Buyer’s counsel checks whether the cap table matches the company’s legal records. Counsel typically reviews formation documents, amendments, bylaws, board and stockholder approvals, equity purchase agreements, option grants, securities filings, and the stock ledger. A spreadsheet or cap table platform helps organize the numbers, but it does not replace signed documents authorizing each issuance.
Missing approvals often create more work than incorrect calculations. Common gaps include unsigned board consents, option grants issued without board approval, stock certificates that were never delivered, and a stock ledger that omits early founders or advisors. Your counsel may be able to prepare corrective approvals or ratifications, but the available remedy depends on the governing state law and the underlying facts.
SAFEs and convertible notes require a separate reconciliation. Buyer’s counsel will compare each instrument’s valuation cap, discount, maturity terms, amendments, and conversion provisions against the cap table. Side letters and inconsistent document versions can change the conversion calculation. You should model each conversion scenario and confirm that every instrument in the files appears on the capitalization schedule.
Cross-border ownership adds another layer of review. A buyer may need records for foreign parent companies, subsidiaries, nominee arrangements, prior reorganizations, and transfers into a U.S. corporation. Tax treatment and local corporate approvals may also affect whether an ownership transfer was valid. Founders with foreign entities or shareholders should review Zecca Ross’s cross-border startup acquisitions guidance and involve counsel familiar with both the U.S. transaction and the relevant foreign records.
Before opening diligence, reconcile every cap table entry to a signed agreement and valid approval. Keep a short exceptions list for any item that still needs correction, rather than leaving buyer’s counsel to discover the discrepancy.
Assignment and change-of-control clauses can affect whether a buyer may take over key customer and vendor contracts without consent. An assignment clause may restrict transferring a contract to another legal entity. A separate change-of-control clause may apply when the company’s ownership changes, even if the contracting entity remains the same. The transaction structure often determines which restriction applies.
Start by collecting every signed master agreement, order form, amendment, and side letter. Compare the documents because a later order form may override the master agreement. Record whether each contract permits assignment, requires notice, requires written consent, or gives the counterparty a termination right. Related startup contract guidance can help founders identify common drafting variations, but transaction counsel should interpret each clause in the context of the proposed sale.
Prioritize customer contracts by revenue contribution and strategic importance. A consent requirement for a top account deserves earlier attention than the same requirement in a small, replaceable contract. You should also flag unusual pricing commitments, service credits, and renewal rights because a buyer will assess the obligations it must assume. Counsel can then create a consent plan without contacting customers before the sale process permits disclosure.
Vendor contracts require the same review, especially agreements supporting hosting, payment processing, or essential software. A buyer may need assurance that these services will continue after closing and that favorable pricing will survive the transaction. Missing consents can influence transaction structure, closing conditions, or post-closing obligations, so founders should identify them before buyer diligence begins.
Buyers compare your privacy and security promises with your actual handling of customer data. Inconsistencies can raise questions about contractual compliance, regulatory exposure, and whether enterprise customers received accurate security representations.
Your privacy policy should identify the data you collect, how you use it, who receives it, and how long you retain it. Review the policy against the product, analytics tools, payment systems, support software, and marketing practices. A policy copied from a template often describes rights or controls the company never implemented.
Security records should show how your company protects customer data. Buyers may request written security policies, access-control procedures, incident-response plans, penetration-test results, customer security questionnaires, and certifications you claim to hold. Keep current versions and evidence that employees follow the documented procedures.
Buyers also expect a complete account of known security incidents and suspected breaches. Prepare an incident log that explains what happened, which data was affected, how the company responded, and whether contracts or applicable law required notice. Counsel should assess disclosure obligations rather than allowing founders to decide informally that an event was too minor to mention.
Data processing agreements should match the roles your company and its vendors perform. Gather customer agreements, vendor agreements, subprocessor lists, and any contractual security commitments. Confirm that major vendors permit the data uses described in your customer contracts and privacy policy.
EU and other cross-border data receives closer review because multiple privacy regimes and transfer rules may apply. Buyers may ask for transfer mechanisms, consent records, data-location details, and documentation covering access by a U.S. entity or foreign parent. International founders should map which entity controls the data and which entities can access it before buyer diligence begins.
Buyers run code-level license audits to identify third-party software and determine whether its license terms restrict the acquired product. The audit may compare the source code against known open-source packages, then review package versions and modifications. Buyers often ask for a software bill of materials, which lists each component and its applicable license.
Copyleft licenses require closer review because their obligations depend on how the software is used and distributed. A copyleft component embedded in shipped code may require source-code disclosure under certain conditions. Network-based licenses can raise separate concerns for hosted SaaS products. Undocumented libraries, copied code snippets, and abandoned dependencies create additional work because the buyer cannot confirm their origin or applicable terms.
Founders should prepare dependency inventories, license notices, internal open-source policies, and prior scan reports. Engineering should also document modified components and any commercial licenses that replace open-source terms. If a scan identifies a concern, engineering can evaluate whether to remove the component or replace it before buyer diligence begins.
Open-source review requires coordination between counsel and engineering. Engineers identify how each component enters the product and whether customers receive it. Counsel interprets the license obligations, evaluates disclosure requirements, and addresses the issue in diligence responses and transaction documents. Counsel cannot establish software composition without technical input, and engineering should not make legal conclusions about license compliance alone.
Buyers reconcile every option grant against the cap table and corporate approvals. Prepare board consents, grant notices, option agreements, exercise records, and termination records. Each document should support the grant date, exercise price, vesting treatment, and current balance shown on the cap table. Buyers will also review acceleration rights because a sale may cause options to vest or require special treatment.
A defensible exercise price usually depends on a timely 409A valuation. Missing valuations, grants issued below fair market value, or grants approved long after their stated dates can create tax and documentation concerns. Counsel should also confirm that incentive stock options went only to eligible employees and that expired options no longer appear as outstanding.
Worker classification creates a separate diligence risk. Buyers compare contractor agreements and actual working relationships to determine whether contractors functioned as employees. Control over hours, exclusivity, long-term service, and work central to the SaaS product can increase misclassification exposure. Potential consequences include unpaid payroll taxes, wage claims, and benefit obligations.
California generally applies stricter worker-classification rules, including the ABC test for many wage-order claims, subject to statutory exceptions. Arizona classification often depends more heavily on the facts and the company’s level of control, while federal tax and employment tests may still apply. Founders with workers in either state should review classifications based on where each person performed the work, not merely where the company formed.
Before opening diligence, reconcile personnel records with payroll, contractor payment records, and the cap table. Counsel can identify legal exposure, while an accountant should quantify potential payroll and tax liabilities.
A buyer will usually ask for more than a list of filed lawsuits. Disclosable history may include pending litigation, arbitration, government inquiries, demand letters, settlement agreements, and credible threats of claims. Buyers review resolved matters because they can reveal continuing obligations, repeat disputes, insurance issues, or facts that affect the seller’s representations in the purchase agreement.
IP disputes often involve ownership claims, infringement allegations, or former contributors asserting rights in the software. Employment disputes can involve termination, discrimination, wage, classification, or restrictive covenant claims. Customer and vendor disputes commonly concern service failures, unpaid amounts, contract termination, data incidents, or alleged breaches of confidentiality.
Before diligence begins, gather pleadings, material correspondence, settlement documents, releases, and relevant insurance notices. Create a factual summary for each matter that identifies the parties, allegations, status, claimed exposure, and resolution. Counsel should review those summaries before you place them in the data room. Legal advice and attorney work product may remain privileged, and careless disclosure can waive that protection. Complete, consistent records also help counsel prepare accurate disclosure schedules and avoid contradictions during buyer questioning.
Buyers usually request federal, state, and local tax returns for the diligence period, along with extensions, payment records, audit correspondence, and notices from tax authorities. Your accountant should reconcile those materials against the company’s books and confirm that every required entity, payroll, and information return was filed. Any late filing, payment plan, tax lien, or ongoing examination should appear in the data room with a clear explanation.
Sales tax and nexus exposure require early review because states apply different rules to SaaS products. A company may develop filing obligations in a state after its sales exceed economic nexus thresholds, even without an office or employees there. Your accountant should map revenue by jurisdiction, test registration and collection duties, and estimate potential exposure. Counsel reviews customer contracts to determine who bears transaction taxes and how the purchase agreement allocates known risks.
R&D tax credits need support beyond the amount reported on a return. Your accountant should preserve calculation workpapers and records connecting eligible expenses to documented development activities. Payroll data, contractor costs, project descriptions, and contemporaneous technical records may all support the analysis.
Legal counsel should flag missing records, disclosure issues, and tax terms that affect the transaction. The accountant should own return accuracy, workpapers, and exposure calculations. Zecca Ross can coordinate those workstreams and advise on tax provisions in the deal documents, but legal diligence should not substitute for an accountant’s review.
Build the legal data room around the buyer’s expected diligence requests, with numbered folders for each workstream. A consistent structure helps counsel answer follow-up requests without searching across email accounts or personal drives.
Use clear filenames that identify the document, counterparty, and signing date. Keep executed PDFs separate from drafts, and maintain an index showing each document’s folder and status. When a document changes, preserve the earlier version rather than overwriting it without a record.
Limit access according to the transaction stage. Advisors may need broad access during preparation, while prospective buyers should receive permissions through a controlled platform. Track downloads and remove access when discussions end. Counsel should review sensitive materials before upload and decide whether employment, security, or privileged records require redaction or delayed disclosure.
Zecca Ross Law Firm helps SaaS founders organize legal data rooms and identify missing records before buyer diligence begins. For transactions under $100 million, that support can include document review, folder design, request-list management, and coordination with the founder’s other advisors.
Treat Month 1 as roughly six months before buyer outreach. Adjust the schedule if known ownership, tax, or regulatory problems require more time.
Use this starting checklist with sell-side counsel. Your company structure, jurisdictions, and transaction terms may require additional review.
IP ownership
Cap table and corporate records
Customer and vendor contracts
Privacy and security
Open-source software
Employment and equity compensation
Litigation and disputes
Tax
Data room
Legal counsel. Counsel reviews corporate records, contracts, IP ownership, employment documents, privacy obligations, and litigation exposure. Counsel also identifies required consents, organizes legal disclosures, and negotiates the purchase agreement. For Arizona and California companies, counsel should flag state-specific employment and corporate issues.
M&A advisor. An advisor manages the sale process. The advisor helps position the business, identify potential buyers, assess valuation expectations, coordinate bids, and negotiate commercial terms. The advisor may help prepare operating metrics, but legal counsel must review how those metrics appear in transaction documents.
Accountant. An accountant prepares or validates financial statements and supports financial diligence. The accountant also examines revenue recognition, sales tax exposure, tax returns, and R&D credit records. A buyer may request a quality of earnings review, which usually requires accounting expertise rather than legal analysis.
Some issues require all three advisors. Tax structuring may affect the purchase agreement, the founder’s expected proceeds, and the company’s reporting obligations. Customer revenue data can also connect financial diligence to contract terms. Counsel, the M&A advisor, and the accountant should use the same transaction assumptions and raise conflicts early.
Zecca Ross Law Firm serves as boutique sell-side counsel for startup transactions under $100 million. The firm can coordinate legal diligence with a founder’s M&A advisor and accountant, but legal counsel does not replace either role. Depending on scope, flat-fee or capped-fee arrangements can give founders direct senior-attorney access with clearer pricing boundaries.
How early should I start preparing for a sale?
Start about six months before you expect buyer outreach. Early preparation gives counsel time to correct IP assignment gaps, reconcile the cap table, review consent requirements, and organize records before a buyer sets the schedule.
Do I need a data room if I am not sure I will sell?
A basic legal data room still helps. Organize signed contracts, corporate approvals, equity records, IP assignments, employment documents, privacy materials, and tax filings. You can restrict access and expand the folders if a sale process becomes likely.
What should I review first?
Start with issues that can take months to correct. Common priorities include missing contractor IP assignments, undocumented equity grants, inaccurate cap tables, and major customer contracts that require consent to an assignment or change of control.
How much does sell-side legal preparation cost?
Cost depends on the condition of your records, company structure, contract volume, and transaction complexity. Ask counsel to separate readiness work from transaction work and define which services fit a flat fee, capped fee, or hourly scope. Predictable pricing should clarify responsibility and scope rather than promise a particular deal result.
Does cross-border buyer diligence differ from domestic diligence?
Cross-border deals usually require additional review of foreign subsidiaries, IP transfers, worker arrangements, privacy obligations, and tax exposure. Buyers may also examine whether contracts can move between entities or across jurisdictions. Zecca Ross’s cross-border startup acquisitions guidance explains issues that can arise when a U.S. company, foreign parent, or international buyer participates in the transaction.
Readiness work completed months before a buyer arrives can make diligence more orderly, but it cannot guarantee a valuation, closing, or other deal outcome. Early legal review gives you time to investigate missing documents, correct remediable defects, and prepare clear explanations before buyer’s counsel raises questions.
Zecca Ross Law Firm serves as boutique sell-side counsel for SaaS transactions under $100 million. Founders work directly with senior attorneys who understand startup contracts, equity records, intellectual property, and cross-border issues. Templates organize documents but cannot assess how a contract clause or ownership gap affects a specific transaction. Generalist counsel may also lack the startup M&A experience needed to prioritize issues efficiently.
Zecca Ross can structure suitable work through flat-fee, capped-fee, or defined-scope arrangements when appropriate. These arrangements connect pricing to an agreed scope rather than leaving founders with an open-ended review. Founders considering a sale within six months can schedule a consultation to assess diligence readiness and define the legal work required.
Legal clarity starts here. Partner with Zecca Ross Law Firm to transform complexity into opportunity.