A SaaS listing can look compelling when recurring revenue is summarized in one number. Advanced diligence asks what sits underneath that number: active paying customers, retention by cohort, contribution after service costs, product dependencies and a transfer plan that survives the founder’s exit.
This checklist is for buyers who already understand the basic listing and financial review. Start with our beginner’s Flippa buyer checklist and revenue verification guide, then apply the deeper tests below.
1. Rebuild the recurring-revenue picture
Request customer-level or appropriately anonymized subscription records for a consistent period. Reconcile billing records with processor transactions, refunds, failed payments and accounting. Define precisely what the seller calls MRR or ARR. Separate active paid subscriptions from trials, one-time services, setup fees, annual prepayments and revenue that is contracted but not yet collected.
Build a monthly bridge: opening recurring revenue, new customers, upgrades, downgrades, cancellations, reactivations and closing recurring revenue. Reconcile the ending total to the customer and billing records. Check whether annual plans are being spread across service periods or represented as cash in the month received. Ask an accountant to review deferred revenue and tax treatment where material.
Analyze churn in more than one way. Track customer-count churn and revenue churn separately, define the denominator and period, and compare customers who joined in different months. Cohort retention can reveal whether older customers stay while new ones cancel quickly. Separate expansion from new sales so growth is not mistaken for retention.
2. Test customer and channel concentration
Identify the largest customers, plans, industries and acquisition channels. Use lawful, privacy-protective anonymization. Ask what would happen if the largest account churned, a key affiliate stopped promoting the product, or paid acquisition became more expensive.
Compare customer acquisition costs with observed payback and retention by channel. Do not accept a single blended lifetime-value figure without the underlying assumptions, cohort period and method. Check whether acquisition cost includes agency fees, creative production, founder sales time, commissions or discounts.
Review support volume, refunds, failed payments and customer complaints alongside the retention story. A low recorded churn rate may not show customers who have stopped using the product but remain on annual plans, and a high refund month may warrant context rather than a simplistic annual extrapolation.
3. Inspect product, code and operating continuity
With authorized access, map the application architecture, repositories, hosting, databases, APIs, domain names, deployment pipeline, monitoring, backups and incident history. Confirm the seller controls the repositories and that the code, brand, product content and customer materials can be assigned or licensed to the buyer. Review third-party and open-source licenses with qualified help where necessary.
Understand which accounts are in the seller’s personal name, which are company-owned, what provider terms say about assignment and what must be replaced after closing. Obtain a list of monthly infrastructure and third-party costs, including usage-based charges that may rise with growth.
Review security and reliability evidence proportionate to the deal: backup restoration, dependency updates, access controls, service availability, known vulnerabilities, privacy commitments and unresolved incidents. A code walkthrough or repository review is not automatically a penetration test or a complete security audit. Engage a specialist if the exposure warrants it.
4. Find founder and team dependencies
Write down the tasks currently performed by the founder, employees and contractors. Include sales demos, onboarding, support, releases, incident response, billing disputes, vendor relationships and roadmap decisions. Ask who owns the documentation and whether key people will remain after transfer.
Estimate the replacement cost of founder work. If the product depends on undocumented deployment steps, a single developer or a supplier relationship held personally by the seller, treat the transition as a real operating risk. Agree on training, access handoff, support hours and the period for assistance in the purchase documents.
5. Verify that the transaction can transfer what the valuation assumes
List the legal entity or assets being sold, customer contracts, subscription commitments, intellectual property, data, accounts and liabilities. Confirm consent, notice, privacy and contract questions with qualified counsel for relevant jurisdictions. Payment processors and cloud vendors each set their own rules; do not assume an account, customer mandate, SaaS subscription or stored card token can move just because the underlying product is sold.
Flippa’s public trust and verification information describes marketplace verification and integrated data sources. Features can help identify evidence, but buyers should still establish what source is connected, what metric is reported, which dates are covered, and which claims or risks remain outside that scope. Consult current Flippa terms for the live listing and closing process.
Decision memo before an offer
Summarize the verified revenue base, retention definition, largest concentrations, necessary founder replacement cost, infrastructure liabilities, code and IP ownership, transfer approvals, transition conditions and unresolved evidence. Run a downside case using assumptions you can explain. If one unresolved issue would change your maximum price or willingness to buy, do not bury it in a general risk list—resolve it, reflect it in the deal terms or decline.
For a deeper review across financial evidence, operations and transfer planning, see RightFlipper’s SaaS diligence service and Complete Due Diligence package. RightFlipper is independent and is not an official Flippa partner. This educational checklist is not an audit, penetration test, valuation, legal or tax opinion, or guarantee that every risk has been found.