By Phillip Mitchell, Founder & Chief Brokerage Officer, AIExchange.club

Figures are as of October 2026, from the sources linked below. Examples are illustrations, not real deals. This is general information, not legal, tax or financial advice. Use a lawyer and an accountant for the legal and tax checks.

Due diligence is the work of checking that what a seller says about a business is true before you pay for it. For a software business under $1M, that comes down to four questions: is the revenue real, do the customers stay, can you actually own and run the code and accounts, and is there anything the seller left out that changes the price?

This guide is a checklist for buyers of small SaaS, app and AI businesses. Each item says what to ask for, how to verify it, and what a red flag looks like. Download the checklist as a spreadsheet if you'd rather work through it with a status column.

What due diligence is for

The price you agreed in your letter of intent rests on claims: monthly revenue, profit, churn, "it runs itself". Due diligence is the period, often 30 to 90 days according to law-firm guides (Turley Law), when you check those claims. Whatever you find either confirms the price, changes it, or ends the deal.

It sits between the LOI and the binding asset purchase agreement. Anything you find becomes either a lower price or a promise the seller makes in that agreement. If you're new to the whole process, our step-by-step guide to buying an AI or SaaS business shows where this stage fits. For all nine steps of the buying process, with a timeline, see business acquisition steps.

Free due diligence checklist to download

The spreadsheet has three sheets:

Checklist: every item below, with when to check it, a status dropdown (not started, requested, received, verified, issue) and a notes column.
Red flags: the findings that should stop, reprice or protect a deal, and what to do about each.
Revenue check: enter the seller's claimed revenue, the processor export and the bank deposits, and it shows the gap.

Download the checklist (Excel, works in Google Sheets)

Verify, don't collect

The common mistake is collecting documents. A seller can send a screenshot or a spreadsheet of revenue, and both are easy to edit. Verifying means seeing the numbers where they come from. Ask for read-only access to the systems that hold the truth, and use the seller's NDA and the LOI's exclusivity period to justify it.

Payment processor. Stripe's View Only role can view payments, customers, balance and payouts, download financial reports and export payments and customers. It can't refund, pay out, change settings, manage API keys or invite users (Stripe, User roles).
Apple App Store. The Finance role in App Store Connect has access to sales and trends and financial reports. The Marketing and Sales roles see sales and trends but not financial reports, and only the Account Holder, Admin and App Manager roles can create or edit app records (Apple, Roles).
Google Play. A Play Console user can be given a "View financial data" permission for financial and sales reports, plus a read-only permission to view app information and download bulk reports (Google Play Console Help).
Bank. Statements downloaded together on a call, or a read-only view, rather than a file emailed in advance.

A seller who offers only screenshots, or who won't give any read-only access during diligence, is telling you something. Treat it as a red flag, not a formality.

The due diligence checklist, by area

Work roughly in this order: money and ownership first, because they decide whether to continue, and the rest while you wait for answers. Deal-breakers are marked in the spreadsheet as "Week 1".

Financials

Check	How to verify	Red flag
12 to 24 months of revenue	Processor exports by month, matched to bank deposits (worked example below)	Deposits that don't reconcile after fees and refunds
Expenses	Bank and card statements and vendor invoices for hosting, AI API usage and tools	Costs paid personally and missing from the P&L, or API bills climbing faster than revenue
Profit (SDE)	Rebuild it yourself from statements, not from the seller's summary	Add-backs with no document behind them
Tax returns	Revenue on the returns matches the revenue claimed	A gap the seller can't explain
Refunds, disputes and failed payments	Processor reports by month	A rising dispute or refund rate
Sales tax or VAT	Registrations and filings, where it applies	Tax collected and not remitted, or never registered where it should be

Customers and retention

Check	How to verify	Red flag
Customer list: start date, plan, price, status	Count matches the processor's customer export	Numbers that don't match, or a list the seller won't share even after the NDA
Churn and net revenue retention	Rebuild monthly cohorts from the export instead of taking the seller's figure	Newer cohorts retain worse than older ones, or a "99% retention" with no period
Concentration	Share of revenue from the top 3 to 5 customers	One guide flags the top 3 above 30% of revenue (vaulto.sh)
Plan mix	Monthly, annual and lifetime plans separated in the export	Lifetime deals or heavy discounts counted as MRR
Where customers come from	Search Console, analytics and ad accounts, viewed live	One channel supplies most signups, or organic traffic is falling
Support history	Read the last 50 tickets and the store reviews	The same bug or complaint appearing again and again

Product and code

Check	How to verify	Red flag
Who wrote the code	Repository history and contributor list, plus signed IP assignments from contractors	Contractor code with no assignment, so you may not own it
Can you build and run it	Read-only repository access, then a build from scratch on your machine or a screenshare	It only runs on the seller's laptop, or secrets are committed in the code
Hosting and infrastructure	A list of every service with its monthly cost, from the cloud console	One unbacked-up server, or costs that the P&L doesn't show
Open-source and third-party code	A dependency and licence report	Licences that bar commercial use or require you to release your code
Security and backups	Ask to see a backup restored, and the incident history	No backups, or a past breach the seller didn't mention
Documentation	Ask the seller to walk you through a deployment	Only the seller knows how to deploy or fix it

Platforms and accounts

These decide whether the business can be handed over at all. List every account and who owns it.

Check	How to verify	Red flag
Domain and DNS	Log in to the registrar with the seller, and check the owner and expiry date	The domain is held by a freelancer or a personal email address
Payment processor	Read-only role (above), and a written plan for moving customers' saved payment details to your account	No plan. This is the hardest part of a handover
App Store account	Finance role for the numbers. Plan the transfer: the Account Holder starts it, and push keys, subscription secrets and any Apple Pay merchant ID need setting up again	An account that can't be transferred, or app review problems
Google Play account	"View financial data" permission. Earnings and sales reports stay with the seller's account, so ask for an export before the transfer	No exported history for the buyer
Email, social and support inbox	Who owns each login, and whether it can move	The business runs from the seller's personal inbox

Store transfers have their own rules, covered in how to sell an app.

AI and third-party dependencies

For an AI-powered business this is its own area. Here's what to ask. What buyers check in an AI business has more. For how these checks change the price, see AI company valuation. For a product built on someone else's model, see our guide to the AI wrapper business.

Check	How to verify	Red flag
Model providers	Which models and vendors, monthly spend by vendor, 12 months of invoices	One provider and no fallback, or spend rising faster than revenue
Cost per customer	API cost divided by active customers, and the same figure for the heaviest 10%	Margins that vanish at the top end of usage
Provider terms	Read the usage and account terms. Can the keys and account move to you, or must you open new ones?	Keys tied to the seller's personal account
Prompts, fine-tunes and data	Who owns them, and where any training data came from	Scraped data or customer data used without permission
Retention against the benchmark	A cohort chart. Median gross revenue retention for AI-native products is 40% in ChartMogul's December 2025 data	Far below that, or no cohort chart at all
Other third-party APIs	A list with cost, terms and what happens if each is switched off	A service that is being retired, or one that can reprice overnight

Legal and IP

Check	How to verify	Red flag
Who owns the business	Formation documents, and that the seller owns the assets being sold	The assets belong to someone else, or a partner you haven't met
Brand and trademarks	Registrations or evidence of use, and a search for conflicting names	Another company uses the same name in the same field
Customer terms and privacy policy	Read both, including whether the terms let the business be sold to you	No privacy policy while collecting personal data, or terms that bar transfer
Contracts	Vendors, contractors and affiliates, with their end dates	Long lock-ins you'd inherit
Disputes and warnings	Ask in writing about claims, takedown notices and app store warnings	An open complaint the seller hadn't disclosed

Most small software deals are asset sales, so you buy named assets and leave most of the seller's company behind. That's why the asset list matters more than the company's history. Have a lawyer check ownership and the IP assignments.

Owner dependence

Check	How to verify	Red flag
Hours the owner works	A list of recurring tasks with hours, and who does support, releases and content	The owner does everything, and none of it is written down
Contractors and staff	Roles, pay, how long they've stayed, and whether they'll stay after the sale	A key person who is leaving too
Customer relationships	Who talks to the biggest customers	Large accounts that only deal with the founder
What the seller does next	Transition support and a non-compete (both are in the LOI)	The seller plans a competing product

Does $9,000 MRR check out?

This is the check to run first. A listing says $9,000 in monthly recurring revenue. In this illustration the product costs $30 a month and has 300 paying customers. Here's how the claim looks once you follow it from the processor to the bank.

Step	Source	Amount
Claimed MRR	The listing	$9,000
Gross card charges, last full month	Processor export (300 charges)	$9,000
Refunds and disputes	Processor export	−$360
Net collected		$8,640
Card processing fees	2.9% + $0.30 on 300 charges	−$351
Deposits you'd expect		$8,289
Deposits in the bank	Bank statement	$8,100
Unexplained gap		$189

The fee line uses Stripe's standard US price of 2.9% + 30 cents per successful domestic card payment (Stripe pricing); check the seller's actual rate. Two points come out of this:

Price on what's left, not the headline. $9,000 is gross. After refunds and fees the business collects $8,289. Profit (SDE) is calculated from the net.
Chase the gap. $189 may be payout timing, or a transfer to the owner. If it's recurring and unexplained, it's about $2,268 a year, which at 3 times SDE is about $6,800 of price. Ask for the payout report and match each transfer.

The "Revenue check" sheet in the download does these sums for your numbers.

Red flags: walk away, reprice or protect yourself

Finding	What to do
Revenue doesn't reconcile and the seller can't explain it	Ask for the explanation in writing. Walk away if it isn't resolved
Screenshots only, no read-only access	Pause. Walk away if the seller still refuses
A few customers make up a large share of revenue	Reprice, or put part of the price in an earnout tied to keeping them
Retention is worse than the seller quoted	Reprice on the real figure
Code written by contractors with no signed IP assignment	Require signed assignments before closing
One AI provider and rising cost per customer	Reprice, or tie part of the price to a margin target
A store or payment account can't be transferred	Fix the plan before you sign, and make the escrow release depend on the transfer
The owner works full time and nothing is documented	Ask for longer transition support or a lower price. If you're borrowing to buy, see how to finance a SaaS acquisition

How long it takes and who to hire

Law-firm guides often put due diligence at 30 to 90 days, with exclusivity of 60 to 120 days (Turley Law). Small deals can run faster if the seller sends what you ask for quickly. Plan it in three passes:

Week 1: deal-breakers. Reconcile revenue, get read-only access, confirm who owns the code and accounts, and check retention.
Weeks 2 and 3: the product. Customers, code, infrastructure and AI dependencies.
Weeks 3 and 4 onward: the paperwork. Legal, IP, tax and contracts, which feed straight into the purchase agreement.

Hire a deal lawyer for ownership, IP assignments and the purchase agreement, and an accountant or tax adviser for the returns and the tax effect of the structure. The two cost you money but find things you can't.

If you're the seller: have this ready

Buyers who do their job will ask for everything above. The sellers who close fastest have it ready before the first call:

12 to 24 months of processor exports and matching bank statements.
A customer and cohort chart you built from those exports.
A list of every account, who owns it, and how it transfers.
Signed IP assignments from every contractor.
12 months of vendor and AI API invoices.
A one-page description of how the business runs week to week.

Our guides on how to sell a SaaS business and how to sell an app cover the rest, and the valuation tool shows what your numbers support. To plan the clean-up month by month, see how to prepare a business for sale.

After due diligence

What you found goes one of three ways. It confirms the price and you move on. It changes the price, which the LOI allowed for if it said the price was subject to diligence. Or it becomes a promise in the asset purchase agreement, where the seller states the facts are true and agrees to cover you if they aren't. Note that the exclusivity clock in your LOI runs while you do all this, so ask for what you need early.

Due diligence checklist FAQs

What documents should a due diligence checklist for a business acquisition include?

For a software business: processor exports and bank statements, tax returns, a customer list with plans and start dates, repository access and IP assignments, a list of accounts and who owns them, vendor and AI API invoices, customer terms and the privacy policy, and any contracts. The checklist above groups them by area.

How do you create a due diligence checklist?

Start with the areas: financials, customers, product, accounts, AI and third-party dependencies, legal, and owner dependence. Add anything specific to the deal, sort items by when to check them, and give each a status. The downloadable spreadsheet is built that way, so you can use it as is or add rows.

What is due diligence in a business acquisition?

It's the buyer's check, between the offer and the final contract, that the seller's claims about revenue, customers, ownership and costs are true. It ends in a confirmed price, a changed price, or a deal that doesn't go ahead.

How long does due diligence take when buying a business?

Law-firm guides often say 30 to 90 days. Small software deals can be quicker when the seller has the exports and account lists ready, and slower when the buyer has to wait for every answer.

Do I need a lawyer and an accountant?

Yes, for different parts. A lawyer checks ownership, IP assignments and the purchase agreement. An accountant or tax adviser reviews the returns and the tax effect of how the deal is structured. You can run the revenue, customer and product checks yourself.

Next step

If you're buying, browse the businesses on our marketplace to see what a listing with verified numbers looks like, and bring this checklist to the first call.

If you're selling, start with your number. Get a value range in a couple of minutes with the estimator below.

On AIExchange.club, listing is free and the flat 10% success fee is paid only when your deal closes. The deal room, escrow and in-platform contracts are included (see fees and pricing). We list businesses that are already making money.

List your AI-powered business →

Weighing a deal and want a second opinion? Talk it through with us.

Due Diligence Checklist for Buying a Business: What to Verify in a SaaS, App or AI Deal