For buyers of a small SaaS or app business
Questions to ask before you buy.
These 19 questions cover what the data room usually leaves out: whose name is on the accounts, whether anyone else can ship, and what it costs to run. Ask them before the letter of intent, while the answers can still change the price.
How to use it
Send the questions to the seller in writing and ask for evidence with each answer: a list, an invoice, a screen share. Slow or vague answers are information too. A red flag is rarely a reason to walk away. It is usually a cost you can price before you agree.
Start with keys and ownership, the most common surprise after closing. If you would rather not run the questions yourself, our page on buying a software company describes the check we do for buyers.
Keys and ownership
The most common surprise after closing. Ask this first; a tidy business answers in minutes.
-
Question 1:Whose name is on every account the product depends on?
- Ask to see
- Every account with its legal owner: domain registrar, DNS, hosting, App Store, Google Play, Stripe, email sending, analytics and any AI provider.
- Red flag
- Accounts on a personal email or card, or a list that takes more than a day to produce.
-
Question 2:Can the mobile apps move to your company?
- Ask to see
- Which developer account each app sits in. Apple and Google both have transfer conditions; check them for this app before the LOI.
- Red flag
- Apps in a personal developer account, or a seller who has not looked at what a transfer involves.
-
Question 3:How do paying customers move with the sale?
- Ask to see
- How subscriptions and saved payment methods reach your company, and whether anyone must re-enter card details.
- Red flag
- No clear answer. Churn from a forced payment update belongs in the price.
Delivery
Can the product keep shipping without the person who built it?
-
Question 4:Can someone other than the seller deploy it today?
- Ask to see
- Someone else following the written instructions ships a small change to production while you watch.
- Red flag
- Only the seller can release, or the steps live in their head.
-
Question 5:How often does it ship, and how does a bad release get undone?
- Ask to see
- The deploy history for the last three months and the rollback steps.
- Red flag
- No releases in months, or no way back from a bad one other than fixing it live.
-
Question 6:Can the apps be built from the repository alone?
- Ask to see
- A build from a clean machine, and where the signing keys and certificates are kept.
- Red flag
- Signing keys that exist only on the seller’s laptop.
Code and architecture
You do not need to read code to ask these, only to get the answers in writing.
-
Question 7:Is all the code in repositories you will own?
- Ask to see
- Read access to every repository, including infrastructure scripts and anything a freelancer or agency still holds.
- Red flag
- Code that exists only on a server, or parts that sit in a contractor’s account.
-
Question 8:Which parts would the seller rather not touch?
- Ask to see
- Ask the seller directly. Most will tell you.
- Red flag
- Billing, login or data import on that list.
-
Question 9:What runs before a release?
- Ask to see
- The automated tests and checks, and the last time one of them stopped a bad change.
- Red flag
- Nothing automated around payments or login.
-
Question 10:Is anything out of support?
- Ask to see
- Framework, language and database versions, and when each stops getting security fixes.
- Red flag
- A major upgrade that is overdue. Price the work into the deal.
Running costs
The listing’s profit is only as good as the costs it counts.
-
Question 11:What does it cost to run each month?
- Ask to see
- Three months of invoices from every provider, not a summary.
- Red flag
- Costs on the seller’s personal card that never reached the profit and loss.
-
Question 12:Which bills grow with usage?
- Ask to see
- Every usage-priced service (AI models, SMS, email, storage, bandwidth) and any spending limits set on it.
- Red flag
- A usage-priced service with no cap and no alert.
-
Question 13:Does any price end after closing?
- Ask to see
- Free tiers, startup credits and old plans that a transfer to a new owner could end.
- Red flag
- Credits that run out soon after the deal, with the full price nowhere in the numbers.
Security and data
What you take responsibility for on closing day.
-
Question 14:Which secrets live in the repository?
- Ask to see
- Whether the code history has been searched for keys and passwords, and which of them will be changed at handover.
- Red flag
- Live keys in the history and no plan to rotate them.
-
Question 15:Has anyone ever restored a backup?
- Ask to see
- The date of the last restore test and how long it took.
- Red flag
- Backups that exist but have never been restored.
-
Question 16:Who can reach customer data today?
- Ask to see
- Every person and service with production access, and the list of data processors the privacy policy relies on.
- Red flag
- Former contractors who still have access.
Product and usage
Do the data room numbers measure what the listing says?
-
Question 17:Where does each number on the listing come from?
- Ask to see
- The query or dashboard behind each metric. Re-run it yourself or have someone do it.
- Red flag
- A figure nobody can reproduce. See the example below: ours was wrong the other way.
-
Question 18:What breaks most often?
- Ask to see
- The error tracker and three months of the support inbox.
- Red flag
- No error tracking, so nobody knows.
-
Question 19:Who answers customers now?
- Ask to see
- Support volume per week and who handles it.
- Red flag
- The seller does it alone and the time is not in the costs.
Our dashboard under-counted returning users
Before asking anyone to pay for a Reality Check, we ran one on GarageHub, our own car maintenance app. The product reported that 17% of new users came back the next day. Re-running the query gave 31%. A field added in late July was empty for older users, so every earlier signup counted as never returning.
The error made the product look worse. In a data room it could go either way, so question 17 asks for the query, not the chart. Read the full GarageHub check.
We can ask for you
A Reality Check covers the same six areas and reads the code behind the answers. In three to five days you get a written verdict with the risks priced, from €1,800, between the letter of intent and closing. Not sure it is worth it for your deal? A 20-minute call will tell you.
One email a month with what we found
Each month Daniel writes up one real finding from the software we read and run: what broke, why, and what it took to fix. Plain text, no tracking pixels, and you can stop it by replying.