Guide
How to vet a SaaS acquisition
What to check before buying a SaaS business, and which record each check reads. The figures are from our scan of 200 Flippa listings, 53 of them SaaS.
What do you check before buying a SaaS business?
Check four things: whether the monthly revenue is committed or rests on discounts, whether customers stay, whether the application is safe to operate, and whether the business runs without its founder. The application can be read from its public address. The other three need read-only access to the seller’s records.
F(x) has 35 checks. 21 run from the address and 14 read what the seller grants. Each one is listed with its source.
How do you check that SaaS revenue will last after the sale?
Read the subscription records in the seller’s payment processor. Count the subscribers on a discount and the date it ends, the share of revenue from the largest customer, cancellations by signup month, and subscribers who pay but do not log in. Then restate the monthly revenue without the parts that end.
The F(x) checks that read those records:
- Discounts that expire after you have bought it
- Committed revenue against the headline figure
- Churn, by the month customers signed up
- How much of the revenue is one customer
- Subscribers who pay but never use it
- How much of the traffic is bought
The study has no figures for these. It read public addresses only, and no seller was asked for access.
How secure is a typical SaaS listed for sale?
Our study scanned 200 businesses listed on Flippa, 53 of them SaaS. The SaaS listings averaged 2.8 findings each. Across the whole sample, 27 sites had an AI endpoint that answered without a login, 15 returned data from an API route without one, and 113 were not served over HTTPS.
An open AI endpoint bills the owner for a stranger’s usage. An open API route can return customer records. Both are found from the address alone, so you can scan the listing before you contact the seller.
The sample is the newest and cheapest listings on Flippa. The study states what the figures do not cover.
What does a founder-written codebase mean for the buyer?
If one person wrote most of the code, the business depends on that person after close. With read access to the repository you can count the share of commits one author made, list who else can still push changes, and search the commit history for passwords and keys left in it.
The F(x) checks that read the repository:
- How much of the code one person wrote
- Who else can change the code you are buying
- Passwords and keys left in the code history
This finding changes the structure of the deal. Part of the price is held back until the handover is complete.
What do you ask the seller for, and what if they refuse?
Ask for read-only access to the payment processor, the analytics account and the code repository. A seller can grant some and refuse others. Record which were refused and the reason given. A refusal does not prove a problem, but it leaves that part of the business unchecked, and the offer should reflect that.
F(x) sends one request from your report and can read Stripe, Paddle, Shopify, Google Analytics, GitHub and Supabase. Each tool is granted separately, on a page that names what it reads. No write, refund or admin scope is requested, and the access is discarded when the scan ends.
The report prints what was granted, what was refused, and the seller’s reason in their own words. Sending the request costs nothing. Pricing says when the seller-data scan is charged.
Run the URL scan
Paste the address of the listing. 21 checks run from it, free, with no account.