SaaS businesses for sale: how to find and evaluate a real acquisition

Our 22 July 2026 collection includes one listing explicitly categorized as SaaS and several AI, mobile-app, or software-oriented products. The table is a research snapshot, not a recommendation to purchase. Categories come from the source marketplace, while evidence confidence is our assessment of how much usable support appeared in the available listing data.

These figures help prioritize questions. They do not verify bank deposits, cohort retention, customer identity, source-code ownership, or future performance.

Monthly recurring revenue is useful only after its components are understood. Separate new, expansion, reactivation, contraction, and churned MRR. Exclude one-time implementation fees, lifetime deals, pass-through revenue, and non-recurring services when assessing the subscription engine.

Stripe’s SaaS analytics guidance warns that topline revenue without retention, customer-acquisition cost, or lifetime-value context is incomplete. It also distinguishes customer churn—the share of customers who cancel—from revenue churn, which reveals the revenue lost. A few large cancellations and many small cancellations can produce very different operating risks.

1. 1Reconcile the MRR bridge to subscription-level billing exports for at least the period being evaluated.
2. 2Compare billing data with bank deposits, refunds, disputes, credits, taxes, and failed payments.
3. 3Inspect cohorts by signup month, plan, geography, and acquisition channel.
4. 4Confirm whether annual contracts, discounts, and lifetime plans distort the monthly figure.

A buyer inherits the customer base that remains after ownership changes—not the historical total of everyone who ever paid. Request gross revenue retention and net revenue retention by month, plus the underlying data needed to reproduce them.

Stripe defines net revenue retention as beginning recurring revenue, minus churn and downgrades, plus expansion, divided by beginning recurring revenue. Because expansion is included, NRR can hide meaningful customer loss if upsells offset churn. Review gross retention and logo retention alongside it.

Request revenue by customer, plan, industry, geography, and contract-renewal date. A business can report stable MRR while depending on one account, one reseller, one integration, or one platform policy. The risk is not only cancellation; a large customer may have negotiated support, security, uptime, data-processing, or indemnity obligations that the buyer must assume.

Review customer contracts for assignment and change-of-control provisions. Ask whether the seller has made side agreements, promised roadmap work, or provided service levels that do not appear in the standard terms. Contract review is legal work; use qualified counsel for the actual transaction.

• Calculate the revenue share of the largest customer and top five customers.
• Map renewal dates and cancellation rights.
• Identify revenue dependent on a single channel, API, app store, or integration.
• Confirm which customer and vendor contracts can transfer.

Seller-reported profit often needs normalization. Reconstruct it from hosting, databases, storage, model or API usage, email, monitoring, support, contractors, payment fees, refunds, app-store fees, sales commissions, and paid acquisition. Then model how costs behave if usage grows or pricing from a critical vendor changes.

Owner labour is not a cash expense in every small-business presentation, but it is an operating requirement. Record weekly hours by support, engineering, sales, content, compliance, and administration. Decide whether you will perform that work, automate it, or pay someone else.

The code must run after the seller leaves. Obtain read-only repository and deployment access before closing where the process permits, and examine commit history, dependency health, secrets management, backups, monitoring, incident history, test coverage, data migrations, and deploy documentation.

Inventory every external dependency: cloud accounts, domains, certificates, OAuth applications, payment accounts, model providers, datasets, analytics, support systems, email infrastructure, and app-store identities. Verify which can legally and technically transfer. A working demo in the seller’s account is not proof of a transferable production system.

1. 1Confirm code and IP ownership, including contractor assignments.
2. 2Search for exposed secrets and unsupported dependencies.
3. 3Test backup restoration and a clean deployment.
4. 4Review security incidents, privacy obligations, and data-processing agreements.
5. 5Create a transfer runbook with owners, deadlines, rollback steps, and seller support.

AI coding tools make many interfaces, workflows, and integrations faster and cheaper to reproduce. That reduces the acquisition value of code in isolation. It does not reproduce paying customers, retained revenue, distribution, brand trust, proprietary permissioned data, partner relationships, or operating knowledge.

Our Buy vs Build framework therefore gives most weight to traction and distribution, then evidence and risk, and only a smaller weight to rebuild cash and time. Papernity, for example, received a Build verdict in our current analysis despite reported revenue: the verdict reflects the relative reproducibility of the product versus the evidence for durable, transferable advantage. It is a screening judgment, not an instruction to transact.

• Prefer Build when the product is reproducible and the moat is mostly features.
• Prefer Buy when verified retention and transferable distribution account for the premium.
• Do neither when evidence quality prevents a defensible conclusion.

Before spending heavily on diligence, use a short evidence request to determine whether the opportunity deserves an LOI.

1. 1Provide subscription-level billing exports and a monthly MRR bridge.
2. 2Provide cohort, logo, gross-revenue, and net-revenue retention data with definitions.
3. 3Show revenue and support load by the largest customers.
4. 4Show acquisition by channel, cohort payback, and the seller’s actual weekly workload.
5. 5List every asset, account, contract, licence, dataset, and dependency included or excluded.
6. 6Disclose security incidents, disputes, refunds, platform warnings, and material compliance obligations.
7. 7Explain why the owner is selling and what changed in the most recent six months.