Developer tools or API business due diligence

The core check for a buyer under letter of intent on a developer tools or API business is whether three records agree: what the metering says customers used, what the billing platform invoiced and what actually reached the bank. Everything else, from code ownership to privacy, is checking that nothing outside those records can interrupt the service or the revenue after closing. Diligence here is document-heavy and technical. This guide sets out what to ask for, which searches to run and what a finding means when it turns up.

Reconcile usage, invoices and cash

Ask for raw usage or request logs, the metering and rate-limit configuration, billing-platform exports, issued invoices, credit notes and bank deposits for the same months, then rebuild a sample from the bottom up. You are looking for usage that was served but never billed, credits issued after outages, customers on exceptions the pricing page does not mention, and free-tier traffic that inflates cost. If a competent engineer cannot reproduce an invoice from the logs and the written pricing rules, the reported revenue cannot be relied on, and that is a deal-level finding rather than a clean-up item. Our guide on how buyers verify earnings covers the general method.

Confirm who owns the code, the marks and the accounts

List every person who wrote core code or SDKs and ask for the paper behind each. Under the Copyright Act the author is generally the first owner of a work, an employer is the first owner of work made by an employee under a contract of service or apprenticeship in the course of employment, in the absence of an agreement to the contrary (subject to the section’s own exceptions), and an assignment is not valid unless it is in writing and signed by the owner or the owner’s duly authorized agent. CIPO lets owners register an assignment or licence, so ask whether any were filed. For brand names, search the Register of Trademarks, remembering that a trademark does not have to be registered, so a name in use may not appear there at all. CIPO also records patent transfers, so check any recorded owner against the seller. Then confirm in writing that the cloud, billing, code-hosting, package-registry and domain accounts belong to the company and not to a person.

Search for liens and security interests

A lien search shows whether a creditor has registered a security interest against the company’s personal property, and the registry and the law behind it differ by province. British Columbia’s Personal Property Registry, for example, records security interests and liens against personal property belonging to businesses and individuals under that province’s Personal Property Security Act, and the province advises checking for registered liens before lending money on the security of personal property. In Québec the register of personal and movable real rights is governed by a regulation under the Civil Code. Search in each province where the company is located or holds assets, then ask the seller to explain every registration that appears and to arrange a discharge for any that will not stay.

Privacy, breach history and data agreements

Ask what personal information passes through the API, whose it is and which written agreements govern it. Where the service processes another company’s customer data, that company’s agreement with the target and the list of subprocessors are diligence items in their own right. PIPEDA requires an organization to keep a record of every breach of security safeguards involving personal information under its control and to report a breach to the Privacy Commissioner if it is reasonable in the circumstances to believe that it creates a real risk of significant harm to an individual. The Commissioner’s guidance adds that records must be kept for all breaches, whether or not they reach that threshold, and must hold enough detail to show how the risk was judged. Ask for the record and for any reports made.

For Quebec exposure, the Commission d’accès à l’information says the person who operates a business is responsible for the personal information it holds, that the title and contact details of the person in charge of protecting it must be published on the business’s website, and that a privacy impact assessment is required before personal information is communicated outside Québec.

Findings that can change a deal, and what they mean

• Usage that cannot be rebuilt from the logs: the revenue figure is a claim rather than a record, so the price depends on what can be proved.
• Most usage coming from a handful of accounts with no commitment: the revenue exists but can leave with one customer’s engineering decision.
• Core accounts in the founder’s name that a platform will not transfer cleanly: the cutover carries outage risk that the seller should help solve before closing.
• Code written by contributors with no written assignment: the company may not own what it is selling until each assignment is obtained.
• No breach record, or one that does not match what the engineers describe: the seller’s statements about safeguards need independent support.
• An SR&ED claim under CRA review: the CRA explains what to do if a claim needs a review, so ask for the filed claim and all correspondence and let the buyer’s tax adviser say what it affects.