Due diligence on a logistics software company in Canada

A buyer under a letter of intent on a logistics software company is verifying claims the seller has made: that the platform’s connections work, that its customers will stay, and that its record in live shipping is clean. That is a different job from judging the opportunity. The work is documentary and technical, and the findings that matter can be small and specific. What follows sets out the checks in a sensible order, and what each type of finding can mean once it surfaces.

Reconcile the integration register to traffic

Ask for transaction counts by connection over a defined recent period and compare them with the seller’s list. A connection in the register with no traffic is a maintenance cost with no revenue behind it. A connection carrying heavy traffic with no documentation, or with credentials held by one person, is a continuity risk. Ask for the last successful end-to-end test with each major carrier and whether any has announced changes to its interface or formats. Have your own engineer, not the seller’s, run a handful of the busiest connections against a test environment. The pattern across that sample can say more than any single result, because one failure can be an accident and several may suggest neglect.

Read the outage record against the contracts

Pull the status-page history, support tickets and any post-incident reviews, then read the largest customers’ agreements for service-level commitments, how credits are calculated and where liability is limited or excluded. An outage during a pickup or delivery window that cost a customer freight is a different finding from one that caused only inconvenience. Ask whether any customer has claimed, threatened to claim or left after an incident. A credit already paid is a cost you can price. A dispute still open, or a contract with no limit on liability, is an exposure to address through a price adjustment, an indemnity or a holdback rather than leave unresolved.

Contract terms that decide whether revenue transfers

Check each significant customer and vendor contract for assignment restrictions, termination rights on a change of control, exclusivity, and the terms on which historical shipment data is kept or returned. Our answer on anti-assignment clauses explains how those work. Concentration matters here: a single shipper or logistics provider holding a large share of revenue under a contract that cannot be assigned can turn its consent into a closing condition. Vendor contracts matter as well, especially licences for map, rate or tracking data on which the platform depends, because a vendor’s terms may not pass to a new owner without its agreement.

Ownership, registered claims and filings

• Code ownership: under the Copyright Act an employer is first owner of a work made in the course of employment unless there is an agreement to the contrary (the section has its own exceptions), but any assignment of copyright is invalid unless in writing and signed by the owner or the owner’s duly authorized agent, so ask for those assignments.
• Registered claims: search the personal property security register where the company is located and operates, such as Ontario’s register under the Personal Property Security Act, British Columbia’s Personal Property Registry or Quebec’s register of personal and movable real rights.
• Incentive filings: copies of any SR&ED claims and CRA correspondence about reviews of them.
• Third-party components: the licence terms for open-source code, map, rate and tracking feeds that sit inside the connectors.
• Breach history: PIPEDA requires an organization to keep and maintain a record of every breach of security safeguards involving personal information under its control, so request the record and the reasoning behind any breach judged not reportable.

Where shipment data goes

Shipment records pass between the platform, its customers and carriers, and some carriers may sit outside Canada. Map those flows. PIPEDA’s accountability principle makes an organization responsible for personal information transferred to a third party for processing, and requires it to use contractual or other means to provide a comparable level of protection while the information is being processed by a third party. Where Quebec’s Law 25 applies, the Commission d’accès à l’information says an organization must carry out a privacy-factors assessment before communicating personal information outside Québec. Ask for the sub-processor and carrier data-sharing terms and any assessments made. Ask separately what customs or border data the product transmits on cross-border moves and who is responsible for its accuracy.

What a finding can mean

Findings can land in one of three places. Cost findings, such as dead connections or deferred maintenance, can become a price conversation. Transfer findings, such as a non-assignable contract with a key shipper or credentials in a founder’s name, can become closing conditions or a covenant to fix before closing. Liability findings, such as an open dispute from an outage or an ownership gap in core code, can lead a buyer to revisit structure, seek an indemnity or reconsider. Which category a finding belongs in is a judgment for your lawyer and advisers, not a rule. The wider software checklist is in software business due diligence.