Micro-SaaS product due diligence

Due diligence changes the job from judging a product to proving it. A small software product may have few documents and no inventory to count, so the evidence can live in payout reports, a code repository, a set of platform accounts and a privacy policy. This guide goes through the checks in a suggested order and says what each gap can mean. It is written for a buyer, describes the general approach, and leaves the legal conclusions to the buyer’s lawyer.

Rebuild the revenue from the processor outward

Rebuild the revenue figure yourself rather than relying on the seller’s summary. Ask for the payment processor’s payout reports, an export of every subscription with its start date, plan, price and status, the refund and chargeback history, and the bank statements, then reconcile payouts to deposits to the books. Separate anything that is not recurring: one-time purchases, lifetime deals and annual plans paid in advance. A gap between payouts and recorded revenue means cash is being treated in a way the seller needs to explain. Check sales tax at the same time. Treadstone Law’s guide to HST on digital products describes software and subscriptions as ordinarily standard taxable supplies, with the rate tied to where the supply is considered to be made, commonly linked to the customer’s location, so ask which customers were charged what and whether the seller is registered. An under-collection is a liability question for your accountant to settle before the structure is chosen.

Trace the code to signed paper

The repository history shows who wrote what. List every contributor and match each to a document. The Copyright Act gives an employer first ownership of work an employee makes in the course of employment, absent an agreement to the contrary, and the CRA describes an employee as someone who generally works under the direction and control of the person who hired them under a contract of service. How each past helper was actually engaged therefore matters. For anyone who was not an employee, the author is the first owner, and an assignment is valid only if it is in writing and signed by the owner or the owner’s duly authorized agent. A missing assignment leaves choices to discuss with counsel: obtain a confirmatory assignment before closing, price the gap, or decline. Moral rights cannot be assigned but may be waived, so ask for waivers too. The answer on who owns code written by a contractor goes deeper.

Check the name and the domain

Confirm that the domain is registered to the seller or the company and not to a former partner or a freelancer. Then look at the product name. CIPO notes that a trademark does not have to be registered and that use over time can create common-law rights, so search the Register of Trademarks for the name and for similar ones. An unregistered name is not a defect, but it changes what the buyer is receiving and what a competitor could challenge. CIPO says trademark rights can be sold or transferred through an assignment, and advises telling the Registrar about changes in ownership.

Test control of every account

Make a list of the registrar, DNS host, cloud host, repository, payment processor, app-store account, email service, analytics and monitoring tools. For each, ask whose name it is in, who holds the administrator login, and whether the recovery email or authentication device belongs to the founder personally. Then ask for a supervised dry run in which the buyer is added as an owner. Whether a provider permits an account to change hands is set by its own terms, so a processor account that cannot move means billing has to be rebuilt under a new account, which becomes part of the closing plan and not an afterthought.

Compare privacy practice with the paperwork

Read the privacy policy and terms of service against what the software actually collects, where it stores it and which outside services touch it. PIPEDA leaves an organization responsible for personal information it has passed to a third party for processing, so the list of processors matters. The Act also requires an organization to keep a record of every breach of security safeguards involving personal information under its control, and to give the Privacy Commissioner access to it on request, so ask for the record and test any claim that nothing has happened against support emails and server logs. Customer lists need one more question: how the addresses were collected and what people were told. Under PIPEDA’s business-transaction rule, a buyer’s continued use of customer information without fresh consent depends, among other conditions, on using it only for the purposes it could already be used for, so a new use of the list is a separate question.

For Quebec users, check whether the product has what the Commission d’accès à l’information describes: a published privacy policy, the published title and contact details of the person in charge of protecting personal information, a register of confidentiality incidents, and an assessment of privacy factors before data leaves Quebec.

Search for liens

Personal property registries are provincial. British Columbia’s records security interests and liens against personal property belonging to businesses and individuals under its Personal Property Security Act, and Alberta advises searching its registry before buying personal property. Search the seller, whether a company or an individual, in the province where it is based. If the search shows a lender’s registered security interest over the seller’s assets, ask your lawyer how it will be discharged or otherwise dealt with before closing. The answer on running a PPSA search walks through the steps.

Findings that can change the deal

• Payouts that do not reconcile to the revenue the seller reported.
• A contributor who wrote core code and signed nothing.
• A payment, hosting or app-store account tied to the founder personally that the provider will not move.
• A privacy policy that describes practices the product does not follow.
• No breach record, alongside evidence that an incident occurred.