Proptech software company due diligence

A buyer under a letter of intent is no longer judging the opportunity; the task is verification. In a proptech company that means checking claims the seller believes sincerely but that rest on other people’s documents: a board’s licence, clients’ contracts, a regulator’s rules. Evidence comes in two kinds, what the seller must produce and what the buyer can check without the seller. This guide sorts the work that way, then says what some findings can mean when they appear. The general companion on software business due diligence covers the parts shared with any code-based company.

Documents to ask for

These requests are worth making in this sector, because each one sits behind a claim a seller may make.

• Every data, listing-feed and integration agreement, with renewal history and any correspondence with the grantor about ownership changes.
• A schedule of client contracts showing term, renewal date, assignment and change-of-control wording, and any termination right.
• Test, reconciliation and release records for the trust-accounting module, with the audit-trail design.
• Employee, founder and contractor agreements covering who owns the code, plus the list of third-party and open-source components and their licence terms.
• Data-processing terms with clients, the breach register, and any privacy complaints or regulator contact.

Searches a buyer can run alone

Some checks do not depend on the seller’s cooperation. A personal property search shows registered security interests. Ontario offers searches through its Access Now service, British Columbia’s Personal Property Registry records security interests and liens against personal property belonging to businesses, and Quebec keeps a register of personal and movable real rights under a Civil Code regulation. The answer on running a PPSA registry search walks through the steps. If the target or one of its people holds a registration, regulators publish lookups, such as Ontario’s Agent/Brokerage Search from RECO and Alberta’s RECA ProCheck. The Canadian Intellectual Property Office’s copyright pages describe registering an assignment or licence, so it is worth asking whether any transfer of the code was registered, although the absence of a registration proves little.

Who owns the code

Ownership of the code is a place where sincere belief and legal fact can part. The Copyright Act makes an employer the first owner of a work made by an employee in the course of employment, absent agreement to the contrary, but says an assignment is valid only if it is in writing signed by the owner of the right or the owner’s duly authorized agent. Moral rights cannot be assigned, only waived. Read each contractor’s agreement for a written assignment and a waiver, check whether founders assigned anything written before the company existed, and see who owns code written by a contractor for the default rule. A gap is a finding to resolve before closing, and the fix is a written assignment signed by whoever owns the right, or that owner’s duly authorized agent.

Privacy records and the breach register

Privacy findings are mostly about records. The Office of the Privacy Commissioner states that the law requires organizations to keep records of every breach of security safeguards for two years, whether or not the breach had to be reported, and to report to the Commissioner and notify individuals where a breach poses a real risk of significant harm. Ask to see the register. An empty one is not proof of a clean history, since it may show only that nobody was looking, while a full one is information about how the company responds. The Commissioner also notes that PIPEDA’s accountability principle leaves an organization responsible for information it passes to a processor, so read what each client agreement says about who controls the data and who reports. For Quebec clients, ask whether a privacy impact assessment preceded any transfer of data outside the province.

Testing the trust-accounting module

A buyer should have the trust module tested rather than described. Ask for a reconciliation run on a recent month’s data and compare it with the client’s own records, see whether a posted entry can be changed without leaving a trace, and check how the product keeps one client’s trust funds apart from another’s. Provincial law sets the standard the clients are held to. In British Columbia a brokerage must maintain designated trust accounts and may withdraw from them only in the circumstances the Act lists, so the question is whether the software lets a client follow the rules without workarounds. A reviewer with accounting experience in the sector can help here as well as a general software tester.

Findings that end deals, and what each one means

A data licence that will not transfer is a serious finding, because part of the product’s function may end at closing. It does not always end the deal: ask whether the grantor will issue a fresh licence to the buyer, how long that takes, and what happens to the product in the gap. A dominant client with a short or non-assignable contract means that revenue is really a negotiation, and the price or an earn-out should follow its outcome. A trust module that fails testing can move risk to the clients and later to the new owner, so remediation cost is a point for the price or the seller’s obligations. A missing signature or an unreported breach may be fixable; the practical questions are who fixes it, and whether before or after closing.