Selling a developer tools or API business in Canada

An owner who has decided to sell a developer tools or API business is selling two things at once: the code and contracts, and the access that makes them work. Much of the second lives in logins. The cloud account, the billing platform, the package-registry publisher account and the signing keys may sit with one person, and a buyer needs them in the company’s hands, able to pass over without an outage, to run the service after closing. Because customers build the product into their own systems, the order of preparation matters as much as the price. This guide follows that order, from tidying accounts through disclosure to the cutover.

Move every login and key into the company first

List every account the service depends on, then confirm in whose name each is held: cloud hosting, the billing and payments platform, the domain registrar and DNS, the code host, the registries where your SDKs are published, monitoring and the status page. Anything in a founder’s personal name should move into the company before a buyer sees the business, so the company can show it holds what it is selling. Plan key handling too. Customers hold API keys you issued, so decide how issuing authority, signing secrets and webhook endpoints will pass to the buyer, and how keys can be rotated without breaking anyone’s production calls. Our answer on transferring domains and software licences covers the mechanics.

Make the metering reproducible

The revenue should be rebuildable from the raw numbers. Before listing, reconcile usage logs to invoices for a run of months and write down how billing and rate-limiting work, including tier boundaries, overage rules, credits and any exceptions granted to individual customers. Put the versioning and deprecation policy in writing, with a changelog, so the buyer can see how you have treated developers over time. BDC notes that buyers ask to see historic and interim financial statements, projections and tax returns, and that unaddressed issues complicate a sale because the buyer has to think about resolving them without the seller’s knowledge of the business. Gaps you find now can be fixed or explained, which is easier than answering for them after a buyer’s engineers find them.

A workable order for the sale

1. Tidy ownership: accounts in the company’s name, contracts reviewed for assignment and change-of-control terms, and written assignments from any contributor who was not an employee, because the Copyright Act makes an assignment invalid unless it is in writing and signed by the owner or the owner’s duly authorized agent.
2. Prepare a data room that shows aggregated, de-identified usage rather than customer personal information.
3. Sign a confidentiality agreement before any detailed disclosure and release information in stages.
4. Agree a letter of intent, then answer technical and legal diligence while keeping the developer community unaware.
5. Settle the cutover plan: which accounts move on closing day, which keys rotate, and who is on call during the transition.
6. Close, then run the planned handover and the customer communication.

Privacy rules decide what a buyer may see

Developer accounts, usage logs and any customer data your service touches can contain personal information, and showing it to a prospective buyer is regulated. Under section 7.2 of the federal PIPEDA, organizations that are parties to a prospective business transaction may use and disclose personal information without the individual’s knowledge or consent if they have entered into an agreement requiring the recipient to use and disclose it solely for purposes related to the transaction, protect it with appropriate safeguards and return or destroy it within a reasonable time if the deal does not proceed, and the information is necessary to decide whether to proceed and, if the parties do, to complete the deal. The section does not apply to a transaction whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information itself.

Quebec has its own rules. Its Commission d’accès à l’information lists, among the changes made by Law 25, a provision allowing a business, under certain conditions, to communicate personal information without consent when that is necessary to conclude a commercial transaction, and it says an organization must carry out a privacy impact assessment before communicating personal information outside Québec. Where Quebec users or developers are involved, have counsel confirm which conditions apply. See also privacy obligations when a tech company is sold.

What can hold up a close

Check how each platform handles a change of ownership, and read customer and vendor agreements for assignment and change-of-control terms before a buyer does, since an upstream vendor you depend on may need to consent before its contract can pass. Government incentives need attention too. The CRA says you can submit an SR&ED claim with your income tax return and explains what to do if a claim needs a review, so have your filed claims and any CRA correspondence ready for the buyer’s adviser rather than reconstructing them during diligence. Finally, a buyer may want you available afterwards. BDC notes that for an owner who wants the business to carry on there can be a benefit to staying involved, such as through vendor financing, an earn-out or a phased transfer, and that buyers may insist on a reduced price if you cut all ties.