Vertical SaaS platform due diligence

A buyer under a signed letter of intent is no longer judging whether the platform is attractive. The job now is to confirm that what was described exists on paper and in the systems. For a vertical platform that means following five trails: who owns the code, who has a claim on the assets, which contracts survive a change of owner, whether the compliance claims are true, and what the privacy record shows. Each trail ends in a document or a registry search, and each can produce findings that change the deal. This guide takes them in that order.

Trace the ownership chain for every connector

Ask for a list of everyone who has written code for the product, with the agreement each person signed. Under the Copyright Act an employer is first owner of what an employee makes in the course of employment unless there is an agreement to the contrary; that rule does not mention contractors, and an assignment must be in writing and signed by the owner of the right or the owner’s duly authorized agent. Moral rights can be waived but not assigned. Look hardest at the connectors if outside developers built them. CIPO lets an assignment of copyright be registered, and its trademarks guide says you should formally tell the Registrar about changes in ownership to avoid ownership disagreements. A connector with no signed assignment from its author is a finding to look for. It means the company may not own that piece outright, so the options include obtaining the assignment before closing or adjusting the price. The CRA also says all the facts, including the actual terms and conditions of the work, decide whether a worker is an employee, not only what the parties intended, so long-standing contractors who work under direction deserve a look.

Search the registers for claims against the assets

A registry search can show whether a lender has registered a security interest against the company. Ontario’s Personal Property Security Act defines an intangible as all personal property, including choses in action, that is not goods, chattel paper, documents of title, instruments, money or investment property, and the province’s Access Now service can be used to find out whether a lien has been filed. British Columbia and Alberta run their own personal property registries, and Quebec has a register of personal and movable real rights. Which registers to search depends on where the company has operated and holds its assets, which is a question for the buyer’s lawyer. Ontario’s guidance, written for buyers of used goods, is that if the loan behind a registration has been repaid, the buyer should insist that the seller require the lender to promptly register a discharge before the sale is completed; a business buyer can ask the same, and a live loan raises the question of how the lender will release its interest at closing. The answer on running a PPSA registry search goes through the steps.

Read a sample of contracts against the billing

Pull the contracts for the largest accounts and a sample of the rest, then reconcile them to invoices. The aim is to confirm the revenue is real and to read the clauses that move with ownership: assignment, change of control, termination for convenience, price-protection promises and data-processing terms. Under PIPEDA an organization that transfers personal information to a third party for processing must use contractual or other means to provide a comparable level of protection, so ask whether a data-processing addendum or similar terms exist wherever the platform holds a customer’s own client records, and what happens to them on a change of control. Then read the partner and association agreements and the terms governing each connection to another vendor’s system. Ask the partner to confirm in writing where things stand.

Test the compliance claims

The marketing is evidence. If the site says the product meets an industry’s record-keeping or reporting standard, ask what supports it: test results, an audit, a customer’s sign-off. The Competition Bureau says it is against the law under the Competition Act to advertise or market something in a way that is false or misleading, and that courts look at the general impression a claim conveys. An unsupported claim is more than a sales problem. Whether a buyer would take on that exposure depends on the deal structure, a question for the buyer’s lawyer, and customers may have relied on a feature that does not do what they believe. Where the vertical is health, an Ontario custodian’s obligations under PHIPA continue until a legally authorized successor has custody and control of the records, so ask how the platform handles retention, access requests and return of records for those customers.

Read the privacy and breach records

Ask for the breach record. PIPEDA requires an organization to keep a record of every breach of security safeguards involving personal information under its control, whether or not it had to be reported, and the Office of the Privacy Commissioner says the law requires those records to be kept for two years. Breaches creating a real risk of significant harm must be reported to the Commissioner and the individuals notified. Compare the record with support tickets, incident emails and any status page; a gap between them is the finding. For Quebec data, ask for the privacy impact assessments behind any hosting or support outside Quebec, and for the named person in charge of privacy. Finally, rebuild recurring revenue from bank deposits and invoices, and ask for SR&ED claim files and any CRA review correspondence; the CRA’s SR&ED pages set out what to do if a claim needs a review.

Findings to raise before closing

• An integration written by a contractor who cannot be found or will not sign an assignment
• A channel partnership or association endorsement that lapses on a change of control, with no route to renew it
• Compliance claims in the marketing that the product does not actually meet
• A breach record that does not match the incident evidence found in tickets and emails
• Customer contracts that let most revenue leave on short notice when the owner changes