Use this checklist before purchasing a SaaS source-code product. Record the answer and evidence for every item rather than relying on a sales-page summary.
Product and code
Confirm repository access, framework versions, licence terms, automated tests, deployment documentation, sample data and the exact modules included.
Security and data
Review authentication, authorization, secrets handling, file uploads, backups, logs, dependency updates and privacy responsibilities. Confirm that test credentials and production data are not included in the transfer.
External dependencies
List payment, email, storage, AI, analytics and data APIs. Confirm whether each service can be transferred or must be replaced with the buyer's own account.
Handover
Agree on repository transfer, domain or brand files, deployment support, documentation, walkthrough time and the support window after delivery.
Evidence to retain during SaaS due diligence
Keep a dated evidence register for repository access, licences, dependency versions, security review, sample deployment, data export, backup restore and credential transfer. Record who checked each item, the source they reviewed, unresolved questions and the owner of the next action. A checked box without retained evidence is not a completed technical review.
Run a buyer-controlled verification
Install or deploy the product in an environment controlled by the buyer, using buyer-owned service accounts and fictional data. Verify the documented setup, key roles, a normal workflow, a correction or failure path, export and restore. Scope specialist legal, security and financial review separately where the purchase risk requires it.
Frequently asked questions
Is a demo enough for due diligence?
No. A demo proves an interface exists. Buyers should also review the transfer package, dependencies, architecture and deployment needs.
Who pays for third-party services?
Unless stated otherwise, the buyer opens and pays for their own provider accounts after transfer.