9 Red Flags to Watch for When Doing Due Diligence on a SaaS Startup

Key points

• Due diligence exists to confirm a SaaS startup is worth its asking price and that nothing nasty surfaces after closing.
• Most red flags are fixable if you catch them early; they cost you leverage, time, or purchase price rather than the whole deal.
• The classic signals still matter: a difficult founder, unverifiable financials, an unhappy team or customers, and non-transferable contracts.
• Two red flags are new for the AI era: code that is quietly AI-generated (“vibe-coded”), and a product AI can now replicate for free.
• The one red flag you cannot fix after closing is a business AI has already made obsolete, so weigh defensibility before you weigh the multiple.

Due diligence is how you confirm a startup supports its asking price, and that there is nothing waiting to surface after the deal closes. Skip it, and you risk acquiring a business whose economics or operations look very different once ownership changes hands.

The bar has moved since the early days of SaaS acquisitions. Buyers today move fast, the typical PE analyst can review startups faster than ever, and they are evaluating something founders three years ago did not have to think about: whether AI has made the business stronger, or made it replaceable. Here are nine red flags to watch for before you commit. (If you want the full step-by-step process alongside these warning signs, keep our due diligence checklist for buying a business handy.)

1. Can You Work Effectively With the Founder?

You do not have to become friends with the founder, but you do need a functional working relationship. If you like the look of a startup but the founder is a pain to deal with, it might be best to walk away. A troublesome founder usually leads to a troublesome acquisition; you need mutual respect and admiration to make the transition work.

Acquiring a startup is a collaboration between you and the founder.  A smooth acquisition depends on transparency, responsiveness, and enough mutual trust to complete the transaction and transition the business successfully.

2. Is the Founder Prepared for the Acquisition Process?

The acquisition process is complex, but there is a wealth of free educational content available to prepare for it. A founder does not need to be an M&A expert, but they should be prepared to answer basic questions about the business, produce relevant documentation, and understand the stages of a transaction.

Inexperience is not a red flag by itself. Repeatedly failing to produce basic information, being unorganized with documentation, and giving inconsistent answers are. A prepared founder usually has clear answers to the essential questions any acquirer will ask.

3. Are the Financials Actually Verifiable?

This is where most deals stall today. The clearest signals that a business is not ready to sell, or that something is being smoothed over, include:

• Vague answers like “I’ll have to check on that”
• Missing data or inconsistent financials
• Hidden liabilities or unclear ownership

You should be able to view the financial data (linked via Stripe, QuickBooks, ChartMogul, or similar tools) that supports the valuation and growth projections. If it is in the founder’s head instead of in a document, treat it as a risk, not an asset.  Read-only access to systems such as Stripe, QuickBooks, or ChartMogul provides stronger verification as the buyer/seller relationship continues. For the deeper version of this check, see how to pass financial due diligence.

4. Is It Too Perfect?

. Every business has risk or areas that could perform better. If materials present uninterrupted growth, perfect customers, flawless technology, and no weaknesses, dig deeper. “Too good to be true” does not automatically mean the founder is hiding something.  It may mean the information is incomplete and the seller has framed things too optimistically.

5. Will the Team Survive the Transition?

If the team is important to the business, determine who is critical and whether they are likely to stay after closing. Look for key-person dependencies, replacement costs, turnover, and roles concentrated in one or two people

Culture matters, but the acquisition question is operational. Can the business continue performing if certain people leave, and what hiring costs should you factor into the deal?

6. Are Customers Happy?

Unhappy customers are not necessarily a deal-breaker; you might turn dissatisfaction into growth. The real question is why they are unhappy, and for how long. Is it pricing, service, or product? What it costs to fix determines whether it is a red flag:

• Pricing: if a founder has been overcharging, reducing prices to drive growth could devalue the acquisition.
• Service: issues might mean hiring support staff or switching CRMs.
• Product: problems take time and resources to resolve.

Factor these anticipated costs into your offer. Watch logo churn, NRR, renewals, customer concentration, and support trends. Together they provide a much clearer picture of customer health than testimonials alone.

7. Is the Code Maintainable and Secure?

You do not want to find the tech stack crawling with bugs. Beyond unexpected behavior, bugs introduce security vulnerabilities that are difficult to isolate without outside help.

This has gotten more complicated recently. AI-assisted development is increasingly common, so the fact that AI helped produce a codebase is not a red flag alone. The risk is software that was shipped too quickly without adequate engineering controls. Ask who wrote the code, review architecture, dependencies, security practices, and deployment processes.  Ask whether anyone besides the founder understands it well enough to maintain it. If the answer is no,  price that key-person risk into the deal. A dedicated technical due diligence pass is the right tool for this.

8. Are All Partners and Integrations Transferable?

Not everything survives an acquisition; employees may leave, vendors may cut ties, and churn often rises during the transition. But if you are relying heavily on a key partnership, whether a high-value client or a critical service provider, confirm the contracts are actually transferable.

Review the relationships the business materially depends on: major customers, vendors, software providers, licenses, etc. Determine whether the relevant agreements contain assignment restrictions, change of control provisions, or consent requirements.

9. Is the Business Actually Defensible in the AI Era?

This is the newest, and arguably most important, question on the list. Some SaaS businesses have gotten stronger because AI helps them scale. Others have quietly become obsolete because their core value proposition can now be replicated by a general-purpose AI model for free.

Look for what still makes the business hard to copy:

• Proprietary customer data
• Real workflow lock-in
• Industry-specific expertise
• Strong retention
• Distribution the founder actually owns

Be cautious of a business whose main value is “connects to an AI model” or performs a task modern AI tools can now do on their own. A defensible SaaS business uses AI to get more efficient. A vulnerable one competes directly with it, and loses. For more on spotting durable moats, see our guide on why buy a SaaS business in the AI era, and how AI is changing due diligence itself.

The Bottom Line

Most of these red flags are fixable if you catch them early; they just cost you leverage, time, or purchase price if you do not. The one thing that is not fixable after closing is a product AI has already made obsolete. Weigh that risk before you weigh the multiple.

Ready to put this checklist to work on real deals? Browse vetted SaaS companies for sale on Acquire.com, or create a free buyer account to start diligence with instant alerts on new listings.

Frequently Asked Questions

What are the biggest red flags in SaaS due diligence?

The most common are unverifiable or inconsistent financials, key-person dependency, weak customer retention, unresolved legal issues, non-transferable contracts, and technical debt the buyer cannot reasonably maintain. Increasingly, buyers should also test whether AI is strengthening or commoditizing the business’s value proposition. 

What does due diligence on a SaaS startup involve?

It is the process of verifying that a SaaS business is worth its asking price and that no hidden problems will surface after closing. That means confirming the financials against live data sources, assessing the team and customers, reviewing the code and integrations, and judging how defensible the business is against AI.

Are AI-generated code and “vibe-coded” products a real risk?

No, AI-assisted development is not inherently a red flag. AI-assisted code risk arises when rapid development substitutes for code review, security testing, and documentation.  The buyer should ask who wrote the code, how much was AI-assisted, and whether someone beyond the founder understands it. If not, price in the cost of a rebuild.

Which SaaS red flags are deal-breakers versus fixable?

Most are fixable if caught early; they cost you leverage, time, or purchase price, not the deal. Unhappy customers, service gaps, and even messy financials can often be renegotiated or repaired.  Problems affecting ownership of the IP, regulatory ability to operate, or the long-term viability of the product can be much harder to overcome.

Founders are seldom out to trick buyers. Yes, you might find a bad egg or two, but they’re easy to spot: they might be evasive under questioning or overconfident and bullish. Nevertheless, you’ll find many who’re helpful and collaborative, too. Use the red flags above to help you distinguish between them. 

Learn more about how to de-risk acquisitions on our blog.

---

The content on this site is not intended to provide legal, financial, or M&A advice. It is for information purposes only, and any links provided are for your convenience. Please seek the services of an M&A professional before any M&A transaction.