.jpg)
What Documents Do I Need to Sell a SaaS Company? The Data Room Specification
What documents do I need to sell a SaaS company is a question with a longer answer than most founders expect, and the length is not the hard part. Buyers ask for somewhere between sixty and a hundred documents across eight folders. Almost every founder has most of them somewhere. What decides whether diligence runs smoothly is the form they arrive in.
A monthly profit and loss statement exported as a PDF and the same statement as a spreadsheet with the formulas intact are the same information and a completely different document. One can be interrogated, the other has to be rebuilt by hand. Multiply that across sixty files and you have the difference between a review that takes six weeks and one that takes four months.
So this page is a specification rather than a list. For each folder: what goes in it, the form a buyer expects, who produces it, and when in the process it gets requested. If you are earlier than that and still working out what to fix rather than what to file, start with how to sell a SaaS business for the process around all of this, and our SaaS exit planning overview for the strategic groundwork.
The short answer, and the three tests every document has to pass
A document is ready when it passes three tests: the right format, a current vintage, and a named producer who can defend it. Presence in the folder is not the same as readiness.
Format means machine-readable and interrogable. Spreadsheets as spreadsheets with working formulas, not flattened exports or scans. This has become more consequential than it sounds: McKinsey's February 2026 M&A report finds deal cycles running 10 to 30 percent faster where AI tooling is applied to diligence and document review, and that speed only reaches sellers whose files can actually be parsed.
Vintage means current to within the reporting cycle. Financials no more than one month stale, a cap table reflecting every issuance to date, security evidence still inside its validity window.
Provenance means a named person who produced the document and can answer questions about it. Your accountant owns the financial folder, your lawyer owns corporate and IP, your technical lead owns architecture and security. Assigning owners before the requests arrive is what keeps a diligence list from routing everything through the founder.
.png)
Folder one: corporate and ownership
This folder is short and it is the one that stops a deal dead if it does not reconcile. Certificate of incorporation and any amendments, bylaws or operating agreement, the current cap table, the stock ledger, board and shareholder consents, and every prior financing document including SAFEs, convertible notes and option grants.
The test is arithmetic. Fully diluted ownership has to sum to exactly 100% and every instrument in the folder has to appear in that calculation. Verbal promises of equity, an advisor who was told they would get half a point, an option grant approved by email but never documented: each of those is a gap between what the cap table says and what the company actually owes, and each becomes a purchase price adjustment once found.
For SaaS companies with venture backing, add the rights that come with it. Preferred stock terms, liquidation preferences, protective provisions, drag-along and tag-along rights, and any consent thresholds that determine who has to approve a sale. A buyer needs to know who can block the transaction before making an offer, and so do you.
Folder two: financial
The largest folder and the first one requested after an NDA. Thirty-six months of monthly profit and loss statements on an accrual basis, or since inception if the company is younger. Monthly balance sheets and cash flow statements over the same period. A deferred revenue schedule. Revenue broken out by customer and by product line. Bank statements and payment processor statements that reconcile to the stated revenue. Federal and state tax returns for three years.
Two specifics matter more than the rest. The recurring versus non-recurring split needs to be explicit in every report, because setup fees, professional services and one-off migrations are valued very differently from subscription revenue. And the deferred revenue schedule needs to show the liability properly, so an annual prepayment collected in January is not presented as January performance. Our guide to the metrics that drive SaaS valuations covers how each line gets treated.
Audited statements are not typically required below roughly $25 million in enterprise value. Reviewed or compiled statements from a credentialed accountant carry most of the weight at SaaS deal sizes, and a sell-side quality of earnings report does more for credibility than an audit at the same cost.
Folder three: revenue, customers and contracts
Every material customer agreement, the standard terms of service, the master services agreement template, and any order forms or statements of work that vary from the template. Alongside them: a cohort export showing revenue by signup month, gross and net revenue retention with the calculation method written down, and a schedule of the top customers by revenue with contract dates and renewal terms.
Two flags belong on the contract schedule from the start. Which agreements contain change-of-control or anti-assignment clauses requiring consent before the contract transfers, and which contain unusual terms a buyer will price: uncapped liability, most-favoured-nation pricing, perpetual discounts, or termination for convenience on short notice.
That schedule does double duty. It tells a buyer what they are acquiring, and it tells you which consent conversations to start early. Each consent is a signature on somebody else's calendar, and they are the most common reason a closing date moves. Our breakdown of SaaS valuation multiples by ARR, growth and retention shows how far apart contract quality prices the same revenue.
Folder four: technology, security and data protection
This is where SaaS diligence has concentrated. In SRS Acquiom's 2026 survey of 150 senior dealmakers, 84% expect greater scrutiny of cybersecurity diligence and 51% already call technology diligence the most demanding part of the review.
The technology set: an architecture overview short enough to read in ten minutes, a dependency inventory covering third-party services and licences, open-source components with their licence obligations identified, infrastructure and hosting agreements, and a summary of the development process and release cadence. The security set: a SOC 2 report where one exists, penetration test results, a data handling and encryption map, an incident log, and business continuity documentation.
Then the document that SaaS sellers forget most often. If you process personal data on behalf of your customers, you are a processor, and Article 28 of the GDPR requires that the relationship be governed by a written contract, in writing including electronic form, stipulating eight specific things: that you process only on documented instructions, maintain confidentiality, implement security measures, follow the rules on engaging sub-processors, assist with data subject requests, help demonstrate compliance, submit to audits, and delete or return the data when the service ends.
In practice that means two artifacts: your customer-facing data processing agreement, and a current sub-processor register with a signed agreement for each one. Every analytics tool, email provider and hosting service that touches customer data belongs on it. Assembling this from nothing during diligence is slow, and a gap in it is a compliance exposure a buyer will want indemnified. The SaaS due diligence checklist for buyers shows how the other side works through this material.
Folder five: intellectual property and people
Trademark registrations, domain registrar records, the source code repository history, and a signed copyright assignment from every person who has contributed to the codebase. That last item deserves particular attention.
Founders routinely assume a paid contractor produced a work made for hire, so the company owns the copyright. The US Copyright Office states a narrower rule: outside employment, a commissioned work qualifies as made for hire only if it falls within one of nine listed categories and the parties expressly agree in a signed written instrument. Those categories cover things like translations, compilations, tests and instructional texts. Software is not among them. So for contractor-written code the document that actually transfers ownership is a written assignment of copyright, not a work-made-for-hire clause. Confirm the position with your own counsel, and audit every contractor and agency now rather than once a buyer is waiting.
On people: the org chart, employment agreements, contractor agreements, confidentiality and invention assignment agreements, the option plan with its grant ledger, and a note on any key-person concentration with what covers it. Buyers are pricing the business they can run, so the documentation showing it runs without any single individual is part of the valuation, not administrative overhead.
The documents that appear late and take the longest
Three sets of documents do not exist until the deal is underway, and each one has caught sellers out.
Disclosure schedules are the first. They are the lists of facts and exceptions attached to the representations and warranties in the purchase agreement: every material contract, every claim, every exception to a promise the agreement makes. Melissa Sawyer, Global Co-Head of M&A at Sullivan & Cromwell, notes in the Harvard Law School Forum on Corporate Governance that disclosure schedules can take weeks to put together while the merger agreement itself can be drafted and negotiated in days, and that they are almost always the workstream that has the deal team pulling an all-nighter on the eve of signing. Her argument is that they are inefficient and should be trimmed, which is a critique rather than permission to skip them, and in private SaaS deals they remain standard. The practical lesson is that they draw directly on folders one through five, so a complete data room converts weeks of schedule preparation into days.
Representations and warranties insurance is the second. Where a buyer uses it, the underwriters review your data room too. SRS Acquiom puts formal underwriting at one to two weeks with preliminary quotes in two to four business days, premiums around 3% to 4% of the insured amount and a retention of roughly 1% to 2% of transaction value. That timeline assumes the documents are already there.
Third, the closing set. Alongside the purchase agreement and assignments, US asset sales bring a tax filing that surprises people: the IRS requires that both the seller and the purchaser file Form 8594 where goodwill or going concern value attaches to the assets, allocating the purchase price across asset classes. Both sides must report the same allocation, so it is negotiated as part of the deal rather than filed independently afterwards. Deloitte puts the median gap between signing and closing at about three months, and this paperwork is what fills it.
The document index
The full specification in one place. The format column is the part worth acting on, because it is where most otherwise-complete data rooms lose weeks.
From a document list to a deal that moves
What documents do I need to sell a SaaS company has a straightforward answer and a demanding standard behind it. Eight folders, sixty to a hundred files, each in a format a reviewer can work with, each current, each owned by someone who can defend it. Datasite's data puts median data room assembly at 12 days, which is achievable precisely because it assumes the underlying documents already exist in the right form. Building them during diligence is what turns twelve days into three months. Our note on planning the timing of a business exit and our mid-year 2026 tech M&A report cover when to start and what buyers are currently paying for.
FE International has completed more than 1,500 transactions since 2010 with a 94.1% success rate on private sales and acquisitions, and we handle SaaS sales end to end, including building the data room with you. If you want to know which of these eight folders is thinnest in your case, that is the quickest conversation to have.
