Seller-side due diligence: what acquirers will examine, and how to prepare

Due diligence is the most feared phase of a sale, and the most poorly prepared. According to Hampleton Partners 2025 data, 40% of tech M&A transactions see the price revised downward during due diligence, and 12% result in deal abandonment. Almost all of these situations are avoidable with structured seller-side preparation. This guide details what the acquirer will look for in each dimension.

The ideal data room: complete list

• Legal documents: updated articles of association, company registration, cap table, shareholder agreement, general meeting minutes for the last 3 fiscal years, employment contracts and team NDAs.
• Financial documents: certified 3-year accounts, aged client receivables, N+1 budget, MRR/ARR bridged month by month over 24 months, client contract list with renewal dates.
• Technical documentation: system architecture, dependency inventory (third-party libraries, licences), API documentation, backup and disaster recovery policy, pentest results < 18 months.
• IP documents: registered trademarks with registration numbers, contractor contracts with rights assignment clause, original software certificates, domain name registry.
• HR documents: org chart, key job descriptions, compensation policy, profit-sharing/BSPCE agreements in force, any non-compete clauses.

Code review: what the buyer will find

Technical due diligence systematically includes a code review by an independent firm mandated by the acquirer. What reviewers look for: (1) measurable technical debt (test coverage ratio, dependency age, presence of linters/formatters); (2) architecture scalability (monolith vs microservices, cloud-native or legacy); (3) application security (OWASP Top 10, secrets management, sensitive data encryption); (4) code documentation (README, comments, OpenAPI). An asset with < 30% test coverage and no documented CI/CD will be systematically discounted.

IP: the 5 issues that collapse a deal 15 days before closing

• Contractors without rights assignment contract: code written by a freelancer without an assignment clause legally belongs to the freelancer, not the company. Present in 43% of assets submitted to Aegryn.
• Trademark not registered in relevant classes: an acquirer cannot secure their investment on an unprotected brand. Registration delay: 6–8 months in FR/EU, must be anticipated.
• GPL dependencies in the codebase: GPL (GNU General Public License) licences are copyleft, they contaminate all code that integrates them. An acquirer who discovers undocumented GPL dependencies can require their replacement before closing.
• Personal data processed without documented legal basis: in GDPR due diligence, the absence of a processing register, compliant privacy policy or DPA with sub-processors is a blocker for institutional acquirers.
• Undisclosed ongoing litigation: any active dispute (client, contractor, employee) must be declared in the data room. Litigation discovered during or after due diligence is a legal basis for SPA resolution or price reduction via escrow.

Finances: how to present your metrics

The golden rule: rigorously separate recurring ARR from non-recurring revenues. Anything that is not an automatically renewable subscription must not be included in ARR. PE acquirers and their advisors systematically dissect MRR bridges month by month, they identify expansion revenues, churns, upgrades and downgrades. "Inflated" ARR is detected in less than two hours of analysis and triggers irreversible loss of trust.