What to put in a data room when selling a SaaS

A data room is where a buyer's questions get answered before they have to ask them. In small SaaS deals, the price is rarely what kills a sale. What kills it is a slow, messy diligence process: numbers that change between the teaser and the spreadsheet, a missing contractor agreement, a founder who takes four days to find last year's bank statements. By then the buyer has cooled off or found a cleaner deal.

A good data room lets a serious buyer go from "interesting" to a signed letter of intent (LOI) without forty emails. This guide covers what goes in it, in what order, and what to hold back.

Stage what you share

Not everything belongs in front of every buyer. Most small business sales move through three levels of disclosure, and your data room should mirror them.

The logic is simple. A tire-kicker should learn enough to decide whether to sign an NDA. An NDA-signed buyer should learn enough to make an offer. Only a buyer who has committed to terms needs the things a competitor could use against you. If you are unsure how the NDA stage works, read how NDAs work in small business sales.

The summary page

Start with one page a buyer can read in three minutes:

• What the product does and who pays for it
• When it started, and how many people work on it (including you and contractors)
• Trailing twelve month revenue, current MRR, and profit or seller's discretionary earnings (SDE)
• Why you are selling
• Exactly what is included: code, domains, customer accounts, trademarks, social accounts, email list, content
• What transition help you are offering, and for how long

Every number on this page must match the detailed files behind it. Buyers check, and a mismatch on page one colors everything that follows.

Financials

This is the folder buyers spend the most time in.

• Monthly profit and loss statement for the last 24 to 36 months. Say whether it is cash or accrual basis. Monthly, not annual, because buyers want to see trends and seasonality.
• Add-backs, itemized. If you are presenting SDE, list every adjustment with a one-line reason: your own salary, a one-off legal bill, a conference you attended for fun. Vague add-backs are the first thing a buyer's accountant challenges.
• An expense list. Every recurring cost, the vendor, the monthly amount, and whether it transfers with the business or is tied to your personal account.
• Tax returns for the business, where the entity files them.
• Bank statements for the account that receives revenue. Hold these until stage 3, but have them ready.

Keep personal spending out of the business accounts if you can. If you cannot, mark it clearly. A buyer finding your grocery bill in the P&L is not a disaster, but it makes them wonder what else is mixed in.

Revenue and metrics

For a SaaS, the P&L is not enough. Buyers want to understand the revenue engine.

• MRR by month, split into new, expansion, contraction and churned
• Active paying customers by month
• Logo churn and revenue churn, with how you calculate them
• Plan mix, and the share of revenue on monthly versus annual billing
• Refunds and disputes by month
• Revenue concentration: what share of MRR comes from your top 1, 5 and 10 customers (anonymized until stage 3)
• Revenue by country, if you sell internationally

The source matters as much as the number. A spreadsheet you typed is a claim. An export from your billing system, or a read-only connection to it, is evidence. Buyers have learned that screenshots are easy to edit, and they will discount anything they cannot trace back to a system of record. See how buyers verify MRR for what they will do with these numbers.

Product and technology

• A short architecture overview: stack, hosting, database, major third-party services
• Monthly infrastructure and tooling costs
• Every external API or service the product depends on, and which ones are registered to you personally
• How deploys work, and who can do them
• Known bugs, technical debt, and anything you would fix if you had another six months
• Security incidents, if there have been any, and what you did about them
• Uptime history, if you track it

Full code access usually comes after the LOI. Before that, a recorded walkthrough or a screen share answers most questions without handing over the repository.

Legal and IP

• Entity documents and who owns the entity
• Proof that the business owns its code: IP assignment or work-for-hire language in every contractor agreement
• Open source licenses used in the product, especially any copyleft licenses
• Trademarks, domain registrar account ownership, app store accounts
• Your terms of service, privacy policy, and any data processing commitments you have made to customers
• Any past or pending disputes, claims or threatening letters

Missing IP assignments from early contractors are one of the most common problems found in small SaaS diligence. If you find a gap, fix it before you list, not after a buyer finds it.

Operations

• What you do each week, and roughly how many hours it takes
• Written procedures for recurring tasks: support, billing issues, deploys, onboarding
• Support volume and the most common ticket types
• Contractors, what they do, what they cost, and whether they are willing to stay
• The full list of tools and accounts that will need to be transferred

Marketing and traffic

• Traffic by channel from Google Analytics, for at least 12 months
• Top landing pages and top converting pages
• Search performance, if organic search matters to the business
• Paid spend and what it produced, if you run ads
• Email list size and engagement, and how subscribers were collected

What to leave out

Do not put passwords, API secrets, raw database dumps, or customer personal data in a data room at any stage. Credentials transfer at closing, through a proper handover. Customer lists with names and emails belong in stage 3, and even then, only what the buyer needs.

Keep it current and keep a log

Update the numbers monthly while the business is listed. A data room frozen in March makes a buyer in June wonder what happened since. Keep every buyer question and your answer in one place, so the second buyer gets the same answer as the first and you are not rewriting it from memory. Before you open the room, run through the due diligence checklist buyers use and fill the gaps you find.

Build it once, share it per buyer

Arrhis was built for exactly this. You connect Stripe, your bank and Google Analytics with read-only access, upload the rest, and send each buyer their own link. They see the teaser, sign the NDA in the page, and only see customer names and bank statements after you mark their LOI signed. Every number says where it came from. Create a deal room, look around the demo room first, or see what a room pass costs.