Selling a SaaS or Subscription Business: Valuation, Diligence, and Process

A SaaS or subscription business is a fundamentally different asset from a traditional services or product company, and the M&A process that produces the best outcome for a recurring revenue founder looks different from a standard lower middle market sell-side process. The valuation framework, the buyer universe, the diligence requests, and the metrics that drive or destroy value are distinct enough that preparing a SaaS business for sale using the same playbook as an EBITDA-based business almost always produces a suboptimal result.

The core difference is that buyers of recurring revenue businesses are underwriting the quality, durability, and expansion potential of the revenue base, not a point-in-time earnings figure. A business with $5M ARR, 115% net revenue retention, 82% gross margins, and 30% growth is a different asset than a $5M EBITDA manufacturing business at 15% margins, even if they trade at comparable dollar values. The metrics that communicate quality are different, the diligence process that validates them is different, and the buyers who are best positioned to pay the highest price are different.

This guide covers what recurring revenue founders need to understand before entering a sale process: how buyers value SaaS businesses, which metrics drive the multiple, how diligence is structured, and what preparation work produces the best outcome.

How buyers value SaaS and subscription businesses

The primary valuation framework for SaaS and subscription businesses is an ARR (annual recurring revenue) multiple, not an EBITDA multiple. Buyers assess the quality of the ARR base, its retention, expansion dynamics, gross margin profile, and growth trajectory, and apply a multiple to current or forward ARR. For lower middle market SaaS businesses ($3M–$15M ARR), ARR multiples at close typically range from 3x to 8x, with the spread driven by the metrics described below.

For lower middle market SaaS businesses that are also EBITDA-positive, buyers will often present both frameworks and use the one that produces the lower value. A business generating $1.5M of EBITDA on $6M ARR might trade at 8x EBITDA ($12M) or 4x ARR ($24M) depending on which framework the buyer uses. Recognizing this dynamic, and positioning the business against the ARR framework when the metrics support it, is a core objective of the sale process.

The metrics that determine your multiple: NRR, GRR, churn, and cohorts

Net revenue retention (NRR) is the single most important metric in a SaaS diligence process. NRR measures what percentage of last year's ARR from existing customers is still generating revenue this year, including expansion from upsells and cross-sells, minus contraction from downgrades, and minus churn from cancellations. An NRR above 100% means the existing customer base is growing without any new logo acquisition. An NRR of 120% means that for every $100 of ARR from customers who were paying one year ago, those same customers are now paying $120.

Gross revenue retention (GRR) measures the same dynamic but excludes expansion, it is pure retention. GRR can never exceed 100%. The gap between NRR and GRR reveals the expansion engine: a business with 88% GRR and 115% NRR has significant expansion revenue offsetting material churn. A business with 96% GRR and 96% NRR has excellent retention and minimal expansion. Both are good businesses, but they have different growth profiles and diligence stories.

Cohort analysis is how buyers validate the retention metrics. Rather than accepting headline churn numbers, buyers decompose the customer base by acquisition vintage (all customers acquired in Q1 2022, Q3 2022, etc.) and track what percentage of each cohort's ARR survived through each subsequent quarter. This analysis reveals whether retention has been improving or degrading over time, whether early cohorts are churning at higher rates than recent ones (suggesting product-market fit has improved), and whether the reported NRR is consistent across vintages or concentrated in a few high-expanding customers masking broad underlying churn.

Customer contract diligence: the SaaS-specific closing risk

Customer contract transferability is a diligence risk unique to SaaS and subscription businesses that traditional M&A advisors often underestimate. Enterprise software agreements frequently contain change-of-control provisions that require the customer's written consent before the agreement can be assigned to a new owner. If a material percentage of ARR is concentrated in contracts with assignment restrictions, the transaction faces a specific closing risk: a customer who refuses consent can walk away from a multi-year agreement without penalty.

The risk is not theoretical. In lower middle market SaaS transactions, change-of-control consent requirements in enterprise contracts are common, and customers who are not satisfied with the existing product, who have been negotiating price reductions, or who are mid-way through evaluating alternatives use the change-of-control event as an opportunity to exit. The loss of a customer representing 8–12% of ARR at closing creates both revenue impairment and a renegotiation event with the buyer around the working capital peg or purchase price.

Technology diligence: what buyers actually assess

Technology diligence in a SaaS acquisition is more intensive than in a traditional services or product company sale. Buyers, particularly strategic acquirers and PE sponsors with existing software platforms, want to understand the quality of the codebase, the scalability of the infrastructure, the security posture, and the depth of technical documentation. Founders who have built functional products without institutional engineering practices often discover that technology diligence surfaces issues that either delay closing or justify price adjustments.

SOC 2 Type II certification is increasingly a buyer expectation in SaaS diligence, particularly when the customer base includes enterprise accounts. A SOC 2 Type II audit demonstrates that the company has maintained documented controls around security, availability, and confidentiality over a defined period, typically 6 to 12 months. Pursuing SOC 2 certification in the 12–18 months before a sale process is one of the highest-return preparation investments available to a SaaS founder because it both clears a common diligence obstacle and signals institutional process discipline to buyers.

The buyer universe and process strategy for recurring revenue businesses

The right buyer universe for a SaaS or subscription business depends on the size, growth profile, and strategic fit. For lower middle market recurring revenue businesses ($3M–$15M ARR), there are three primary buyer categories, each with different pricing frameworks, due diligence intensity, and post-close integration expectations.

The process strategy for SaaS businesses differs from traditional lower middle market auctions in several ways. The buyer universe is often smaller, there are fewer buyers in the market for a $5M ARR vertical SaaS business than for a $5M EBITDA services business. The management presentation is heavier on product demonstrations and technical architecture than on financial analysis. And the negotiation dynamics often involve earn-out structures tied to ARR or NRR targets rather than EBITDA thresholds, reflecting the forward-looking nature of the revenue base.